feat(taiji): unofficial custom package - warden/poke/RBAC, legion, ACP bridge, knowledge-base search

.github/workflows/ci.yml

@@ -138,9 +138,41 @@ jobs:
           cargo test --locked -p terminal-core background_only_binding_is_owned_by_the_session -- --test-threads=1
 
   # ── Rust: build check ─────────────────────────────────────────────
+  # Cargo-deny gate: advisories + licenses + sources (+ bans at warn level).
+  # Kept on Linux only - the license/source graph is OS-independent, so a
+  # single check covers the whole workspace without triplicating the run.
+  cargo-deny:
+    name: Cargo Deny (advisories + licenses)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: swatinem/rust-cache@v2
+        with:
+          shared-key: "cargo-deny-v1"
+          cache-bin: false
+
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --locked --version 0.20.2
+
+      - name: Deny advisories
+        run: cargo deny check advisories
+
+      - name: Deny licenses
+        run: cargo deny check licenses
+
+      - name: Deny sources
+        run: cargo deny check sources
+
   rust-build-check:
     name: Rust Build Check (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    # Rust workspace check + 6 test groups across 3 OS; generous but bounded
+    # so a wedged dependency/network cannot burn the full 6h default.
+    timeout-minutes: 60
     env:
       # Keep the workspace check plus desktop test profiles within hosted-runner disk limits.
       CARGO_INCREMENTAL: "0"
@@ -197,13 +229,62 @@ jobs:
 
       - uses: swatinem/rust-cache@v2
         with:
-          shared-key: "ci-check-v3-${{ runner.os }}-no-cargo-bin-v1"
+          shared-key: "ci-check-v4-${{ runner.os }}-no-cargo-bin-v1-sherpa-native-v1"
           cache-bin: false
+          # sherpa-onnx-sys stores downloaded native archives beside Cargo's
+          # normal artifacts. Preserve that directory with the build-script
+          # fingerprints that reference it, or restored test builds cannot link.
+          cache-directories: |
+            target/sherpa-onnx-prebuilt
           # PR caches are scoped to merge refs; trusted main pushes own shared
           # refreshes and retain completed dependency builds after late test failures.
           save-if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
           cache-on-failure: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
 
+      # sherpa-onnx-sys downloads its native static libraries from GitHub
+      # Releases at build time. Hosted runners intermittently fail that
+      # download (network/rate limits), so pre-fetch and extract the archive
+      # here, then point SHERPA_ONNX_LIB_DIR at the extracted lib directory.
+      # The build script uses that variable directly without any cache/rerun
+      # logic, so both `cargo check` and `cargo test` link against the same
+      # pre-fetched libraries. Windows is skipped: its archive is already
+      # cached in the rust-cache path and the previous failures were Linux and
+      # macOS only.
+      - name: Pre-download sherpa-onnx native libraries
+        if: runner.os != 'Windows'
+        shell: bash
+        env:
+          SHERPA_VERSION: "1.13.4"
+        run: |
+          set -euo pipefail
+          case "${{ runner.os }}" in
+            Linux)
+              archive="sherpa-onnx-v${SHERPA_VERSION}-linux-x64-static-lib.tar.bz2"
+              ;;
+            macOS)
+              archive="sherpa-onnx-v${SHERPA_VERSION}-osx-arm64-static-lib.tar.bz2"
+              ;;
+            *)
+              exit 0
+              ;;
+          esac
+          mkdir -p "$RUNNER_TEMP/sherpa-onnx-libs"
+          archive_path="$RUNNER_TEMP/sherpa-onnx-libs/$archive"
+          if [ ! -f "$archive_path" ]; then
+            curl -fL --retry 5 --retry-all-errors \
+              "https://github.com/k2-fsa/sherpa-onnx/releases/download/v${SHERPA_VERSION}/${archive}" \
+              -o "$archive_path"
+          fi
+          lib_dir="$RUNNER_TEMP/sherpa-onnx-libs/lib"
+          if [ ! -d "$lib_dir" ]; then
+            tar -xjf "$archive_path" -C "$RUNNER_TEMP/sherpa-onnx-libs"
+            # The archive extracts to a versioned directory; its lib/ is the
+            # native library directory the build script expects.
+            lib_dir="$(find "$RUNNER_TEMP/sherpa-onnx-libs" -maxdepth 2 -type d -name lib | head -n 1)"
+          fi
+          test -n "$lib_dir" && test -f "$lib_dir/libsherpa-onnx-c-api.a"
+          echo "SHERPA_ONNX_LIB_DIR=$lib_dir" >> "$GITHUB_ENV"
+
       - name: Check compilation
         run: cargo check --locked --workspace
 
