Merge remote-tracking branch 'origin/main' into HEAD

# Conflicts:
#	.gitignore
#	headroom/graph/tokensave_installer.py
#	headroom/lean_ctx/installer.py
#	headroom/proxy/handlers/openai.py
#	headroom/rtk/installer.py

Author: JD Davis

.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Headroom marketplace for Claude Code and GitHub Copilot CLI plugins.",
-    "version": "0.31.0"
+    "version": "0.34.0"
   },
   "plugins": [
     {
       "name": "headroom",
       "source": "./plugins/headroom-agent-hooks",
       "description": "Headroom startup hooks for Claude Code and GitHub Copilot CLI.",
-      "version": "0.31.0",
+      "version": "0.34.0",
       "author": {
         "name": "Headroom Contributors",
         "url": "https://github.com/chopratejas/headroom"

.github/plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Headroom marketplace for Claude Code and GitHub Copilot CLI plugins.",
-    "version": "0.31.0"
+    "version": "0.34.0"
   },
   "plugins": [
     {
       "name": "headroom",
       "source": "./plugins/headroom-agent-hooks",
       "description": "Headroom startup hooks for Claude Code and GitHub Copilot CLI.",
-      "version": "0.31.0",
+      "version": "0.34.0",
       "author": {
         "name": "Headroom Contributors",
         "url": "https://github.com/chopratejas/headroom"

.github/workflows/ci.yml

@@ -70,7 +70,6 @@ jobs:
               - 'headroom/cli/**'
               - 'headroom/install/**'
               - 'headroom/providers/**'
-              - 'headroom/rtk/**'
               - 'crates/**'
               - '**/*.rs'
               - 'Cargo.toml'
@@ -117,7 +116,10 @@ jobs:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-lint-${{ hashFiles('pyproject.toml') }}
           restore-keys: ${{ runner.os }}-pip-lint-
-      - run: python -m pip install --upgrade pip "ruff==0.15.17" "mypy==1.20.2"
+      - name: Verify Ruff version alignment
+        id: ruff-version
+        run: echo "version=$(python scripts/verify-ruff-version.py --print-version)" >> "$GITHUB_OUTPUT"
+      - run: python -m pip install --upgrade pip "ruff==${{ steps.ruff-version.outputs.version }}" "mypy==1.20.2"
       - name: ruff check
         run: ruff check .
       - name: ruff format --check
@@ -291,6 +293,7 @@ jobs:
         uses: codecov/codecov-action@v5
         with:
           files: coverage-${{ matrix.shard }}.xml
+          disable_search: true
           flags: python
           name: python-shard-${{ matrix.shard }}
           # Token is sent so uploads authenticate once the repo is activated on

.github/workflows/docs.yml

@@ -1,55 +1,36 @@
-name: Deploy Documentation
+name: Validate Docs
+
+# There is ONE documentation site: the Next.js/Fumadocs app in `docs/`, published
+# at https://headroom-docs.vercel.app by Vercel's own Git integration. That URL is
+# what README and `pyproject.toml` (Homepage, Documentation) point at.
+#
+# This workflow therefore only *validates* — it deploys nothing. Vercel owns
+# deployment; duplicating it here is what produced a `deploy-vercel` job that
+# failed 30 times on main without ever deploying (no VERCEL_* secrets were set).
+#
+# A second site used to be built from `wiki/` by MkDocs and published to GitHub
+# Pages off the `gh-pages` branch. It was linked from nowhere in the repo, it meant
+# every documented change had to be written twice, and each Pages deploy
+# force-pushed `gh-pages` — which Vercel then tried to build, failing with
+# "The specified Root Directory 'docs' does not exist" because that branch holds
+# only the rendered site. Removed. `wiki/` stays in the repo as unpublished
+# markdown pending migration of the pages `docs/` does not yet cover (notably
+# `wiki/cli.md`); nothing builds or publishes it, so it needs no syncing.
 
 on:
   pull_request:
     branches: [main]
     paths:
       - 'docs/**'
-      - 'wiki/**'
-      - 'mkdocs.yml'
-      - '.github/workflows/docs.yml'
-  push:
-    branches:
-      - main
-    paths:
-      - 'docs/**'
-      - 'mkdocs.yml'
       - '.github/workflows/docs.yml'
   workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  validate-mkdocs:
-    name: Validate mkdocs build
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.11'
-
-      - name: Cache pip
-        uses: actions/cache@v6
-        with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-docs-${{ hashFiles('mkdocs.yml') }}
-          restore-keys: ${{ runner.os }}-pip-docs-
-
-      - name: Install dependencies
-        run: pip install mkdocs-material
-
-      - name: Build docs
-        run: mkdocs build
-
   validate-nextjs:
     name: Validate Next.js build
-    if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
@@ -69,62 +50,3 @@ jobs:
       - name: Build docs
         run: npm run build
         working-directory: docs
-
-  deploy-github-pages:
-    name: Deploy GitHub Pages
-    if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.11'
-
-      - name: Cache pip
-        uses: actions/cache@v6
-        with:
-          path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-docs-${{ hashFiles('mkdocs.yml') }}
-          restore-keys: ${{ runner.os }}-pip-docs-
-
-      - name: Install dependencies
-        run: pip install mkdocs-material
-
-      - name: Build and deploy
-        run: mkdocs gh-deploy --force
-
-  deploy-vercel:
-    name: Deploy Vercel Docs
-    if: >-
-      github.event_name != 'pull_request'
-      && github.ref == 'refs/heads/main'
-      && github.repository_owner == 'headroomlabs-ai'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: '20'
-          cache: npm
-          cache-dependency-path: docs/package-lock.json
-
-      - name: Install dependencies
-        run: npm ci
-        working-directory: docs
-
-      - name: Deploy to Vercel
-        run: npx vercel deploy --prod --token=${{ secrets.VERCEL_TOKEN }}
-        working-directory: docs
-        env:
-          VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
-          VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}

