[Init] Initial commit - NetMesh terminal manager

.github/workflows/build-et-binaries.yml

@@ -0,0 +1,332 @@
+name: build-et-binaries
+
+# Trigger philosophy (mirrors build-mosh-binaries.yml):
+#  - Pull requests that touch the et build pipeline run the matrix. Main pushes
+#    provide the post-merge check without duplicating every PR commit.
+#    Artifacts upload as workflow artifacts only; *no* release.
+#  - Manual `workflow_dispatch` with `release_tag` publishes the binaries +
+#    SHA256SUMS to the dedicated binary repository
+#    (`binaricat/Netcatty-et-bin` by default).
+#
+# `paths` keeps unrelated commits (UI, bridges, etc) from rebuilding the et
+# binaries on every push.
+on:
+  workflow_dispatch:
+    inputs:
+      et_ref:
+        description: "EternalTerminal git ref (tag/branch/commit) — see https://github.com/MisterTea/EternalTerminal"
+        type: string
+        default: "et-v6.2.10"
+      release_tag:
+        description: "Optional release tag to attach binaries to (e.g. et-bin-6.2.10-1). Empty = artifacts only."
+        type: string
+        default: ""
+      release_repo:
+        description: "Repository that stores et binary releases."
+        type: string
+        default: "binaricat/Netcatty-et-bin"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/build-et-binaries.yml"
+      - "electron-builder.config.cjs"
+      - "package.json"
+      - "scripts/build-et/**"
+      - "scripts/fetch-et-binaries.cjs"
+      - "scripts/et-extra-resources.cjs"
+  pull_request:
+    paths:
+      - ".github/workflows/build-et-binaries.yml"
+      - "electron-builder.config.cjs"
+      - "package.json"
+      - "scripts/build-et/**"
+      - "scripts/fetch-et-binaries.cjs"
+      - "scripts/et-extra-resources.cjs"
+
+concurrency:
+  group: build-et-binaries-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  ET_REF: ${{ inputs.et_ref || 'et-v6.2.10' }}
+
+jobs:
+  # ------------------------------------------------------------------
+  # Linux x64 (manylinux2014 / glibc 2.17, broad distro compatibility).
+  # ------------------------------------------------------------------
+  build-linux-x64:
+    name: build-linux-x64
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Restore cached PR build
+        id: et-build-cache
+        if: github.event_name == 'pull_request'
+        uses: actions/cache@v6
+        with:
+          path: out/
+          key: et-pr-build-v1-${{ runner.os }}-${{ runner.arch }}-${{ env.ET_REF }}-${{ hashFiles('.github/workflows/build-et-binaries.yml', 'scripts/build-et/**') }}
+      - name: Restore vcpkg download cache
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        uses: actions/cache@v6
+        with:
+          path: .cache/vcpkg-downloads
+          key: vcpkg-downloads-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/build-et/**') }}
+          restore-keys: vcpkg-downloads-${{ runner.os }}-${{ runner.arch }}-
+      - name: Pull build container with retry
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          image="quay.io/pypa/manylinux2014_x86_64"
+          for attempt in 1 2 3; do
+            if docker pull "$image"; then
+              exit 0
+            fi
+            if [[ "$attempt" -lt 3 ]]; then
+              sleep "$((attempt * 5))"
+            fi
+          done
+          exit 1
+      - name: Build et (linux-x64)
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p "${GITHUB_WORKSPACE}/.cache/vcpkg-downloads"
+          docker run --rm --pull=never \
+            -e ET_REF="${ET_REF}" \
+            -e OUT_DIR=/work/out \
+            -e ARCH=x64 \
+            -e VCPKG_DOWNLOADS=/work/.cache/vcpkg-downloads \
+            -v "${GITHUB_WORKSPACE}:/work" \
+            -w /work \
+            quay.io/pypa/manylinux2014_x86_64 \
+            bash scripts/build-et/build-linux.sh
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: et-linux-x64
+          path: out/
+          if-no-files-found: error
+
+  build-linux-arm64:
+    name: build-linux-arm64
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v7
+      - name: Restore cached PR build
+        id: et-build-cache
+        if: github.event_name == 'pull_request'
+        uses: actions/cache@v6
+        with:
+          path: out/