@@ -253,6 +334,9 @@ jobs:
   frontend-build:
     name: Frontend Build
     runs-on: ubuntu-latest
+    # Full web-ui test + build + i18n audits; bounded so a stuck install or
+    # test cannot burn the full 6h default.
+    timeout-minutes: 40
     env:
       NODE_OPTIONS: --max-old-space-size=6144
     steps:

.github/workflows/desktop-package.yml

@@ -34,6 +34,7 @@ jobs:
   prepare:
     name: Prepare
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       version: ${{ steps.meta.outputs.version }}
       release_tag: ${{ steps.meta.outputs.release_tag }}
@@ -95,10 +96,13 @@ jobs:
     runs-on: ${{ matrix.platform.os }}
     needs: prepare
     if: needs.prepare.outputs.relay_image_only != 'true'
+    # Release packaging: full release-profile build + bundles per platform.
+    # 6h default is far too long for a wedged job; cap it at 120m.
+    timeout-minutes: 120
     env:
       NODE_OPTIONS: --max-old-space-size=6144
       BITFUN_ENABLE_UPDATER_ARTIFACTS: ${{ needs.prepare.outputs.upload_to_release }}
-      TAURI_UPDATER_ENDPOINT: https://github.com/GCWing/BitFun/releases/latest/download/latest.json
+      TAURI_UPDATER_ENDPOINT: https://github.com/${{ github.repository }}/releases/latest/download/latest.json
       TAURI_UPDATER_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
       # Same trust root, compiled into the Desktop binary so one-click relay
       # deploy can verify the signed checksum locally and hand the remote host
@@ -274,6 +278,7 @@ jobs:
   publish-relay-image:
     name: Publish Relay Server Image
     needs: [prepare, linux-binaries]
+    timeout-minutes: 60
     if: >-
       always() &&
       (needs.prepare.outputs.upload_to_release == 'true' ||
@@ -285,7 +290,7 @@ jobs:
       contents: write
       packages: write
     env:
-      IMAGE: ghcr.io/gcwing/bitfun-relay-server
+      IMAGE: ghcr.io/${{ github.repository_owner }}/bitfun-relay-server
 
     steps:
       - name: Checkout
@@ -311,7 +316,7 @@ jobs:
           set -euo pipefail
           mkdir -p linux-release-assets
           gh release download "${RELEASE_TAG}" \
-            --repo GCWing/BitFun \
+            --repo "${{ github.repository }}" \
             --dir linux-release-assets \
             --pattern 'bitfun-relay-server-*.tar.gz' \
             --pattern 'bitfun-relay-server-*.tar.gz.sha256'
@@ -359,7 +364,7 @@ jobs:
             if [[ "${IMAGE_ONLY}" == "true" ]]; then
               # Backfilling an older release must not roll the floating tag
               # backwards. GitHub's latest endpoint excludes prereleases.
-              latest_release="$(gh api repos/GCWing/BitFun/releases/latest --jq .tag_name)"
+              latest_release="$(gh api repos/${{ github.repository }}/releases/latest --jq .tag_name)"
               if [[ "${RELEASE_TAG}" == "${latest_release}" ]]; then
                 echo "${IMAGE}:latest"
               fi
@@ -465,6 +470,7 @@ jobs:
   upload-release-assets:
     name: Upload Release Assets
     needs: [prepare, package, linux-binaries, publish-relay-image]
+    timeout-minutes: 30
     if: >-
       always() &&
       needs.prepare.outputs.upload_to_release == 'true' &&
@@ -520,6 +526,7 @@ jobs:
         env:
           BITFUN_SIGNING_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           BITFUN_SIGNING_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          BITFUN_SIGNING_PUBKEY: ${{ secrets.TAURI_UPDATER_PUBKEY }}
         run: bash scripts/sign-release-assets.sh release-manual-assets/*.exe
 