.github/workflows/network-diff-capture.yml

@@ -43,7 +43,7 @@ jobs:
             'magika>=0.6.0' \
             'zstandard>=0.20.0' \
             'websockets>=13.0' \
-            'onnxruntime>=1.16.0' \
+            'onnxruntime>=1.24' \
             'transformers>=4.30.0' \
             'watchdog>=4.0.0' \
             'sqlite-vec>=0.1.6' \
@@ -107,7 +107,7 @@ jobs:
             'magika>=0.6.0' \
             'zstandard>=0.20.0' \
             'websockets>=13.0' \
-            'onnxruntime>=1.16.0' \
+            'onnxruntime>=1.24' \
             'transformers>=4.30.0' \
             'watchdog>=4.0.0' \
             'sqlite-vec>=0.1.6'

.github/workflows/opencode-plugin.yml

@@ -10,11 +10,13 @@ on:
     branches: [main]
     paths:
       - "plugins/opencode/**"
+      - "headroom/providers/opencode/_dist/**"
       - ".github/workflows/opencode-plugin.yml"
   push:
     branches: [main]
     paths:
       - "plugins/opencode/**"
+      - "headroom/providers/opencode/_dist/**"
       - ".github/workflows/opencode-plugin.yml"
 
 permissions:
@@ -39,3 +41,13 @@ jobs:
       - run: npm run typecheck
       - run: npm run build
       - run: npm test
+      # The wheel ships a committed self-contained bundle at
+      # headroom/providers/opencode/_dist/entry.opencode.js so pip installs
+      # get the transport plugin too. Rebuild it and fail if the committed
+      # artifact has drifted from the source.
+      - run: npm run build:standalone
+      - name: verify committed wheel bundle matches source
+        run: |
+          cmp dist-standalone/entry.opencode.js \
+            ../../headroom/providers/opencode/_dist/entry.opencode.js \
+            || { echo "::error::headroom/providers/opencode/_dist/entry.opencode.js is stale - run 'npm run build:standalone' in plugins/opencode and commit the result"; exit 1; }

.github/workflows/release-metadata-sync.yml

@@ -0,0 +1,87 @@
+name: Release Metadata Sync
+
+# Keep generated version-carrying files in sync on release-please's branch.
+#
+# Why this exists
+# ---------------
+# release-please only rewrites `pyproject.toml` plus the `extra-files` listed in
+# `.release-please-config.json` (currently the TypeScript SDK and OpenClaw
+# package.json). Several other tracked files also carry the version, and
+# `server.json` is asserted byte-for-byte against `render_server_json()` — which
+# derives its version from `pyproject.toml`. So the moment release-please bumps
+# the version, `tests/test_mcp_registry/test_server_json.py::
+# test_root_server_json_matches_builder` fails on the release PR, and the release
+# cannot be merged. That is what blocked v0.33.0 (PR #2339).
+#
+# `release.yml` already runs `scripts/version-sync.py` before its own
+# `verify-versions.py` gate, so the release *build* self-heals in the workspace.
+# The regular CI test job does not, so the fix has to be committed.
+#
+# Why a workflow rather than more `extra-files` entries
+# ----------------------------------------------------
+# `scripts/version-sync.py` is the single place that knows every version-carrying
+# file. Restating that list as per-file jsonpaths would duplicate it, and a
+# jsonpath that silently fails to match produces exactly the failure we are trying
+# to remove. Running the script instead means files added to it in future are
+# covered with no change here.
+#
+# Why the push trigger
+# --------------------
+# release-please regenerates (force-pushes) its branch on every merge to main.
+# That is what repeatedly wiped the hand-pushed metadata fixes on #2339. Keying
+# off a push to the branch means the sync re-applies after every regeneration
+# instead of being lost.
+
+on:
+  push:
+    branches:
+      - "release-please--branches--**"
+
+permissions:
+  contents: write
+
+concurrency:
+  # Never cancel: a half-applied sync would leave the release PR inconsistent.
+  group: release-metadata-sync-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.ref_name }}
+          # PAT (not GITHUB_TOKEN) for the same reason release-please.yml uses one:
+          # a push made with GITHUB_TOKEN does not trigger workflows, so the release
+          # PR's checks would never re-run against the synced commit and would stay
+          # red. Falls back to GITHUB_TOKEN, where the sync still lands and a manual
+          # re-run of the PR's checks picks it up.
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || secrets.GITHUB_TOKEN }}
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      # version-sync.py is stdlib-only (json/re/tomllib), so no install step.
+      - name: Sync version-carrying files release-please does not bump
+        run: python scripts/version-sync.py
+
+      - name: Verify all versions agree
+        run: python scripts/verify-versions.py
+
+      - name: Commit and push if anything changed
+        run: |
+          if git diff --quiet; then
+            echo "Already in sync — nothing to commit."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git commit -m "chore: sync generated version metadata"
+          # This push re-triggers this workflow. version-sync.py is idempotent, so
+          # the next run finds no diff and exits above without pushing — the loop
+          # terminates after one no-op run.
+          git push origin HEAD:"${GITHUB_REF_NAME}"

.github/workflows/release.yml

@@ -788,6 +788,7 @@ jobs:
           # recommended pattern for release workflows that may run
           # multiple times against the same version.
           skip-existing: true
+          attestations: false
 
   publish-npm:
     needs: [detect-version, build]