Merge remote-tracking branch 'upstream/main' into codex/agnes-ai-byok-provider-pr

# Conflicts:
#	apps/web/src/state/config.ts

Author: sucaifenxiang

.github/actions/configure-ci-parallelism/action.yml

@@ -1,5 +1,5 @@
 name: Configure CI parallelism
-description: Export CI worker counts derived from nproc/2
+description: Export build worker counts derived from nproc/2 with a memory-safe Playwright cap
 
 runs:
   using: composite
@@ -14,14 +14,18 @@ runs:
         if [ "$workers" -lt 1 ]; then
           workers=1
         fi
+        playwright_workers="$workers"
+        if [ "$playwright_workers" -gt 2 ]; then
+          playwright_workers=2
+        fi
 
         {
           echo "OPEN_DESIGN_POSTINSTALL_CONCURRENCY=$workers"
           echo "OPEN_DESIGN_WORKSPACE_CONCURRENCY=$workers"
           echo "OD_CI_DAEMON_MAX_WORKERS=$workers"
           echo "OD_E2E_VITEST_MAX_WORKERS=$workers"
-          echo "OD_PLAYWRIGHT_WORKERS=$workers"
+          echo "OD_PLAYWRIGHT_WORKERS=$playwright_workers"
         } >> "$GITHUB_ENV"
 
         echo "workers=$workers" >> "$GITHUB_OUTPUT"
-        echo "nproc=$cpu_count workers=$workers"
+        echo "nproc=$cpu_count workers=$workers playwright_workers=$playwright_workers"

.github/actions/setup-playwright/action.yml

@@ -1,5 +1,5 @@
 name: Setup Playwright
-description: Restore Playwright browser cache and install browsers
+description: Use a preseeded Nexu browser when available, otherwise restore the browser cache and install browsers
 
 inputs:
   package-json-path:
@@ -16,8 +16,40 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: Detect preinstalled Playwright
+      id: preinstalled-playwright
+      shell: bash
+      env:
+        RUNNER_LABELS_JSON: ${{ inputs.runner-labels }}
+      run: |
+        preinstalled_enabled=false
+
+        # The ARC tools image carries both the OS dependencies and Chromium.
+        # Keep this opt-in to the named Nexu profiles so a hosted runner with
+        # a restored browser cache still receives its OS dependencies.
+        case "$RUNNER_LABELS_JSON" in
+          *'"nexu-runners-'*)
+            if [ -n "${PLAYWRIGHT_BROWSERS_PATH:-}" ] && [ -d "$PLAYWRIGHT_BROWSERS_PATH" ]; then
+              chromium_bin="$(find "$PLAYWRIGHT_BROWSERS_PATH" -type f \
+                \( -name chrome -o -name chromium -o -name chrome-headless-shell \) \
+                -perm -111 -print -quit 2>/dev/null || true)"
+              if [ -n "$chromium_bin" ]; then
+                preinstalled_enabled=true
+              fi
+            fi
+            ;;
+        esac
+
+        echo "enabled=$preinstalled_enabled" >> "$GITHUB_OUTPUT"
+        if [ "$preinstalled_enabled" = "true" ]; then
+          echo "Using the Playwright browser preseeded in the Nexu runner image."
+        else
+          echo "No preseeded Playwright browser detected; using the workflow install path."
+        fi
+
     - name: Detect persistent Playwright cache
       id: persistent-playwright-cache
+      if: ${{ steps.preinstalled-playwright.outputs.enabled != 'true' }}
       shell: bash
       env:
         RUNNER_LABELS_JSON: ${{ inputs.runner-labels }}
@@ -41,6 +73,7 @@ runs:
 
     - name: Resolve Playwright version
       id: playwright-version
+      if: ${{ steps.preinstalled-playwright.outputs.enabled != 'true' }}
       shell: bash
       run: |
         version=$(node -p "const pkg = require('./${{ inputs.package-json-path }}'); const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) }; (deps['@playwright/test'] || deps.playwright || '').replace(/[^0-9.]/g,'')")
@@ -51,12 +84,22 @@ runs:
         echo "version=$version" >> "$GITHUB_OUTPUT"
 
     - name: Cache Playwright browser binaries
-      if: ${{ steps.persistent-playwright-cache.outputs.enabled != 'true' }}
+      if: ${{ steps.preinstalled-playwright.outputs.enabled != 'true' && steps.persistent-playwright-cache.outputs.enabled != 'true' }}
       uses: actions/cache@v5.0.5
       with:
         path: ~/.cache/ms-playwright
         key: playwright-${{ runner.os }}-${{ steps.playwright-version.outputs.version }}
 