       - name: Collect updater assets
@@ -537,7 +544,7 @@ jobs:
             --manual-assets-dir release-manual-assets \
             --version "${{ needs.prepare.outputs.version }}" \
             --tag "${{ needs.prepare.outputs.release_tag }}" \
-            --repo "GCWing/BitFun" \
+            --repo "${{ github.repository }}" \
             --out release-updater-assets/latest.json \
             --required-platforms "${REQUIRED_UPDATER_PLATFORMS}"
 
@@ -555,7 +562,7 @@ jobs:
             --assets-dir linux-release-assets \
             --version "${{ needs.prepare.outputs.version }}" \
             --tag "${{ needs.prepare.outputs.release_tag }}" \
-            --repo "GCWing/BitFun" \
+            --repo "${{ github.repository }}" \
             --out linux-release-assets/linux-binaries.json
 
       # The Tauri bundler signs the five updater artifacts during `tauri build`,
@@ -587,36 +594,47 @@ jobs:
           # can fetch a key for is not verifiable.
           printf '%s' "${BITFUN_SIGNING_PUBKEY}" | base64 -d >release-assets/minisign.pub
 
+      - name: Stage uniquely named release assets
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s globstar
+          node scripts/stage-github-release-assets.mjs \
+            --out-dir release-upload-assets \
+            release-updater-assets/* \
+            release-manual-assets/*.exe \
+            release-manual-assets/*.exe.sig \
+            release-assets/**/*.AppImage \
+            release-assets/**/*.AppImage.sig \
+            release-assets/**/*.deb \
+            release-assets/**/*.deb.sig \
+            release-assets/**/*.dmg \
+            release-assets/**/*.dmg.sig \
+            release-assets/**/*.rpm \
+            release-assets/**/*.rpm.sig \
+            release-assets/minisign.pub \
+            linux-release-assets/bitfun-cli-*.tar.gz \
+            linux-release-assets/bitfun-cli-*.tar.gz.sha256 \
+            linux-release-assets/bitfun-relay-server-*.tar.gz \
+            linux-release-assets/bitfun-relay-server-*.tar.gz.sha256 \
+            linux-release-assets/*.tar.gz.sig \
+            linux-release-assets/*.tar.gz.sha256.sig \
+            linux-release-assets/linux-binaries.json \
+            relay-image-assets/relay-image.json \
+            relay-image-assets/relay-image.json.sig
+
       - name: Upload to release
         uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ needs.prepare.outputs.release_tag }}
           generate_release_notes: true
-          files: |
-            release-updater-assets/*
-            release-manual-assets/*.exe
-            release-manual-assets/*.exe.sig
-            release-assets/**/*.AppImage
-            release-assets/**/*.deb
-            release-assets/**/*.dmg
-            release-assets/**/*.rpm
-            release-assets/**/*.sig
-            release-assets/minisign.pub
-            linux-release-assets/bitfun-cli-*.tar.gz
-            linux-release-assets/bitfun-cli-*.tar.gz.sha256
-            linux-release-assets/bitfun-relay-server-*.tar.gz
-            linux-release-assets/bitfun-relay-server-*.tar.gz.sha256
-            linux-release-assets/*.tar.gz.sig
-            linux-release-assets/*.tar.gz.sha256.sig
-            linux-release-assets/linux-binaries.json
-            relay-image-assets/relay-image.json
-            relay-image-assets/relay-image.json.sig
+          files: release-upload-assets/*
           fail_on_unmatched_files: true
 
