Merge remote-tracking branch 'origin/main' into claude/error-ux-agent-error

# Conflicts:
#	libs/langgraph/src/lib/agent.fn.spec.ts

Author: blove

.github/workflows/release-provenance.yml

@@ -44,7 +44,7 @@ jobs:
       - name: Upload tarballs to the release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release upload "${{ github.event.release.tag_name }}" -- release-artifacts/*.tgz --clobber
+        run: gh release upload "${{ github.event.release.tag_name }}" --clobber -- release-artifacts/*.tgz
 
   provenance:
     needs: [build-artifacts]

.github/workflows/scorecard.yml

@@ -28,6 +28,10 @@ jobs:
         with:
           results_file: results.sarif
           results_format: sarif
+          # Read-only PAT (Administration: read) so Scorecard can evaluate the
+          # Branch-Protection check, which the default GITHUB_TOKEN cannot read.
+          # Falls back gracefully (check stays inconclusive) if the secret is unset.
+          repo_token: ${{ secrets.SCORECARD_TOKEN }}
           publish_results: true
       - name: Upload artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

libs/chat/src/lib/styles/chat-error.styles.ts

@@ -15,4 +15,24 @@ export const CHAT_ERROR_STYLES = `
   }
   .chat-error__icon { flex-shrink: 0; width: 16px; height: 16px; margin-top: 2px; }
   .chat-error__msg { flex: 1; min-width: 0; word-break: break-word; }
+  .chat-error__retry {
+    flex-shrink: 0;
+    background: transparent;
+    color: var(--ngaf-chat-error-text);
+    border: 1px solid var(--ngaf-chat-error-border);
+    border-radius: var(--ngaf-chat-radius-card);
+    padding: 2px 10px;
+    font-size: var(--ngaf-chat-font-size-sm);
+    cursor: pointer;
+    transition: background 150ms ease, color 150ms ease;
+    white-space: nowrap;
+  }
+  .chat-error__retry:hover {
+    background: var(--ngaf-chat-error-border);
+    color: var(--ngaf-chat-error-text);
+  }
+  .chat-error__retry:focus-visible {
+    outline: 2px solid var(--ngaf-chat-error-border);
+    outline-offset: 2px;
+  }
 `;

libs/langgraph/src/lib/agent.fn.spec.ts

@@ -994,8 +994,9 @@ describe('agent — LANGGRAPH_CLIENT_OPTIONS resolution (no mock transport)', ()
       search: vi.fn().mockResolvedValue([]),
     },
     runs: {
-      // eslint-disable-next-line @typescript-eslint/no-empty-function
-      stream: vi.fn().mockReturnValue((async function* () {})()),
+      stream: vi.fn().mockReturnValue((async function* () {
+        /* empty stream — construction-only tests assert wiring, not events */
+      })()),
     },
   };
 

renovate.json

@@ -6,7 +6,6 @@
     ":dependencyDashboard",
     ":semanticCommits"
   ],
-  "schedule": ["before 9am on monday"],
   "prConcurrentLimit": 5,
   "packageRules": [
     {