+    - name: Ensure preinstalled Playwright browser revision
+      if: ${{ steps.preinstalled-playwright.outputs.enabled == 'true' }}
+      shell: bash
+      env:
+        PACKAGE_JSON_PATH: ${{ inputs.package-json-path }}
+      run: |
+        package_dir="${PACKAGE_JSON_PATH%/*}"
+        pnpm -C "$package_dir" exec playwright install chromium
+
     - name: Install Playwright browsers
+      if: ${{ steps.preinstalled-playwright.outputs.enabled != 'true' }}
       shell: bash
       run: ${{ inputs.install-command }}

.github/actions/setup-workspace/action.yml

@@ -47,7 +47,17 @@ runs:
           echo "enabled=true" >> "$GITHUB_OUTPUT"
           echo "path=$store_dir" >> "$GITHUB_OUTPUT"
         else
+          # Force a stable home store path so actions/cache version hashes match
+          # across fleets (hosted vs Nexu ARC). ARC may copy instead of hardlink;
+          # that is acceptable for cache hit stability.
+          store_dir="$HOME/.pnpm-store"
+          mkdir -p "$store_dir"
+          {
+            echo "NPM_CONFIG_STORE_DIR=$store_dir"
+            echo "npm_config_store_dir=$store_dir"
+          } >> "$GITHUB_ENV"
           echo "enabled=false" >> "$GITHUB_OUTPUT"
+          echo "path=$store_dir" >> "$GITHUB_OUTPUT"
         fi
 
     - name: Setup pnpm
@@ -73,6 +83,8 @@ runs:
       with:
         path: ${{ steps.pnpm-store.outputs.path }}
         key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+        restore-keys: |
+          pnpm-store-${{ runner.os }}-
 
     - name: Install dependencies
       shell: bash

.github/scripts/runners.py

@@ -7,35 +7,41 @@
 
 GITHUB_HOSTED = ["ubuntu-24.04"]
 WINDOWS_HOSTED = ["windows-latest"]
-CONTABO_CONTROL = ["self-hosted", "Linux", "X64", "od-persistent-ci", "od-ci-hot-poc"]
-BLACKSMITH_4V = ["blacksmith-4vcpu-ubuntu-2404"]
+NEXU_SMALL = ["nexu-runners-small"]
+NEXU_MEDIUM = ["nexu-runners-medium"]
+NEXU_LARGE = ["nexu-runners-large"]
+NEXU_XLARGE = ["nexu-runners-xlarge"]
 
 
 def compact_json(value):
     return json.dumps(value, separators=(",", ":"))
 
 
 def normalize_mode(raw_mode):
-    mode = (raw_mode or "default").strip().lower()
+    mode = raw_mode or "default"
     if mode in {"default", "performance", "economic"}:
         return mode
     return "default"
 
 
 def resolve_contract(mode):
-    general_medium = BLACKSMITH_4V if mode == "performance" else GITHUB_HOSTED
-    hot_path = GITHUB_HOSTED if mode == "economic" else BLACKSMITH_4V
-    control = CONTABO_CONTROL if mode == "default" else GITHUB_HOSTED
+    control = GITHUB_HOSTED if mode == "economic" else NEXU_SMALL
+    workload = GITHUB_HOSTED if mode == "economic" else NEXU_MEDIUM
+    browser_workload = GITHUB_HOSTED if mode == "economic" else NEXU_LARGE
+    # UI P0 is the memory-heavy Playwright domain suite; prefer the dedicated
+    # xlarge class once available so large remains headroom for lighter UI jobs.
+    ui_p0_workload = GITHUB_HOSTED if mode == "economic" else NEXU_XLARGE
 
     return {
         "runs_on": {
             "control": control,
-            "general_medium": general_medium,
-            "workspace_unit": GITHUB_HOSTED,
+            "general_medium": workload,
+            "workspace_unit": workload,
             "windows_tools": WINDOWS_HOSTED,
-            "js_hot": hot_path,
-            "ui_hot": hot_path,
-            "visual_hot": hot_path,
+            "js_hot": workload,
+            "ui_hot": browser_workload,
+            "ui_p0": ui_p0_workload,
+            "visual_hot": browser_workload,
         },
         "decision": {
             "schema_version": 1,

