chore(reconcile): integrate upstream v1.1.0 with fork behaviors retained

.env.example

@@ -24,6 +24,22 @@ SANDBOX_RUN_CPU_TIME=10000
 SANDBOX_RUN_TIMEOUT=15000
 SANDBOX_OUTPUT_MAX_SIZE=65536
 
+# Docker Compose keeps hardened mode enabled. Its API exposes bridge routes even
+# with the default HTTP sandbox backend, so configure a private enrollment token
+# of at least 32 bytes before starting Compose (generate with: openssl rand -hex 32).
+# Do not use a shared example token. These defaults accept paired dynamic workers;
+# enrollment still requires the token. Never provide this token to sandbox code.
+CODEAPI_BRIDGE_TOKEN=
+CODEAPI_BRIDGE_AUTH_MODE=paired
+CODEAPI_BRIDGE_DYNAMIC_WORKERS=true
+# For a fixed worker, set DYNAMIC_WORKERS=false and WORKER_ID to that worker's ID.
+CODEAPI_BRIDGE_WORKER_ID=
+
+# Remote stateful code bridge (Code API deployment)
+# CODEAPI_SANDBOX_BACKEND=remote-bridge
+# CODEAPI_EXECUTION_PROFILE=stateful
+# CODEAPI_RUNTIME_SESSION_MODE=affinity
+
 # Service Configuration
 PYTHON_CONCURRENCY=5
 OTHER_CONCURRENCY=15

.github/release.yml

@@ -0,0 +1,31 @@
+# Categories for the changelog `gh release create --generate-notes` appends to
+# every release body (see .github/workflows/release.yml). Labels are matched
+# against the merged pull requests in the range; anything unlabelled lands in
+# "Other changes" rather than being dropped, which matters here because sync
+# pull requests from the internal monorepo usually carry no labels.
+changelog:
+  exclude:
+    labels:
+      - duplicate
+      - invalid
+      - wontfix
+  categories:
+    - title: Security
+      labels:
+        - security
+    - title: Features
+      labels:
+        - enhancement
+        - feature
+    - title: Fixes
+      labels:
+        - bug
+    - title: Documentation
+      labels:
+        - documentation
+    - title: Dependencies
+      labels:
+        - dependencies
+    - title: Other changes
+      labels:
+        - '*'

.github/scripts/next-release-version.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [ "$#" -ne 2 ]; then
+  echo "usage: $0 <current-vMAJOR.MINOR.PATCH> <git-revision-range>" >&2
+  exit 2
+fi
+
+CURRENT_TAG="$1"
+REVISION_RANGE="$2"
+
+if [[ ! "$CURRENT_TAG" =~ ^v([0-9]+)[.]([0-9]+)[.]([0-9]+)$ ]]; then
+  echo "current release must be a stable vMAJOR.MINOR.PATCH tag (got '$CURRENT_TAG')" >&2
+  exit 2
+fi
+
+# Documentation, workflow, and test-only changes remain auditable in git but do
+# not produce a deployable release. Any unrecognised path is treated as
+# deployable so a newly added runtime component cannot silently miss a release.
+DEPLOYABLE=false
+while IFS= read -r path; do
+  case "$path" in
+    .github/*|docs/*|tests/*|*.md|*/README|*/README.*|*.test.*|*.spec.*)
+      ;;
+    *)
+      DEPLOYABLE=true
+      break
+      ;;
+  esac
+done < <(git diff --name-only "$REVISION_RANGE")
+
+if [ "$DEPLOYABLE" = "false" ]; then
+  exit 0
+fi
+
+COMMIT_MESSAGES="$(git log --format='%s%n%b' "$REVISION_RANGE")"
+BUMP=patch
+
+if grep -Eq '^[[:alnum:]_-]+(\([^)]*\))?!:' <<<"$COMMIT_MESSAGES" \
+   || grep -Eq '^BREAKING([ -])CHANGE:' <<<"$COMMIT_MESSAGES"; then
+  BUMP=major
+elif grep -Eq '^feat(\([^)]*\))?:' <<<"$COMMIT_MESSAGES"; then
+  BUMP=minor
+fi
+
+VERSION="${CURRENT_TAG#v}"
+IFS=. read -r MAJOR MINOR PATCH <<<"$VERSION"
+
+case "$BUMP" in
+  major)
+    MAJOR=$((MAJOR + 1))
+    MINOR=0
+    PATCH=0
+    ;;
+  minor)
+    MINOR=$((MINOR + 1))
+    PATCH=0
+    ;;
+  patch)
+    PATCH=$((PATCH + 1))
+    ;;
+esac
+
+printf 'v%s.%s.%s\n' "$MAJOR" "$MINOR" "$PATCH"

