fix: harden plugin lifecycle and add packaged runtime gates

.github/workflows/addon-author-packages.yml

@@ -0,0 +1,30 @@
+name: Independent add-on author distributions
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'packages/plugin-*/**'
+      - 'examples/addons/**'
+      - 'scripts/addons/prepare-release.mjs'
+      - '.github/workflows/addon-author-packages.yml'
+permissions:
+  contents: read
+jobs:
+  prepare:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+      - name: Build independent distributions from committed source
+        run: node scripts/addons/prepare-release.mjs
+      - name: Verify exact distribution checksums
+        working-directory: addon-author-release
+        run: sha256sum --check SHA256SUMS
+      - uses: actions/upload-artifact@v4
+        with:
+          name: addon-author-release-${{ github.sha }}
+          path: addon-author-release/
+          if-no-files-found: error

.github/workflows/addon-native-ui.yml

@@ -0,0 +1,110 @@
+name: Retry native add-on UI acceptance
+on:
+  pull_request:
+    paths:
+      - scripts/addons/native-ui.mjs
+      - scripts/addons/install-webdriver.ps1
+      - scripts/addons/windows-*.ps1
+      - .github/workflows/addon-native-ui.yml
+  workflow_dispatch:
+    inputs:
+      build_run_id:
+        description: Packaged add-on workflow run containing the installer input artifacts
+        required: true
+        type: string
+      platform:
+        description: Run either ready installer artifact, or both platforms
+        required: true
+        type: choice
+        default: both
+        options: [both, Linux, Windows]
+permissions:
+  contents: read
+  actions: read
+jobs:
+  harness-syntax:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+      - run: node --check scripts/addons/native-ui.mjs
+      - name: Verify refusal outside disposable CI
+        run: |
+          node --input-type=module <<'JS'
+          import assert from 'node:assert/strict';
+          import { spawnSync } from 'node:child_process';
+          const result = spawnSync(process.execPath, ['scripts/addons/native-ui.mjs'], {
+            env: { ...process.env, GITHUB_ACTIONS: 'false' }, encoding: 'utf8'
+          });
+          assert.notEqual(result.status, 0);
+          assert.match(result.stderr, /Requires disposable GitHub CI/);
+          JS
+  native-ui:
+    if: github.event_name == 'workflow_dispatch'
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ inputs.platform == 'Linux' && fromJSON('["ubuntu-22.04"]') || inputs.platform == 'Windows' && fromJSON('["windows-latest"]') || fromJSON('["ubuntu-22.04", "windows-latest"]') }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+      - name: Validate installer source run
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BUILD_RUN_ID: ${{ inputs.build_run_id }}
+        run: |
+          node --input-type=module <<'JS'
+          import assert from 'node:assert/strict';
+          const id = process.env.BUILD_RUN_ID;
+          assert.match(id, /^\d+$/);
+          const response = await fetch(`https://api.github.com/repos/${process.env.GITHUB_REPOSITORY}/actions/runs/${id}`, {
+            headers: { Authorization: `Bearer ${process.env.GH_TOKEN}`, Accept: 'application/vnd.github+json' }
+          });
+          assert.equal(response.status, 200);
+          const run = await response.json();
+          assert.equal(run.repository.full_name, process.env.GITHUB_REPOSITORY);
+          assert.equal(run.head_repository.full_name, process.env.GITHUB_REPOSITORY);
+          assert.equal(run.path, '.github/workflows/addon-packaged.yml');
+          console.log(`Testing installers from ${run.head_sha}; harness ${process.env.GITHUB_SHA}`);
+          JS
+      - uses: actions/download-artifact@v4
+        with:
+          name: addon-native-ui-inputs-${{ runner.os }}
+          run-id: ${{ inputs.build_run_id }}
+          github-token: ${{ github.token }}
+      - name: Native Linux dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends libwebkit2gtk-4.1-0 libayatana-appindicator3-1 webkit2gtk-driver xvfb dbus-x11 imagemagick
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install external WebDriver
+        run: cargo install tauri-driver --version 2.0.6 --locked
+      - name: Verify native Windows dependency toolchain
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: ./scripts/addons/windows-native-perl.ps1
+      - name: Install matching Microsoft WebView2 driver
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: ./scripts/addons/install-webdriver.ps1
+      - name: Native desktop UI acceptance (Linux)
+        if: runner.os == 'Linux'
+        run: dbus-run-session -- xvfb-run -a node scripts/addons/native-ui.mjs
+      - name: Native desktop UI acceptance (Windows)
+        if: runner.os == 'Windows'
+        run: node scripts/addons/native-ui.mjs
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: addon-native-ui-evidence-${{ runner.os }}
+          path: addon-native-ui-evidence/
+          if-no-files-found: warn

