release.yml: verify assets actually landed after publish, retry if not

v1.1.1 shipped without its Windows installer (~450MB .exe) even though the
build succeeded and gh release create/upload reported success — gh uploads
assets concurrently and can silently drop one without failing the command.
Now re-checks the published release's asset list against dist/ afterward
and retries anything missing, failing the workflow if a retry also fails.

Also add renderer console/pageerror forwarding and a fake-server request-
count log to the agent-tool-approval e2e tests, which have failed on CI
(never locally) with no signal beyond "Allow never appeared" — this should
narrow down whether the chat request even reaches the fake Ollama server.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: voidstackloop

.github/workflows/release.yml

@@ -143,3 +143,33 @@ jobs:
           || gh release upload "${{ github.ref_name }}" dist/* \
             --repo "${{ github.repository }}" \
             --clobber
+
+      # `gh release create dist/*` uploads every asset concurrently and can
+      # exit 0 even when one of them silently failed to attach (observed on
+      # v1.1.1: the Windows .exe — by far the largest asset at ~450MB — never
+      # made it onto the release while gh reported success, and every asset
+      # smaller than it uploaded fine). The "Validate..." step above only
+      # confirms the files exist locally in dist/ *before* this upload;
+      # this checks what the release *actually* ended up with afterward, and
+      # retries anything gh's own upload silently dropped.
+      - name: Verify every local asset actually landed on the release, retry any that didn't
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          published=$(gh release view "${{ github.ref_name }}" --repo "${{ github.repository }}" --json assets --jq '.assets[].name')
+          missing=0
+          for f in dist/*; do
+            name=$(basename "$f")
+            if ! grep -qxF "$name" <<< "$published"; then
+              echo "::warning::Asset '$name' didn't land on the release after the initial publish — retrying its upload."
+              if ! gh release upload "${{ github.ref_name }}" "$f" --repo "${{ github.repository }}" --clobber; then
+                echo "::error::Retry upload failed for '$name'."
+                missing=1
+              fi
+            fi
+          done
+          if [ "$missing" -ne 0 ]; then
+            echo "::error::One or more release assets could not be uploaded even after a retry — this release is incomplete."
+            exit 1
+          fi

e2e/tests/agent-tool-approval.spec.ts

@@ -33,6 +33,13 @@ test.beforeEach(async () => {
     workspaceDir = fs.mkdtempSync(path.join(os.tmpdir(), "modelforge-e2e-workspace-"));
     instance = await launchApp({ settings: { onboardingComplete: true, ollamaHost: fakeOllama.url } });
     await stubOpenDialog(instance.app, workspaceDir);
+
+    // Both agent-tool-approval tests have failed on CI (never locally) with
+    // no other signal than "Allow never appeared" — surface renderer
+    // console/errors directly in the CI step's own stdout (no artifact
+    // download needed) so a future failure actually says why.
+    instance.window.on("console", (m) => console.log(`[renderer:${m.type()}] ${m.text()}`));
+    instance.window.on("pageerror", (e) => console.log(`[renderer:pageerror] ${e.stack ?? e.message}`));
 });
 
 test.afterEach(async () => {
@@ -55,6 +62,12 @@ async function enableAgentModeAndSendToolCallingMessage(instance_: LaunchedApp):
     const sendButton = window.getByRole("button", { name: "Send message" });
     await expect(sendButton).toBeEnabled({ timeout: 20_000 });
     await sendButton.click();
+
+    // Narrows "the request never reached the fake server" from "it reached
+    // it but the response never rendered" — cheap, and the only thing that
+    // can actually tell those two apart from the CI log alone.
+    await instance_.window.waitForTimeout(500);
+    console.log(`[diagnostic] fakeOllama chat request count after send: ${fakeOllama.getChatRequestCount()}`);
 }
 
 test("Deny stops the tool from running and the card clears", async () => {