+          key: et-pr-build-v1-${{ runner.os }}-${{ runner.arch }}-${{ env.ET_REF }}-${{ hashFiles('.github/workflows/build-et-binaries.yml', 'scripts/build-et/**') }}
+      - name: Restore vcpkg download cache
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        uses: actions/cache@v6
+        with:
+          path: .cache/vcpkg-downloads
+          key: vcpkg-downloads-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/build-et/**') }}
+          restore-keys: vcpkg-downloads-${{ runner.os }}-${{ runner.arch }}-
+      - name: Pull build container with retry
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        run: |
+          set -euo pipefail
+          image="quay.io/pypa/manylinux2014_aarch64"
+          for attempt in 1 2 3; do
+            if docker pull "$image"; then
+              exit 0
+            fi
+            if [[ "$attempt" -lt 3 ]]; then
+              sleep "$((attempt * 5))"
+            fi
+          done
+          exit 1
+      - name: Build et (linux-arm64)
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p "${GITHUB_WORKSPACE}/.cache/vcpkg-downloads"
+          docker run --rm --pull=never \
+            -e ET_REF="${ET_REF}" \
+            -e OUT_DIR=/work/out \
+            -e ARCH=arm64 \
+            -e VCPKG_DOWNLOADS=/work/.cache/vcpkg-downloads \
+            -v "${GITHUB_WORKSPACE}:/work" \
+            -w /work \
+            quay.io/pypa/manylinux2014_aarch64 \
+            bash scripts/build-et/build-linux.sh
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: et-linux-arm64
+          path: out/
+          if-no-files-found: error
+
+  # ------------------------------------------------------------------
+  # macOS universal2 (arm64 + x86_64 lipo). Min deployment target macOS 11.
+  # ------------------------------------------------------------------
+  build-macos-universal:
+    name: build-macos-universal
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v7
+      - name: Restore cached PR build
+        id: et-build-cache
+        if: github.event_name == 'pull_request'
+        uses: actions/cache@v6
+        with:
+          path: out/
+          key: et-pr-build-v1-${{ runner.os }}-${{ runner.arch }}-${{ env.ET_REF }}-${{ hashFiles('.github/workflows/build-et-binaries.yml', 'scripts/build-et/**') }}
+      - name: Restore vcpkg download cache
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        uses: actions/cache@v6
+        with:
+          path: ${{ runner.temp }}/vcpkg-downloads
+          key: vcpkg-downloads-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/build-et/**') }}
+          restore-keys: vcpkg-downloads-${{ runner.os }}-${{ runner.arch }}-
+      - name: Prepare vcpkg download cache
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p "${RUNNER_TEMP}/vcpkg-downloads"
+          echo "VCPKG_DOWNLOADS=${RUNNER_TEMP}/vcpkg-downloads" >> "$GITHUB_ENV"
+      - name: Build et (darwin-universal)
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        env:
+          ET_REF: ${{ env.ET_REF }}
+          OUT_DIR: ${{ github.workspace }}/out
+          MACOSX_DEPLOYMENT_TARGET: "11.0"
+        run: bash scripts/build-et/build-macos.sh
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: et-darwin-universal
+          path: out/
+          if-no-files-found: error
+
+  # ------------------------------------------------------------------
+  # Windows x64 — static MSVC build (no DLL bundle).
+  # ------------------------------------------------------------------
+  build-windows-x64:
+    name: build-windows-x64
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Restore cached PR build
+        id: et-build-cache
+        if: github.event_name == 'pull_request'
+        uses: actions/cache@v6
+        with:
+          path: out/
+          key: et-pr-build-v1-${{ runner.os }}-${{ runner.arch }}-${{ env.ET_REF }}-${{ hashFiles('.github/workflows/build-et-binaries.yml', 'scripts/build-et/**') }}
+      - name: Restore vcpkg download cache
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        uses: actions/cache@v6
+        with:
+          path: ${{ runner.temp }}\vcpkg-downloads
+          key: vcpkg-downloads-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('scripts/build-et/**') }}
+          restore-keys: vcpkg-downloads-${{ runner.os }}-${{ runner.arch }}-
+      - name: Prepare vcpkg download cache