.github/workflows/addon-packaged.yml

@@ -0,0 +1,243 @@
+name: Packaged add-on runtime
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      [
+        "scripts/addons/**",
+        "packages/plugin-*/**",
+        "examples/addons/**",
+        "src/components/addons/**",
+        "src/components/settings/addons-settings*",
+        "src/components/chat/Composer.tsx",
+        "src/components/layout/right-panel.tsx",
+        "src/components/overlays/command-palette.tsx",
+        "src/lib/addons/**",
+        "src/stores/addons-store.ts",
+        "src-tauri/src/addons/**",
+        "src-tauri/src/commands/addons.rs",
+        "src-tauri/addon-protocol/**",
+        "src-tauri/addon-host/**",
+        "src-tauri/tauri.conf.json",
+        "scripts/build-addon-host.sh",
+        ".github/workflows/addon-packaged.yml",
+      ]
+permissions:
+  contents: read
+concurrency:
+  group: addon-packaged-${{ github.ref }}
+  # Preserve installer evidence and populated caches from an in-flight build.
+  # Harness-only iterations can reuse its artifacts through addon-native-ui.yml.
+  cancel-in-progress: false
+jobs:
+  bundle:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 90
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Install Linux system dependencies
+        if: matrix.os == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libwebkit2gtk-4.1-dev \
+            build-essential \
+            libssl-dev \
+            libgtk-3-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf \
+            libfuse2 \
+            file webkit2gtk-driver xvfb dbus-x11 imagemagick
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install standalone add-on host Windows GNU target
+        if: runner.os == 'Windows'
+        run: rustup target add x86_64-pc-windows-gnu
+
+      - name: Install add-on host C compiler
+        if: runner.os == 'Windows'
+        uses: msys2/setup-msys2@v2
+        with:
+          msystem: MINGW64
+          install: mingw-w64-x86_64-gcc
+          path-type: inherit
+
+      - name: Select add-on host compiler
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: '"C:\msys64\mingw64\bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append'
+
+      - name: Select native Perl for MSVC dependencies
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: ./scripts/addons/windows-native-perl.ps1
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri -> target
+          cache-on-failure: true
+          key: addon-packaged-${{ matrix.os }}
+
+      - name: Setup Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install frontend dependencies
+        run: npm ci
+
+      - name: Build and verify independent add-on packages and release host
+        shell: bash
+        run: |
+          bash scripts/addons/build-examples.sh
+          bash scripts/build-addon-host.sh --profile release
+          if [ "$RUNNER_OS" = Windows ]; then
+            addon_host=src-tauri/binaries/codemux-addon-host-windows-x64.exe
+          else
+            addon_host=src-tauri/binaries/codemux-addon-host-linux-x64
+          fi
+          node scripts/addons/sdk-native.mjs "$addon_host"
+
+      - name: Verify AppImage provenance checks
+        if: runner.os == 'Linux'
+        run: node --test scripts/addons/elf-provenance-check.mjs
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.2.21"
+
+      - name: Stage claude-agent sidecar binary
+        shell: bash
+        run: |
+          bash scripts/build-claude-sidecar.sh --strict
+          TARGET="${CARGO_BUILD_TARGET:-$(rustc -vV | grep host | cut -d' ' -f2)}"
+          case "$TARGET" in
+            *windows*) DEST="src-tauri/binaries/codemux-claude-sidecar-$TARGET.exe" ;;
+            *)         DEST="src-tauri/binaries/codemux-claude-sidecar-$TARGET" ;;
+          esac
+          if [ ! -s "$DEST" ]; then
+            echo "::error::build-claude-sidecar.sh did not produce a non-empty binary at $DEST"
+            echo "::error::Target: $TARGET"
+            ls -la src-tauri/binaries/ || true
+            exit 1
+          fi
+
+      - name: Stage agent-browser sidecar binary
+        shell: bash
+        run: |
+          bash scripts/copy-agent-browser.sh
+          TARGET="${CARGO_BUILD_TARGET:-$(rustc -vV | grep host | cut -d' ' -f2)}"
+          case "$TARGET" in
+            *windows*) DEST="src-tauri/binaries/agent-browser-$TARGET.exe" ;;