.github/workflows/backport-label-guard.yml

@@ -3,6 +3,8 @@ name: backport-label-guard
 # when someone applies a backport label, verify they have write+ permission (this includes
 # outside collaborators granted write). If not, remove the label and comment. Removing a label
 # fires the "unlabeled" event, not "labeled", so there is no loop.
+# GitHub App bots never appear in the collaborators API (permission reads as "none"), so
+# trusted automation apps are allowlisted by login instead.
 
 on:
   pull_request_target:
@@ -31,6 +33,10 @@ jobs:
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
+          if [ "$ACTOR" = "open-design-crew[bot]" ]; then
+            echo "Authorized: $ACTOR (allowlisted app)"
+            exit 0
+          fi
           perm=$(gh api "repos/$REPO/collaborators/$ACTOR/permission" --jq '.permission' 2>/dev/null || echo none)
           case "$perm" in
             admin|maintain|write)

.github/workflows/cache-maintenance.yml

@@ -29,6 +29,23 @@ jobs:
         with:
           save-pnpm-cache: 'true'
 
+
+  # GHA actions/cache is repo-scoped and shared across hosted + every Nexu
+  # size (small/medium/large). One Linux seed under the pinned home store path
+  # is enough for the whole fleet; no per-size matrix required.
+  seed-pnpm-linux:
+    if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v6.0.2
+
+      - name: Seed Linux pnpm cache
+        uses: ./.github/actions/setup-workspace
+        with:
+          save-pnpm-cache: 'true'
+
   clean-closed-pr-buildkit:
     if: github.event_name == 'pull_request_target' && github.repository == 'nexu-io/open-design'
     runs-on: ubuntu-24.04

.github/workflows/ci.yml

@@ -31,7 +31,14 @@ concurrency:
 jobs:
   runners:
     name: Resolve runner profiles
-    runs-on: ubuntu-24.04
+    # Resolve on the Nexu ARC fleet for trusted branches, but preserve the
+    # hosted bootstrap path for external forks and explicit economic mode.
+    runs-on: >-
+      ${{ ((github.event_name == 'pull_request'
+        && github.event.pull_request.head.repo.full_name != github.repository)
+        || vars.OD_CI_RUNNER_MODE == 'economic')
+        && 'ubuntu-24.04'
+        || 'nexu-runners-small' }}
     outputs:
       runs_on: ${{ steps.runners.outputs.runs_on }}
       decision: ${{ steps.runners.outputs.decision }}
@@ -43,7 +50,13 @@ jobs:
       - name: Resolve runner profiles
         id: runners
         env:
-          OD_CI_RUNNER_MODE: ${{ vars.OD_CI_RUNNER_MODE }}
+          # Fork PRs cannot rely on repository variables, so keep their required
+          # validation on GitHub-hosted runners even when private pools are down.
+          OD_CI_RUNNER_MODE: >-
+            ${{ github.event_name == 'pull_request'
+              && github.event.pull_request.head.repo.full_name != github.repository
+              && 'economic'
+              || vars.OD_CI_RUNNER_MODE }}
         run: python3 .github/scripts/runners.py
 
   scopes:
@@ -353,11 +366,15 @@ jobs:
         run: pnpm --filter @open-design/tools-pack exec vitest run tests/launcher-payload.test.ts
 
   web_workspace_tests:
-    name: Web workspace tests
+    name: Web workspace tests (${{ matrix.shard }}/2)
     needs: [scopes, runners]
     if: ${{ needs.scopes.outputs.run_web_workspace_tests == 'true' }}
     runs-on: ${{ fromJSON(needs.runners.outputs.runs_on).js_hot }}
     timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2]
 
     steps:
       - name: Checkout
@@ -375,7 +392,7 @@ jobs:
         run: pnpm --filter @open-design/web build:sidecar
 
       - name: Web workspace tests
-        run: pnpm --filter @open-design/web test
+        run: pnpm --filter @open-design/web exec vitest run -c vitest.config.ts --maxWorkers=2 --shard=${{ matrix.shard }}/2
 
   e2e_vitest:
     name: E2E Vitest
@@ -464,7 +481,7 @@ jobs:
     name: UI P0 (${{ matrix.name }})
     needs: [scopes, runners]
     if: ${{ needs.scopes.outputs.run_ui_p0 == 'true' }}
-    runs-on: ${{ fromJSON(needs.runners.outputs.runs_on).ui_hot }}
+    runs-on: ${{ fromJSON(needs.runners.outputs.runs_on).ui_p0 }}
     timeout-minutes: 45
     strategy:
       fail-fast: false
@@ -481,14 +498,14 @@ jobs:
       - name: Setup workspace
         uses: ./.github/actions/setup-workspace
         with:
-          runner-labels: ${{ toJSON(fromJSON(needs.runners.outputs.runs_on).ui_hot) }}
+          runner-labels: ${{ toJSON(fromJSON(needs.runners.outputs.runs_on).ui_p0) }}
 