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        shell: pwsh
+        run: |
+          $downloads = Join-Path $env:RUNNER_TEMP "vcpkg-downloads"
+          New-Item -ItemType Directory -Force -Path $downloads | Out-Null
+          "VCPKG_DOWNLOADS=$downloads" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+      - name: Install ninja
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        run: choco install -y ninja
+      - name: Set up MSVC developer command prompt
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        uses: ilammy/msvc-dev-cmd@v1
+        with:
+          arch: x64
+      - name: Build et (win32-x64)
+        if: github.event_name != 'pull_request' || steps.et-build-cache.outputs.cache-hit != 'true'
+        env:
+          ET_REF: ${{ env.ET_REF }}
+          OUT_DIR: ${{ github.workspace }}\out
+        shell: pwsh
+        run: pwsh -File scripts/build-et/build-windows.ps1
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: et-win32-x64
+          path: out/
+          if-no-files-found: error
+
+  # ------------------------------------------------------------------
+  # Windows arm64 — intentionally not built until a tested client exists.
+  # ------------------------------------------------------------------
+
+  # ------------------------------------------------------------------
+  # Aggregate + optional release to the dedicated binary repository.
+  # ------------------------------------------------------------------
+  release:
+    name: release
+    needs:
+      - build-linux-x64
+      - build-linux-arm64
+      - build-macos-universal
+      - build-windows-x64
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch' && inputs.release_tag != ''
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+      - name: Download artifacts
+        uses: actions/download-artifact@v8
+        with:
+          path: artifacts
+      - name: Stage release files
+        run: |
+          set -euo pipefail
+          mkdir -p release
+          for d in artifacts/*/; do
+            find "$d" -maxdepth 1 -type f -exec cp {} release/ \;
+          done
+          (cd release && find . -maxdepth 1 -type f ! -name SHA256SUMS -printf '%P\n' | sort | xargs sha256sum > SHA256SUMS)
+          ls -la release
+          cat release/SHA256SUMS
+      - name: Determine tag
+        id: tag
+        env:
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        run: |
+          tag="${RELEASE_TAG}"
+          if [[ ! "$tag" =~ ^et-bin-[A-Za-z0-9._-]+$ ]]; then
+            echo "Invalid et binary release tag: $tag" >&2
+            exit 1
+          fi
+          printf 'name=%s\n' "$tag" >> "$GITHUB_OUTPUT"
+      - name: Create / update release
+        env:
+          GH_TOKEN: ${{ secrets.ET_BIN_RELEASE_TOKEN }}
+          RELEASE_REPO: ${{ inputs.release_repo }}
+          RELEASE_TAG: ${{ steps.tag.outputs.name }}
+        run: |
+          set -euo pipefail
+          if [[ -z "${GH_TOKEN:-}" ]]; then
+            echo "::error::ET_BIN_RELEASE_TOKEN is required to publish into ${RELEASE_REPO}."
+            exit 1
+          fi
+          {
+            printf '%s\n' 'Pre-built EternalTerminal `et` client binaries consumed by `scripts/fetch-et-binaries.cjs` during `npm run pack`.'
+            printf 'Built from `MisterTea/EternalTerminal` upstream ref `%s`.\n\n' "${ET_REF}"
+            printf 'Source workflow: %s/%s/actions/runs/%s\n' "${GITHUB_SERVER_URL}" "${GITHUB_REPOSITORY}" "${GITHUB_RUN_ID}"
+            printf 'Source commit: `%s`\n\n' "${GITHUB_SHA}"
+            printf '%s\n' 'All artifacts are Apache-2.0; see `resources/et/README.md` for source provenance.'
+          } > release-notes.md
+          if gh release view "${RELEASE_TAG}" --repo "${RELEASE_REPO}" >/dev/null 2>&1; then
+            gh release edit "${RELEASE_TAG}" \
+              --repo "${RELEASE_REPO}" \
+              --title "${RELEASE_TAG}" \
+              --notes-file release-notes.md
+            gh release upload "${RELEASE_TAG}" release/* \
+              --repo "${RELEASE_REPO}" \
+              --clobber
+          else
+            gh release create "${RELEASE_TAG}" release/* \
+              --repo "${RELEASE_REPO}" \
+              --title "${RELEASE_TAG}" \
+              --notes-file release-notes.md
+          fi