       - name: Verify published updater manifest
         run: |
           curl -fsSL --retry 5 --retry-delay 3 \
-            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/latest.json" \
+            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/latest.json" \
             -o latest.published.json
           node scripts/verify-tauri-latest-json.mjs \
             --manifest latest.published.json \
@@ -628,7 +646,7 @@ jobs:
       - name: Verify published Linux binaries manifest
         run: |
           curl -fsSL --retry 5 --retry-delay 3 \
-            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/linux-binaries.json" \
+            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/linux-binaries.json" \
             -o linux-binaries.published.json
           test "$(jq -r '.version' linux-binaries.published.json)" = "${{ needs.prepare.outputs.version }}"
           while IFS= read -r cli_url; do
@@ -639,13 +657,13 @@ jobs:
       - name: Verify published Relay image descriptor
         run: |
           curl -fsSL --retry 5 --retry-delay 3 \
-            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json" \
+            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json" \
             -o relay-image.published.json
           test "$(jq -r '.tag' relay-image.published.json)" = "${{ needs.prepare.outputs.release_tag }}"
-          test "$(jq -r '.image' relay-image.published.json)" = "ghcr.io/gcwing/bitfun-relay-server"
+          test "$(jq -r '.image' relay-image.published.json)" = "ghcr.io/${{ github.repository_owner }}/bitfun-relay-server"
           jq -e '.digest | test("^sha256:[0-9a-f]{64}$")' relay-image.published.json >/dev/null
           curl -fsSL --retry 5 --retry-delay 3 \
-            "https://github.com/GCWing/BitFun/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json.sig" \
+            "https://github.com/${{ github.repository }}/releases/download/${{ needs.prepare.outputs.release_tag }}/relay-image.json.sig" \
             -o /dev/null
 
       # Nudge the openbitfun.com mirror to sync now instead of on its next

.github/workflows/nightly.yml

@@ -162,6 +162,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Generate web API bindings
+        run: pnpm --dir src/web-ui run gen:types
+
       - name: Type-check web UI
         run: pnpm run type-check:web
 

.gitignore

@@ -23,11 +23,44 @@ dist-ssr
 # Build outputs - Rust/Tauri
 target/
 **/target/
+.target/
 /.targets/
+# Local evidence working dir (fully ignored; intermediate artifacts go to
+# outside the repo)
+target2/
 # The deployable Rust services use the workspace lockfile for reproducible
 # container builds.
 !Cargo.lock
 
+# Work artifacts that must never enter the repo (S-37/S-56 hygiene):
+# recon/fix/verify/report/sediment intermediates, sync records, ws-check data.
+/docs/plans/RECON-*
+/docs/plans/FIX-*
+/docs/plans/VERIFY-*
+/docs/plans/REPORT-*
+/docs/plans/SEDIMENT-*
+/docs/plans/sync-record-*
+/docs/plans/recon-*
+/docs/plans/fix-*
+/docs/plans/doc-governance-report-*
+/docs/plans/pr-final-*
+/docs/plans/ws-check-*
+/docs/plans/del-*.json
+/docs/plans/侦查-*
+/docs/plans/核对-*
+/docs/plans/核查-*
+/docs/plans/*.log
+/docs/plans/*.json
+/docs/plans/*.cjs
+
+# Local customization docs stay out of the repo (S-56 sanitize)
+
+/docs/功能文档/
+/交接文档-现状与决议.md
+/fix-dualfeed-停止回报.md
+/docs/plans/review-upstream-sync-*
+/docs/features/agent-hot-reload.md
+
 # Monaco Editor - copied from node_modules
 public/monaco-editor/
 src/web-ui/public/monaco-editor/
@@ -91,5 +124,9 @@ external/
 /.bitfun/search/flashgrep-index/
 .agents/
 /.flashgrep-index-engine/
+/src/apps/desktop/.bitfun/search/flashgrep-index/
+/target/debug/.bitfun/search/flashgrep-index/
 
 .design/
+__pycache__/
+*.pyc