fix(rerun): emit partial stdout on TimeoutError in single-FE rerun --wait

.gitattributes

@@ -0,0 +1,6 @@
+# Check out all text files with LF on every platform. Tests compare bytes
+# from checked-out files (skill templates, snapshots); a CRLF working tree
+# (core.autocrlf on Windows) broke those comparisons.
+* text=auto eol=lf
+
+*.png binary

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,7 +12,9 @@ agree on the approach before you invest time — see CONTRIBUTING.md.
 
 ## Related issue
 
-<!-- e.g. "Fixes #123" or "Refs #123". Link an issue for non-trivial changes. -->
+<!-- e.g. "Closes #123". Required for features and behavior changes — open an
+     issue first and get it assigned (comment `/assign` there); see
+     CONTRIBUTING.md → Contribution model. Docs and small fixes don't need one. -->
 
 ## Type of change
 

.github/workflows/backport-dispatch.yml

@@ -0,0 +1,83 @@
+# backport-dispatch.yml — OPTIONAL latency optimization for DEV-352's
+# auto-backport bot. Authored in atlas (release/public path), ships to the
+# PUBLIC repo via the snapshot per invariant I0 — this workflow only ever
+# runs on the public repo, never on atlas (see the repo guard below).
+#
+# NOT YET ARMED (2026-07-15): the atlas-side auto-backport.yml has a
+# scheduled SWEEP (every 30 min) that scans merged public PRs anonymously
+# and backports anything unabsorbed — the whole pipeline is fully
+# functional with ZERO public-repo credentials via that path alone. This
+# workflow instantly notifies atlas the moment a PR merges instead of
+# waiting for the next sweep (seconds vs. up to 30 minutes) — a nice-to-have,
+# not a requirement.
+#
+# Arming it means placing a GitHub App credential with contents:write on
+# the PRIVATE atlas repo into THIS PUBLIC repo's secrets — a real trust
+# decision (a compromised public-repo secret store would let an attacker
+# push to atlas) that is deliberately left to the operator, not decided by
+# this file. Until TESTSPRITE_HOB_APP_ID/TESTSPRITE_HOB_PRIVATE_KEY (or the
+# ALFHEIM_AGENT_* fallback) exist on the PUBLIC repo with contents:write on
+# atlas, this workflow no-ops cleanly (see the "not armed" step) — it does
+# NOT fail loud, so it stays quiet for every contributor watching the
+# Actions tab until the operator decides to enable it.
+#
+# SECURITY: this workflow reads ONLY event metadata (PR number, merge SHA,
+# base ref) — it never checks out the merged PR's code. That is what makes
+# `pull_request_target` safe here: the base-repo context (secrets, a
+# write-capable token) is required because a fork-originated merged PR gets
+# ZERO secrets under a plain `pull_request` trigger, even for the `closed`
+# activity type — but nothing in this job ever runs untrusted fork code, so
+# the classic pull_request_target RCE/secret-exfiltration risk (checking
+# out and executing the fork's own head ref under a privileged context)
+# does not apply. Do not add actions/checkout to this workflow.
+name: Notify atlas of a merged public PR
+
+on:
+  pull_request_target:
+    types: [closed]
+
+permissions:
+  contents: read
+
+jobs:
+  notify:
+    if: github.repository == 'TestSprite/testsprite-cli' && github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    steps:
+      - id: app-token
+        continue-on-error: true
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.TESTSPRITE_HOB_APP_ID || secrets.ALFHEIM_AGENT_APP_ID }}
+          private-key: ${{ secrets.TESTSPRITE_HOB_PRIVATE_KEY || secrets.ALFHEIM_AGENT_PRIVATE_KEY }}
+          owner: TestSprite
+          repositories: testsprite-cli-atlas
+          # Minimum required for POST /repos/{owner}/{repo}/dispatches (verified
+          # against docs.github.com/en/rest/using-the-rest-api/permissions-required-for-github-apps —
+          # the endpoint is gated on Contents:write, not Contents:read).
+          permission-contents: write
+
+      - name: Dispatch to atlas
+        if: steps.app-token.outputs.token != ''
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          # These two fields are fork-influenced (merge_commit_sha/base.ref come
+          # from a merged PR's event payload) — routed through env instead of
+          # spliced into the run: string to avoid the GHA script-injection class
+          # (a maliciously-crafted value could otherwise break out of the -F
+          # argument and inject arbitrary shell). PR_NUMBER is left inline: it is
+          # a GitHub-assigned integer, not attacker-authorable content.
+          MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          set -euo pipefail
+          gh api repos/TestSprite/testsprite-cli-atlas/dispatches \
+            -f event_type=public-pr-merged \
+            -F 'client_payload[pr_number]=${{ github.event.pull_request.number }}' \
+            -F "client_payload[merge_commit_sha]=$MERGE_SHA" \
+            -F "client_payload[base_ref]=$BASE_REF"
+
+      - name: Not armed yet — the atlas sweep will pick this up
+        if: steps.app-token.outputs.token == ''
+        run: |
+          echo "::notice::No cross-repo credential configured on this repo yet — atlas's scheduled sweep (auto-backport.yml, every 30 min) will pick up this merge instead of an instant dispatch. See DEV-352 / DEV-348 / DEV-350 for the operator decision to arm this."