+            *)         DEST="src-tauri/binaries/agent-browser-$TARGET" ;;
+          esac
+          if [ ! -s "$DEST" ]; then
+            echo "::error::copy-agent-browser.sh did not produce a non-empty binary at $DEST"
+            echo "::error::Target: $TARGET"
+            ls -la src-tauri/binaries/ || true
+            ls -la node_modules/agent-browser/bin/ || true
+            exit 1
+          fi
+
+      - name: Build codemux-remote binary (release profile)
+        shell: bash
+        run: |
+          bash scripts/build-codemux-remote.sh --profile release
+
+          TARGET="${CARGO_BUILD_TARGET:-$(rustc -vV | grep host | cut -d' ' -f2)}"
+          case "$TARGET" in
+            *windows*) DEST="src-tauri/binaries/codemux-remote-$TARGET.exe" ;;
+            *)         DEST="src-tauri/binaries/codemux-remote-$TARGET" ;;
+          esac
+          STAMP="src-tauri/binaries/.codemux-remote-$TARGET.profile"
+
+          if [ ! -s "$DEST" ]; then
+            echo "::error::codemux-remote build did not produce a non-empty binary at $DEST"
+            exit 1
+          fi
+
+          if [ ! -f "$STAMP" ]; then
+            echo "::error::missing provenance stamp $STAMP — build-codemux-remote.sh did not complete"
+            exit 1
+          fi
+          cat "$STAMP"
+          if ! grep -qx 'profile=release' "$STAMP"; then
+            echo "::error::codemux-remote was staged from a non-release profile — refusing to publish"
+            exit 1
+          fi
+          ls -la src-tauri/binaries/codemux-remote-*
+
+      - name: Configure git identity
+        shell: bash
+        run: |
+          git config --global user.email "release@codemux.dev"
+          git config --global user.name "Codemux Release"
+
+      - name: Pre-cache stable linuxdeploy + plugin-appimage
+        if: matrix.os == 'ubuntu-22.04'
+        run: |
+          mkdir -p ~/.cache/tauri
+          curl -fsSL -o ~/.cache/tauri/linuxdeploy-plugin-appimage.AppImage \
+            https://github.com/linuxdeploy/linuxdeploy-plugin-appimage/releases/download/1-alpha-20250213-1/linuxdeploy-plugin-appimage-x86_64.AppImage
+          chmod +x ~/.cache/tauri/linuxdeploy-plugin-appimage.AppImage
+          ls -la ~/.cache/tauri/
+
+      - name: Build installers without publishing
+        shell: bash
+        env:
+          NO_STRIP: "true"
+        run: |
+          if [ "$RUNNER_OS" = Windows ]; then formats=nsis; else formats=deb,appimage; fi
+          npm run tauri -- build --verbose --bundles "$formats" --config '{"bundle":{"createUpdaterArtifacts":false}}'
+      - name: Verify bundled host and runtime deadlines
+        run: node scripts/addons/packaged-smoke.mjs src-tauri/target/release/bundle
+      - name: Record installer build revision
+        run: node -e "require('node:fs').writeFileSync('addon-native-ui-build.json', JSON.stringify({commit:process.env.GITHUB_SHA,run:process.env.GITHUB_RUN_ID,platform:process.platform}))"
+      - name: Preserve built acceptance inputs for harness-only retries
+        uses: actions/upload-artifact@v4
+        with:
+          name: addon-native-ui-inputs-${{ runner.os }}
+          retention-days: 7
+          path: |
+            addon-native-ui-build.json
+            src-tauri/target/release/bundle/deb/*.deb
+            src-tauri/target/release/bundle/nsis/*.exe
+            examples/addons/project-brief/*.cmxaddon
+            examples/addons/issue-companion/*.cmxaddon
+            scripts/addons/fixtures/fault-isolation/*.cmxaddon
+      - name: Install external WebDriver
+        run: cargo install tauri-driver --version 2.0.6 --locked
+      - name: Install matching Microsoft WebView2 driver
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: ./scripts/addons/install-webdriver.ps1
+      - name: Native desktop UI acceptance (Linux)
+        if: runner.os == 'Linux'
+        run: dbus-run-session -- xvfb-run -a node scripts/addons/native-ui.mjs
+      - name: Native desktop UI acceptance (Windows)
+        if: runner.os == 'Windows'
+        run: node scripts/addons/native-ui.mjs
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: addon-native-ui-evidence-${{ runner.os }}
+          path: addon-native-ui-evidence/
+          if-no-files-found: warn
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: addon-packaged-evidence-${{ matrix.os }}
+          path: addon-packaged-evidence.json
+          if-no-files-found: warn