.github/workflows/ci.yml

@@ -31,14 +31,44 @@ jobs:
       - name: Block-root package delivery
         run: tests/block_root_package_delivery.sh
 
+      - name: KVM guest resolver handoff
+        run: tests/kvm_guest_dns.sh
+
       - name: Sandbox-runner liveness checks
         run: tests/sandbox_runner_healthcheck.sh
 
+      - name: Bridge pairing rollout safety
+        run: tests/bridge_pairing_rollout.sh
+
+      - name: Compose bridge configuration
+        run: node tests/compose-bridge-config.cjs
+
+      - name: Release versioning
+        run: tests/release-versioning.sh
+
       - name: Validate sandbox Dockerfiles
         run: |
           docker buildx build --check -f api/Dockerfile .
           docker buildx build --check -f docker/Dockerfile.worker-sandbox .
 
+  launcher-unit-tests:
+    name: Launcher Unit Tests
+    runs-on: ubuntu-latest
+    container: fedora:43
+    defaults:
+      run:
+        working-directory: launcher
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - name: Install Rust and libkrun
+        # Mirrors launcher/Dockerfile's builder stage; libkrun is only packaged
+        # for Fedora, and the guest-environment checks link against it.
+        run: dnf install -y --setopt=install_weak_deps=False rust cargo libkrun-devel gcc
+
+      - name: Cargo tests
+        run: cargo test
+
   api-unit-tests:
     name: API Unit Tests
     runs-on: ubuntu-latest
@@ -113,12 +143,70 @@ jobs:
       - name: Install dependencies
         run: bun ci
 
+      - name: Install Redis for ledger integration tests
+        run: sudo apt-get update && sudo apt-get install -y redis-server
+
       - name: Build service
         run: bun run build
 
       - name: Bun tests
         run: bun run test
 
+  code-package-tests:
+    name: Code Package Tests (Node ${{ matrix.node-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ['20.11.0', '22.21.0', '24.16.0']
+    defaults:
+      run:
+        working-directory: packages/code
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+          cache-dependency-path: packages/code/package-lock.json
+
+      - name: Install ripgrep
+        # list_files and search_text shell out to rg. Without it the workspace
+        # tools degrade to LIST_UNAVAILABLE / SEARCH_UNAVAILABLE and 37 tests
+        # fail, so the dependency is part of the job, not an assumption.
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ripgrep
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Tests
+        run: npm test
+
+  macos-storage-tests:
+    name: macOS Storage ACL Tests
+    runs-on: macos-14
+    defaults:
+      run:
+        working-directory: packages/code
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24.16.0
+      - run: npm ci
+      - run: npm run build
+      - name: Native environment containment tests
+        run: node --test dist/environment.test.js
+      - name: Native ACL and credential lifecycle tests
+        run: node --test dist/macos-storage.test.js dist/private-storage.test.js dist/storage.test.js dist/github.test.js
+      - name: Native environment setup lifecycle tests
+        env:
+          LIBRECHAT_CODE_LIVE_SRT_TESTS: '1'
+        run: node --test dist/environment-live.test.js
+
   lambda-microvm-provisioning:
     name: Lambda MicroVM Provisioning
     runs-on: ubuntu-latest
@@ -156,12 +244,17 @@ jobs:
           shellcheck scripts/build-lambda-microvm-artifact.sh
 
       - name: Validate runner Dockerfile
-        run: >-
-          docker buildx build --check
-          --platform linux/arm64
-          --target lambda-microvm-runner
-          -f api/Dockerfile
-          .
+        run: |
+          docker buildx build --check \
+            --platform linux/arm64 \
+            --target lambda-microvm-runner \
+            -f api/Dockerfile \
+            .
+          docker buildx build --check \
+            --platform linux/arm64 \
+            --target lambda-microvm-app-host \
+            -f api/Dockerfile \
+            .
 
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
@@ -174,6 +267,7 @@ jobs:
           terraform fmt -check -recursive
           terraform init -backend=false -input=false -lockfile=readonly
           terraform validate
+          terraform test
 
   lambda-microvm-runner-build:
     name: Lambda MicroVM Runner Image (arm64)