.github/workflows/ci-nudge.yml

@@ -0,0 +1,149 @@
+# "Fix this and we merge" nudge (InsForge `agent-zhang-beihai` pattern, part 3).
+# When a PR's CI finishes red, posts ONE sticky comment listing exactly which
+# jobs failed and the local one-liner that reproduces/fixes each (the automated
+# version of the hand-written "run `npm run format` and you're green" review
+# comments). The comment flips to a green confirmation once all checks pass.
+#
+# Runs in base-repo context via workflow_run — no PR code is checked out, so
+# fork PRs are safe. State is recomputed from check-runs each time, so the two
+# CI workflows (CI + Test Coverage) can complete in any order.
+#
+# Bot identity: same App-token-first / GITHUB_TOKEN-fallback pattern as
+# pr-triage.yml. The App has had the "Pull requests: Read & write" permission
+# since 2026-07-02 (corrected 2026-07-15; this comment previously said the
+# permission was still pending) — the fallback path stays as defense-in-depth
+# for whenever the App/secrets are absent.
+name: CI failure nudge
+
+on:
+  workflow_run:
+    workflows: ['CI', 'Test Coverage']
+    types: [completed]
+
+permissions:
+  checks: read # read the head SHA's check-run state
+  pull-requests: write
+  issues: write # PR comments ride the issues API
+
+env:
+  MARKER: '<!-- hob:ci-nudge -->'
+
+jobs:
+  nudge:
+    # Public repo only; PR-triggered runs only (pushes to main have no PR to nudge).
+    if: >-
+      github.repository == 'TestSprite/testsprite-cli' &&
+      github.event.workflow_run.event == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - id: app-token
+        continue-on-error: true
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.TESTSPRITE_HOB_APP_ID || secrets.ALFHEIM_AGENT_APP_ID }}
+          private-key: ${{ secrets.TESTSPRITE_HOB_PRIVATE_KEY || secrets.ALFHEIM_AGENT_PRIVATE_KEY }}
+          # The script below only ever calls the App client (`appClient`) for
+          # rest.issues.updateComment/createComment — PR comments ride the
+          # issues API (see the header comment above). All reads (checks,
+          # pulls, commit->PR lookup) go through the ambient `github` client,
+          # governed by this workflow's top-level `permissions:` block, not
+          # this minted token. Scoping to checks:read/pull-requests:write here
+          # (matching the job's top-level block literally) would risk the mint
+          # itself failing if the App's installation doesn't hold Checks
+          # permission — which would silently drop the App-token path
+          # entirely (continue-on-error swallows the failure) and always fall
+          # back to github-actions[bot], defeating this bot's own purpose.
+          permission-issues: write
+
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const run = context.payload.workflow_run;
+            const marker = process.env.MARKER;
+
+            const appClient = process.env.APP_TOKEN
+              ? new (github.constructor)({ auth: process.env.APP_TOKEN })
+              : null;
+            async function write(fn) {
+              if (appClient) {
+                try { return await fn(appClient.rest); }
+                catch (e) { if (e.status !== 403 && e.status !== 404) throw e; }
+              }
+              return await fn(github.rest);
+            }
+
+            // Resolve the PR for this run. `workflow_run.pull_requests` is empty
+            // for fork PRs, so fall back to the commit→PRs lookup.
+            let pr = (run.pull_requests || [])[0];
+            if (!pr) {
+              const { data } = await github.rest.repos.listPullRequestsAssociatedWithCommit(
+                { owner, repo, commit_sha: run.head_sha });
+              pr = data.find(p => p.state === 'open');
+            } else {
+              pr = (await github.rest.pulls.get({ owner, repo, pull_number: pr.number })).data;
+            }
+            if (!pr || pr.state !== 'open' || pr.user.type === 'Bot') return;
+
+            // Job name → the local command that reproduces/fixes it. Also the
+            // allowlist of CI jobs this nudge watches — keep in sync with ci.yml.
+            const FIX = {
+              'Lint & Format': 'run `npm run lint:fix && npm run format`, then commit',
+              'Typecheck': 'run `npm run typecheck` and fix the reported type errors',
+              'Unit Tests': 'run `npm test` and fix the failing tests',
+              'Build': 'run `npm run build` and fix the compile errors',
+              'Local E2E Tests': 'run `npm run test:e2e` (it builds first)',
+              'Coverage (>= 80%)': 'run `npm run test:coverage` — new code needs tests until every metric is back at 80%',
+              'Secret scan (gitleaks)': 'run `gitleaks detect --no-git --redact --source .` locally (config: .gitleaks.toml) and remove the secret — or, for a provable false positive, add a narrowly-anchored allowlist regex',
+            };
+            // Matrix jobs publish check runs as "Unit Tests (Node 20)" etc. —
+            // exact lookup alone would silently skip them (and the nudge would
+            // say "all green" while they are red). Try exact first, then the
+            // name with a trailing parenthetical stripped (review round 2).
+            const fixFor = (name) => FIX[name] ?? FIX[name.replace(/\s*\([^)]*\)$/, '')];
+
+            // Recompute full CI state from this SHA's check runs, narrowed to the
+            // CI jobs above — other workflows (e.g. pr-triage) also attach
+            // github-actions check runs to the PR head and must not count here.
+            const checks = await github.paginate(github.rest.checks.listForRef,
+              { owner, repo, ref: run.head_sha, per_page: 100 });
+            const ours = checks.filter(c => c.app && c.app.slug === 'github-actions' && fixFor(c.name));
+            const failing = ours.filter(c => ['failure', 'timed_out'].includes(c.conclusion));
+            const pending = ours.filter(c => c.status !== 'completed');
+
+            const comments = await github.paginate(github.rest.issues.listComments,
+              { owner, repo, issue_number: pr.number, per_page: 100 });
+            const sticky = comments.find(c => (c.body || '').includes(marker));
+
+            if (failing.length === 0) {
+              // Only speak up on success if we previously flagged a failure, and
+              // only once everything has actually finished.
+              if (sticky && pending.length === 0 && !sticky.body.includes('all green')) {
+                await write(rest => rest.issues.updateComment({ owner, repo, comment_id: sticky.id,
+                  body: `${marker}\n✅ CI is **all green** now — thanks, @${pr.user.login}!` }));
+              }
+              return;
+            }
+
+            const lines = failing
+              .sort((a, b) => a.name.localeCompare(b.name))
+              .map(c => {
+                const fix = fixFor(c.name) || 'see the logs for details';
+                return `- **${c.name}** — ${fix} ([logs](${c.html_url}))`;
+              });
+            const body = `${marker}\nThanks, @${pr.user.login}! CI is red on this PR — `
+              + `here's what failed and how to reproduce it locally:\n\n${lines.join('\n')}\n\n`
+              + `Everything runs on Node 22 after \`npm ci\`. Push a fix and this comment `
+              + `flips green automatically once all checks pass.`;
+
+            if (sticky) {
+              if (sticky.body !== body) {
+                await write(rest => rest.issues.updateComment(
+                  { owner, repo, comment_id: sticky.id, body }));
+              }
+            } else {
+              await write(rest => rest.issues.createComment(
+                { owner, repo, issue_number: pr.number, body }));
+            }

