Merge origin/main (#1008) into arch-fix/sec-credentials

engine.rs imports: keep this branch's removal of url_host from the
guidance import list and add #1008's NPM_REPLACE_REGISTRY_HOST_CODE.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

.github/actions/upload-artifact/action.yml

@@ -16,6 +16,9 @@ inputs:
   include-hidden-files:
     description: Include hidden files in the artifact
     default: 'false'
+  compression-level:
+    description: ZIP compression level (0 for files that are already compressed)
+    default: '6'
 outputs:
   artifact-id:
     description: ID of the uploaded artifact
@@ -47,6 +50,7 @@ runs:
         if-no-files-found: ${{ inputs.if-no-files-found }}
         retention-days: ${{ inputs.retention-days }}
         include-hidden-files: ${{ inputs.include-hidden-files }}
+        compression-level: ${{ inputs.compression-level }}
         overwrite: true
 
     - name: Wait before retrying
@@ -65,6 +69,7 @@ runs:
         if-no-files-found: ${{ inputs.if-no-files-found }}
         retention-days: ${{ inputs.retention-days }}
         include-hidden-files: ${{ inputs.include-hidden-files }}
+        compression-level: ${{ inputs.compression-level }}
         overwrite: true
 
     - name: Wait before the final attempt
@@ -84,4 +89,5 @@ runs:
         if-no-files-found: ${{ inputs.if-no-files-found }}
         retention-days: ${{ inputs.retention-days }}
         include-hidden-files: ${{ inputs.include-hidden-files }}
+        compression-level: ${{ inputs.compression-level }}
         overwrite: true

.github/workflows/bun-compatibility.yml

@@ -130,11 +130,11 @@ jobs:
 
       - name: Cache cargo
         # save-if keeps writes on main so open PRs do not churn the repo's
-        # 10 GiB cache budget; rust-cache's automatic key already includes
-        # the runner OS, so one logical key serves all three builds.
+        # 10 GiB cache budget. Share dependency artifacts with the other
+        # debug=0 E2E builders on the same runner image.
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: bun-native
+          shared-key: e2e-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Build CLI
@@ -390,7 +390,7 @@ jobs:
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           # Keep binaries linked against different glibc versions separate.
-          key: bun-native-binary-${{ matrix.os }}
+          shared-key: e2e-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Setup Python

.github/workflows/ci.yml

@@ -110,7 +110,7 @@ jobs:
       - run: rustup show
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: composer-compat
+          shared-key: dev-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
@@ -181,7 +181,10 @@ jobs:
         include:
           - {os: macos-latest, composer: '1.10.28', php: '8.1', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a}
           - {os: macos-latest, composer: '2.2.30', php: '8.3', sha256: 8c2b4478b64f8f7cdf1574838fdb0033b29049ca821dad452db7a3dcfcdbffc2}
-          - {os: macos-latest, composer: '2.10.3', php: '8.5', sha256: 7a2d379d5b8ffdaa028580ef26494c36d2feef4b178d3dd1473a4dbc5e17c8d6}
+          # PHP 8.4 on macOS: setup-php 2.37.2 cannot install 8.5 from Homebrew
+          # since PHP 8.6 shipped (every run from 2026-10-07 23:51Z failed in
+          # "Setup PHP"). Ubuntu and Windows keep the 2.10.3 / 8.5 cell.
+          - {os: macos-latest, composer: '2.10.3', php: '8.4', sha256: 7a2d379d5b8ffdaa028580ef26494c36d2feef4b178d3dd1473a4dbc5e17c8d6}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     steps: *native-steps

.github/workflows/composer-compatibility.yml

@@ -55,7 +55,7 @@ jobs:
       - run: rustup show
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: go-compat
+          shared-key: dev-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:

.github/workflows/go-compatibility.yml

@@ -21,8 +21,8 @@ name: Gradle patch compatibility
 #
 # 9.8.0 is the current release on services.gradle.org (re-checked
 # 2026-10-02; bump it here and in ci.yml together when a newer 9.x ships).
-# 7.6.6 is the last 7.x. Every distribution is sha256-checked against
-# services.gradle.org before use.
+# 7.6.6 is the last 7.x. scripts/install-gradle.sh pins every
+# distribution's sha256; add the new version's digest there too.
 #
 # Each mode runs its suites' `#[ignore]` tests by name prefix (the contract
 # scripts/ci-e2e-bundle.py --check enforces): agent = e2e_gradle_discovery_build
@@ -44,6 +44,7 @@ on:
     paths:
       - '.github/workflows/gradle-compatibility.yml'
       - 'scripts/ci-e2e-bundle.py'
+      - 'scripts/install-gradle.sh'
       - 'Cargo.lock'
       - 'Cargo.toml'
       - 'crates/*/Cargo.toml'
@@ -125,7 +126,7 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: gradle-compat
+          shared-key: e2e-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Check the Gradle test-name prefixes
@@ -256,9 +257,13 @@ jobs:
           # TLS handshake with CRYPT_E_REVOCATION_OFFLINE whenever the CA's
           # revocation server is unreachable. A revoked certificate still fails;
           # the body is checked against a digest right after. A no-op elsewhere.
-          url="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          # Tarball from Maven Central's CDN, digest from the Apache archive,
+          # which throttles the tarball itself to minutes (ci.yml's copy).
+          file="apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          url="https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/${MAVEN_VERSION}/${file}"
+          sha_url="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/${file}.sha512"
           curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/maven.tgz"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha512" -o "$RUNNER_TEMP/maven.sha512"
+          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$sha_url" -o "$RUNNER_TEMP/maven.sha512"
           python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha512((p/"maven.tgz").read_bytes()).hexdigest() == (p/"maven.sha512").read_text().split()[0]'
           python -m tarfile -e "$RUNNER_TEMP/maven.tgz" "$RUNNER_TEMP"
           launcher="$RUNNER_TEMP/apache-maven-${MAVEN_VERSION}/bin/mvn"
@@ -273,16 +278,8 @@ jobs:
         shell: bash
         env:
           GRADLE_VERSION: ${{ matrix.gradle }}
-        run: |
-          # Download flags: see the Maven step above.
-          url="https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/gradle.zip"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha256" -o "$RUNNER_TEMP/gradle.sha256"
-          python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha256((p/"gradle.zip").read_bytes()).hexdigest() == (p/"gradle.sha256").read_text().strip()'
-          unzip -q "$RUNNER_TEMP/gradle.zip" -d "$RUNNER_TEMP"
-          launcher="$RUNNER_TEMP/gradle-${GRADLE_VERSION}/bin/gradle"
-          if [ "$RUNNER_OS" = Windows ]; then launcher="${launcher}.bat"; fi
-          echo "SOCKET_PATCH_GRADLE_E2E_GRADLE=$launcher" >> "$GITHUB_ENV"
+        # Pinned digest, GitHub-release origin: see the script.
+        run: scripts/install-gradle.sh "$GRADLE_VERSION" "$RUNNER_TEMP" >> "$GITHUB_ENV"
 