       - name: Setup Playwright
         uses: ./.github/actions/setup-playwright
         with:
           package-json-path: e2e/package.json
           install-command: pnpm -C e2e exec playwright install --with-deps chromium
-          runner-labels: ${{ toJSON(fromJSON(needs.runners.outputs.runs_on).ui_hot) }}
+          runner-labels: ${{ toJSON(fromJSON(needs.runners.outputs.runs_on).ui_p0) }}
 
       - name: Prebuild workspace type declarations
         run: |
@@ -601,6 +618,7 @@ jobs:
           name: visual-pr-capture-${{ github.event.pull_request.number }}-${{ github.run_id }}-${{ matrix.name }}
           path: |
             e2e/ui/reports/visual-screenshots
+            e2e/ui/reports/visual-test-results
             e2e/ui/reports/visual-results.json
             e2e/ui/reports/visual-report/manifest.json
           if-no-files-found: ignore
@@ -613,6 +631,7 @@ jobs:
           name: visual-ci-${{ github.run_id }}-${{ matrix.name }}
           path: |
             e2e/ui/reports/visual-screenshots
+            e2e/ui/reports/visual-test-results
             e2e/ui/reports/visual-results.json
           if-no-files-found: ignore
           retention-days: 7
@@ -740,6 +759,8 @@ jobs:
               handoff_dir="$(python3 .github/scripts/handoff.py dir comment "$handoff_id" --root "$handoff_root")"
               mkdir -p "$handoff_dir"
               marker="<!-- merge-queue-needs-validation -->"
+              # Markdown code spans are intentionally literal in these single-quoted strings.
+              # shellcheck disable=SC2016
               {
                 printf '%s\n' "$marker"
                 # Markdown code spans are intentional literal text.

.github/workflows/notify-release-feishu.yml

@@ -36,6 +36,16 @@ on:
         required: false
         type: string
         default: ""
+      amr_profile:
+        description: "Optional AMR profile to bake (test / feature-test enable the Workspace Team transport). Empty uses the per-branch default: test on release/v0.18.0, otherwise prod."
+        required: false
+        type: string
+        default: ""
+      win_x64_smoke_mode:
+        description: "Windows x64 packaged smoke coverage (skip/core/full). Empty uses the per-branch default: skip on release/v0.18.0 to bypass the known packaged-win smoke flake that gates publish, otherwise release-prerelease's own default."
+        required: false
+        type: string
+        default: ""
 
 permissions:
   contents: write
@@ -65,6 +75,23 @@ jobs:
       # version). Only set when building from a non-release ref like main, where
       # release-prerelease cannot derive the base version from the branch name.
       release_version: ${{ inputs.release_version }}
+      # Workspace Team profile baked into the packaged build (see
+      # apps/packaged/src/workspace-team.ts + release-prerelease.yml). Release
+      # builds ship `prod`: production's Vela backend now serves the feature, so
+      # a release prerelease points users at the production console rather than
+      # an internal test environment. A manual dispatch can still override to
+      # test / feature-test to cut a build against those backends.
+      #
+      # (This replaces a temporary `test` default on release/v0.18.0 that
+      # existed only while prod's resource-hub storage was unconfigured.)
+      amr_profile: ${{ inputs.amr_profile || 'prod' }}
+      # Windows packaged smoke is a hard publish gate (publish needs build_win
+      # success) but currently flakes on release/v0.18.0 ("did not reach main app
+      # shell"), skip-blocking EVERY platform's publish + the Feishu card. TEMPORARY:
+      # skip it on release/v0.18.0 so the workspace-team prerelease can actually
+      # ship its mac/win/linux packages + post its card. Manual dispatch overrides.
+      # Remove this branch default once the win smoke flake root cause is fixed.
+      win_x64_smoke_mode: ${{ inputs.win_x64_smoke_mode || (github.ref_name == 'release/v0.18.0' && 'skip') || '' }}
 
   notify:
     name: Notify Feishu (release)