.github/workflows/issue-format.yml

@@ -0,0 +1,152 @@
+name: issue-format
+
+on:
+  issues:
+    types: [opened, edited]
+
+permissions:
+  contents: read
+  issues: write
+  # workflow_dispatch is allowed from GITHUB_TOKEN (unlike issues.reopened)
+  # so format recovery can start triage without a human re-dispatch.
+  actions: write
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    # Skip issues opened by bots (e.g. dependabot) and maintainers fixing format
+    if: >-
+      github.event.issue.user.type != 'Bot' &&
+      !contains(github.event.issue.labels.*.name, 'format-exempt')
+    steps:
+      - name: Checkout format helpers
+        uses: actions/checkout@v7
+        with:
+          sparse-checkout: |
+            scripts/ai-automation.cjs
+          sparse-checkout-cone-mode: false
+
+      - name: Validate title and body
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const auto = require(`${process.env.GITHUB_WORKSPACE}/scripts/ai-automation.cjs`);
+            const issue = context.payload.issue;
+            const errors = auto.getIssueFormatErrors(issue);
+            const labels = new Set(
+              (issue.labels || []).map((label) =>
+                typeof label === 'string' ? label : label.name
+              )
+            );
+            const formatOk = errors.length === 0;
+            const recovery = auto.shouldRecoverIssueFormat({
+              state: issue.state,
+              labels: [...labels],
+              formatOk,
+            });
+
+            if (formatOk) {
+              if (recovery.recover) {
+                // Dispatch FIRST while invalid-format is still present and the
+                // issue may still be closed. workflow_dispatch sets manual=true
+                // so classify is eligible even with the label. Only after a
+                // successful dispatch do we reopen / clear the label — so a
+                // failed dispatch leaves a recoverable state (Codex P2).
+                const ref =
+                  context.payload.repository?.default_branch || 'main';
+                try {
+                  await github.rest.actions.createWorkflowDispatch({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    workflow_id: 'ai-automation.yml',
+                    ref,
+                    inputs: {
+                      issue_number: String(issue.number),
+                    },
+                  });
+                  core.info(
+                    `Dispatched ai-automation for recovered issue #${issue.number}`,
+                  );
+                } catch (err) {
+                  core.setFailed(
+                    `Triage dispatch failed after format recovery; leaving invalid-format in place for retry: ${err.message}`,
+                  );
+                  return;
+                }
+
+                labels.delete('invalid-format');
+                const update = {
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number,
+                  labels: [...labels],
+                };
+                if (recovery.reopen) {
+                  update.state = 'open';
+                }
+                await github.rest.issues.update(update);
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number,
+                  body: recovery.reopen
+                    ? '<!-- issue-format-bot --> Format looks good now. Reopening this issue and starting triage.'
+                    : '<!-- issue-format-bot --> Format looks good now. Starting triage.',
+                });
+              } else {
+                core.info('Issue format OK');
+              }
+              return;
+            }
+
+            const issueNumber = issue.number;
+            const marker = '<!-- issue-format-bot -->';
+            const bodyText = [
+              marker,
+              '## Issue format check failed',
+              '',
+              'This issue was closed automatically because it does not follow the required format.',
+              '',
+              ...errors.map((e) => `- ${e}`),
+              '',
+              '### How to resubmit',
+              '',
+              '1. Go to [New Issue](https://github.com/binaricat/Netcatty/issues/new/choose)',
+              '2. Pick **Bug Report** or **Feature Request**',
+              '3. Fill in every required field',
+              '4. Keep the `[Bug]` or `[Feature]` prefix in the title and add a clear summary after it (older app versions may use `Bug: ...`)',
+              '',
+              'For questions and open-ended discussion, use [GitHub Discussions](https://github.com/binaricat/Netcatty/discussions) instead.',
+              '',
+              'If you believe this was a mistake, reply here after fixing the title/body and a maintainer can reopen.',
+            ].join('\n');
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issueNumber,
+              per_page: 100,
+            });
+            const alreadyNotified = comments.some((c) =>
+              (c.body || '').includes(marker)
+            );
+
+            if (!alreadyNotified) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issueNumber,
+                body: bodyText,
+              });
+            }
+
+            labels.add('invalid-format');
+
+            await github.rest.issues.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issueNumber,
+              state: 'closed',
+              state_reason: 'not_planned',
+              labels: [...labels],
+            });

.github/workflows/spam-comments.yml

@@ -0,0 +1,50 @@
+name: spam-comments
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  delete-spam:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout filter rules
+        uses: actions/checkout@v7
+
+      - name: Delete suspected malware spam
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const path = require('node:path');
+            const { detectSpamComment } = require(
+              path.join(process.env.GITHUB_WORKSPACE, 'scripts/spam-comment-filter.cjs')
+            );
+
+            const comment = context.payload.comment;
+            const result = detectSpamComment({
+              body: comment.body || '',
+              authorAssociation: comment.author_association,
+              userType: comment.user && comment.user.type,
+            });
+
+            core.info(JSON.stringify(result, null, 2));
+
+            if (!result.spam) {
+              core.info('Comment did not match the zip/dangerous-file spam filter.');
+              return;
+            }
+
+            await github.rest.issues.deleteComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: comment.id,
+            });
+
+            core.notice(
+              `Deleted comment with zip/dangerous attachment by @${comment.user.login} on #${context.payload.issue.number}: ${result.reasons.join('; ')}`
+            );