       - name: Run the ${{ matrix.mode }} suites
         shell: bash

.github/workflows/gradle-compatibility.yml

@@ -0,0 +1,44 @@
+name: Merge queue fail-fast
+
+# Cancels a merge-queue entry's CI run the moment one of its jobs fails, so
+# `ci-ok` (if: always()) reports failure in seconds instead of after the
+# slowest e2e leg, and the queue evicts the entry and rebuilds the ones
+# behind it ~40 minutes sooner. See scripts/merge-queue-fail-fast.py.
+# Not a required check; it never fails.
+
+on:
+  merge_group:
+    types: [checks_requested]
+
+permissions: {}
+
+jobs:
+  watch:
+    runs-on: ubuntu-latest
+    timeout-minutes: 110
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        # Run the canceller as it is on the base branch, never the queued
+        # PRs' copy: this job holds an actions:write token, so executing
+        # merge-group-head bytes would hand that token to any queued PR.
+        with:
+          ref: ${{ github.event.merge_group.base_sha }}
+          persist-credentials: false
+          sparse-checkout: scripts/merge-queue-fail-fast.py
+          sparse-checkout-cone-mode: false
+
+      - name: Cancel the CI run on its first failed job
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_SHA: ${{ github.event.merge_group.head_sha }}
+        # Until this workflow lands, the base branch has no canceller to run.
+        run: |
+          if [ ! -f scripts/merge-queue-fail-fast.py ]; then
+            echo "scripts/merge-queue-fail-fast.py is not on the base branch yet; nothing to watch."
+            exit 0
+          fi
+          python3 -B scripts/merge-queue-fail-fast.py

.github/workflows/merge-queue-fail-fast.yml

@@ -0,0 +1,55 @@
+name: Merge queue janitor
+
+# Cancels merge-group runs the queue has orphaned. Each queue entry runs CI on
+# its own `gh-readonly-queue/main/pr-<n>-<base sha>` ref, so ci.yml's
+# concurrency group never lets a newer run cancel an older one. When an entry
+# ahead fails or is removed, the queue deletes the refs of every entry behind
+# it and rebuilds them on new refs, but the runs on the deleted refs keep going
+# (each one is a full ~200-job CI run, macOS legs included). A run whose ref no
+# longer exists can never merge, so it is cancelled here. Every rebuild creates
+# a new merge group, which triggers this sweep.
+#
+# Not a required check, and it never fails the merge group: a sweep error is
+# only a warning.
+
+on:
+  merge_group:
+    types: [checks_requested]
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: merge-queue-janitor
+  cancel-in-progress: false
+
+jobs:
+  cancel-orphaned-runs:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      - name: Cancel merge-group runs whose queue ref is gone
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -uo pipefail
+          for status in queued in_progress; do
+            gh api --paginate "repos/$REPO/actions/runs?event=merge_group&status=$status&per_page=100" \
+              -q '.workflow_runs[] | "\(.id) \(.head_branch)"' || echo "::warning::could not list $status runs"
+          done | sort -u | while read -r id branch; do
+            case "$branch" in gh-readonly-queue/*) ;; *) continue ;; esac
+            # Only a definite 404 means the entry is gone; any other lookup
+            # error (rate limit, 5xx) leaves the run alone.
+            if err=$(gh api "repos/$REPO/git/ref/heads/$branch" --silent 2>&1); then
+              continue
+            fi
+            case "$err" in *"HTTP 404"*) ;; *) echo "::warning::ref lookup for $branch failed: $err"; continue ;; esac
+            echo "Cancelling run $id: $branch is no longer in the queue"
+            gh api -X POST "repos/$REPO/actions/runs/$id/cancel" --silent \
+              || echo "::warning::could not cancel run $id"
+          done
+          exit 0

.github/workflows/merge-queue-janitor.yml

@@ -78,7 +78,7 @@ jobs:
           persist-credentials: false
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: pdm-compat
+          shared-key: dev-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Compile the CLI and the capstone once
         run: |

.github/workflows/pdm-compatibility.yml

@@ -68,7 +68,7 @@ jobs:
       - name: Cache cargo
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          key: pipenv-compat
+          shared-key: dev-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Install uv
         uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0