.github/workflows/ci.yml

@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -37,6 +39,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -48,10 +52,35 @@ jobs:
       - run: npm run typecheck
 
   test:
-    name: Unit Tests
+    name: Unit Tests (Node ${{ matrix.node-version }})
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20, 22]
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+
+      - run: npm ci
+      - run: npm run build
+      - run: npm test
+        env:
+          CI: true
+
+  test-windows:
+    name: Unit Tests (Windows)
+    runs-on: windows-latest
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -60,20 +89,27 @@ jobs:
           cache: 'npm'
 
       - run: npm ci
+      - run: npm run build
+      - run: npm run typecheck
       - run: npm test
         env:
           CI: true
 
   build:
-    name: Build
+    name: Build (Node ${{ matrix.node-version }})
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20, 22]
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
-          node-version: 22
+          node-version: ${{ matrix.node-version }}
           cache: 'npm'
 
       - run: npm ci
@@ -89,6 +125,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
@@ -100,3 +138,36 @@ jobs:
       - run: npm run test:e2e
         env:
           CI: true
+
+  gitleaks:
+    name: Secret scan (gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        with:
+          persist-credentials: false
+
+      # Same pinned version + checksum-verified install as
+      # divergence-sentinel.yml (the more recent/secure of the two gitleaks
+      # invocations already in this repo — release-build.yml pins an older
+      # 8.21.2 with no checksum check). Continuous, per-PR/per-push gate: a
+      # working-tree scan (--no-git), not a full-history scan — history
+      # scanning is too slow to run on every PR, and this mirrors the mode
+      # scripts/make-public-snapshot.sh already uses for the release-time scan
+      # (`gitleaks detect --no-git --no-banner --redact --source <tree>`).
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: '8.28.0'
+        run: |
+          set -euo pipefail
+          BASE="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}"
+          TARBALL="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl -sSL -o "$TARBALL" "${BASE}/${TARBALL}"
+          curl -sSL -o checksums.txt "${BASE}/gitleaks_${GITLEAKS_VERSION}_checksums.txt"
+          grep " ${TARBALL}\$" checksums.txt | sha256sum -c -
+          tar -xzf "$TARBALL" gitleaks
+          sudo mv gitleaks /usr/local/bin/gitleaks
+          gitleaks version
+
+      - name: Scan working tree for secrets
+        run: gitleaks detect --no-git --no-banner --redact --source .