.github/workflows/star-history.yml

@@ -0,0 +1,97 @@
+name: Star History
+
+on:
+  schedule:
+    # Weekly Monday 00:00 UTC
+    - cron: '0 0 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  update:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          # Same PAT used for releases — needs stargazers read (admin/collaborator)
+          # plus contents/PR write so we can open an update PR against protected main.
+          token: ${{ secrets.RELEASE_TOKEN }}
+
+      - name: Generate star history SVGs
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_TOKEN }}
+        run: |
+          set -euo pipefail
+          tmpdir=$(mktemp -d)
+          git clone --depth 1 https://github.com/carsteneu/mystarhistory.git "$tmpdir/mystarhistory"
+          out_dir="docs/assets/star-history"
+          mkdir -p "$out_dir"
+          python3 "$tmpdir/mystarhistory/mystarhistory.py" \
+            --repo "${{ github.repository }}" \
+            --output "$out_dir/star-history-light.svg"
+          python3 "$tmpdir/mystarhistory/mystarhistory.py" \
+            --repo "${{ github.repository }}" \
+            --dark \
+            --output "$out_dir/star-history-dark.svg"
+
+      # main is protected (require PR + enforce_admins), so direct pushes fail with GH006.
+      # Push the chart branch with RELEASE_TOKEN (checkout credentials), then open/merge
+      # the PR with GITHUB_TOKEN — RELEASE_TOKEN is not granted createPullRequest.
+      - name: Commit via pull request
+        env:
+          # Prefer GITHUB_TOKEN for PR API; fall back is not used for git push auth.
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          git add docs/assets/star-history/star-history-light.svg \
+                  docs/assets/star-history/star-history-dark.svg
+          if git diff --cached --quiet; then
+            echo "No chart changes"
+            exit 0
+          fi
+
+          default_branch="${{ github.event.repository.default_branch }}"
+          branch="chore/star-history"
+
+          git checkout -B "$branch"
+          git commit -m "chore: update star history charts [skip ci]"
+          # Auth comes from actions/checkout (RELEASE_TOKEN), not GH_TOKEN above.
+          git push -u origin "HEAD:${branch}" --force
+
+          existing="$(
+            gh pr list \
+              --head "$branch" \
+              --base "$default_branch" \
+              --state open \
+              --json number \
+              --jq '.[0].number // empty'
+          )"
+          if [[ -n "$existing" ]]; then
+            echo "Reusing open PR #${existing}"
+            pr_number="$existing"
+          else
+            pr_url="$(
+              gh pr create \
+                --base "$default_branch" \
+                --head "$branch" \
+                --title "chore: update star history charts" \
+                --body "Automated weekly refresh of the static star history SVG charts embedded in the README. Generated by the Star History workflow via mystarhistory."
+            )"
+            echo "Created ${pr_url}"
+            pr_number="${pr_url##*/}"
+          fi
+
+          # required_approving_review_count is 0; merge immediately when possible.
+          if gh pr merge "$pr_number" --squash --delete-branch; then
+            echo "Merged PR #${pr_number}"
+          else
+            echo "Could not auto-merge PR #${pr_number}; left open for manual merge."
+            exit 1
+          fi

.github/workflows/test.yml

@@ -0,0 +1,72 @@
+name: test
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: test-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: lint-and-test
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install shell test dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y fish xvfb
+
+      - name: Install deps
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Verify generated Catty tool specs
+        run: |
+          npm run generate:capability-tools
+          git diff --exit-code infrastructure/ai/harness/generated/cattyToolSpecs.json
+
+      - name: Verify Codex App Server schema
+        run: npm run check:codex-app-server-schema
+
+      - name: Test
+        run: npm test
+
+      - name: Test terminal background rendering
+        run: xvfb-run -a ./node_modules/.bin/electron --no-sandbox --use-angle=swiftshader --enable-unsafe-swiftshader scripts/terminal-background-rendering.live.test.cjs
+
+      - name: Test terminal keyword highlight performance
+        env:
+          NETCATTY_TERMINAL_PERF_SHOW_WINDOW: "1"
+        # GitHub-hosted runners do not configure Electron's SUID sandbox helper.
+        run: xvfb-run -a ./node_modules/.bin/electron --no-sandbox scripts/xterm-keyword-highlight-performance.live.test.cjs
+
+      - name: Test terminal keyword highlight throughput
+        env:
+          NETCATTY_TERMINAL_PERF_MAIN_REF: ${{ github.event.pull_request.base.sha || 'HEAD^' }}
+          NETCATTY_TERMINAL_PERF_ROUNDS: "3"
+          NETCATTY_TERMINAL_PERF_SHOW_WINDOW: "1"
+        run: xvfb-run -a ./node_modules/.bin/electron --no-sandbox scripts/xterm-keyword-highlight-throughput.live.test.cjs
+
+      - name: Build
+        run: npm run build