From 6d81bc139d47e2a267ed1070d9fe895eb02efedd Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 13:56:55 -0500
Subject: [PATCH 01/66] add threat scanning workflows

---
 .github/workflows/clam-av-scan.yml          | 37 ++++++++++++
 .github/workflows/owasp-scan.yml            | 42 ++++++++++++++
 .github/workflows/windows-defender-scan.yml | 62 +++++++++++++++++++++
 3 files changed, 141 insertions(+)
 create mode 100644 .github/workflows/clam-av-scan.yml
 create mode 100644 .github/workflows/owasp-scan.yml
 create mode 100644 .github/workflows/windows-defender-scan.yml

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
new file mode 100644
index 0000000000..fd0529a05b
--- /dev/null
+++ b/.github/workflows/clam-av-scan.yml
@@ -0,0 +1,37 @@
+name: av-clamav
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+jobs:
+  clamav-scan:
+    name: ClamAV scan (release assets)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Install ClamAV
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clamav
+          sudo freshclam || true
+
+      - name: Download assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          mkdir -p dist-release
+          gh release download "${{ github.event.release.tag_name }}" --dir dist-release --clobber
+
+      - name: Scan with ClamAV
+        run: |
+          clamscan -ri dist-release | tee clamav.log
+          # Fail if infected found
+          ! grep -q "Infected files: [1-9]" clamav.log
+
+      - name: Upload scan results
+        uses: actions/upload-artifact@v4
+        with:
+          name: clamav-scan-results
+          path: clamav.log
diff --git a/.github/workflows/owasp-scan.yml b/.github/workflows/owasp-scan.yml
new file mode 100644
index 0000000000..9fcfe12fdb
--- /dev/null
+++ b/.github/workflows/owasp-scan.yml
@@ -0,0 +1,42 @@
+name: owasp-dependency-check
+on:
+  workflow_dispatch:
+  push:
+    branches: [ main, master ]
+  pull_request:
+  schedule:
+    - cron: "0 3 * * 1" # weekly, 03:00 UTC Mondays
+
+jobs:
+  depcheck:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    steps:
+      - uses: actions/checkout@v4
+
+      # Cache DC data to speed up runs
+      - name: Cache dependency-check data
+        uses: actions/cache@v4
+        with:
+          path: ~/.m2/repository/org/owasp/dependency-check-data/
+          key: depcheck-data-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            depcheck-data-${{ runner.os }}-
+
+      - name: Run OWASP Dependency-Check
+        uses: dependency-check/Dependency-Check_Action@v4.1.3
+        with:
+          project: "OpenCode"
+          path: "."
+          format: "HTML,JSON"
+          out: "dependency-check-report"
+          # optionally: args: "--enableRetired"
+
+      - name: Upload reports
+        uses: actions/upload-artifact@v4
+        with:
+          name: owasp-depcheck-report
+          path: dependency-check-report
diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
new file mode 100644
index 0000000000..150b7946c7
--- /dev/null
+++ b/.github/workflows/windows-defender-scan.yml
@@ -0,0 +1,62 @@
+name: av-windows-defender
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+jobs:
+  defender-scan:
+    name: Windows Defender scan (release assets)
+    runs-on: windows-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Prepare download dir
+        shell: pwsh
+        run: New-Item -ItemType Directory -Force -Path dist-release | Out-Null
+
+      - name: Download assets for this release
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if (-not "${{ github.event.release.tag_name }}") {
+            throw "This workflow requires a release context or manual tag input."
+          }
+          gh release download "${{ github.event.release.tag_name }}" --dir dist-release --clobber
+
+      - name: List assets
+        shell: pwsh
+        run: Get-ChildItem -File dist-release | Select-Object FullName, Length | Format-Table | Out-String | Tee-Object -FilePath dist-release\\asset-list.txt
+
+      - name: Scan each asset with Defender
+        shell: pwsh
+        run: |
+          $mp = "$env:ProgramFiles\\Windows Defender\\MpCmdRun.exe"
+          $detections = @()
+          Get-ChildItem -File dist-release | ForEach-Object {
+            Write-Host "Scanning $($_.FullName)"
+            & $mp -Scan -ScanType 3 -File $_.FullName
+            Start-Sleep -Seconds 3
+          }
+          # Collect *recent* detections (last 30 minutes) and only for our folder
+          $since = (Get-Date).AddMinutes(-30)
+          $recent = Get-MpThreatDetection | Where-Object {
+            $_.InitialDetectionTime -ge $since -and
+            $_.Resources -and ($_.Resources.Resource -match [Regex]::Escape((Resolve-Path "dist-release").Path))
+          }
+          if ($recent) {
+            $recent | ConvertTo-Json -Depth 5 | Out-File dist-release\\defender-detections.json -Encoding UTF8
+            Write-Error "Windows Defender found detections. See artifact."
+          } else {
+            '{"status":"clean"}' | Out-File dist-release\\defender-detections.json -Encoding UTF8
+          }
+
+      - name: Upload scan results
+        uses: actions/upload-artifact@v4
+        with:
+          name: defender-scan-results
+          path: |
+            dist-release/asset-list.txt
+            dist-release/defender-detections.json

From a2d6d1b9d54a17b17312436e44cc2ccc14a216a1 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 14:04:55 -0500
Subject: [PATCH 02/66] adjusted event triggers

---
 .github/workflows/clam-av-scan.yml          | 6 ++++++
 .github/workflows/deploy.yml                | 8 ++++----
 .github/workflows/owasp-scan.yml            | 9 ++++++---
 .github/workflows/windows-defender-scan.yml | 7 +++++++
 4 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index fd0529a05b..d84c6143e9 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -3,6 +3,12 @@ on:
   workflow_dispatch:
   release:
     types: [published]
+  pull_request:
+    branches: [dev]
+  schedule:
+    - cron: "0 3 * * 1" # weekly, 03:00 UTC Mondays
+permissions:
+  contents: read
 
 jobs:
   clamav-scan:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b92c3d7293..9b0d181c27 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,11 +1,11 @@
 name: deploy
 
 on:
-  push:
-    branches:
-      - dev
-      - production
   workflow_dispatch:
+  release:
+    types: [published]
+  pull_request:
+    branches: [dev]
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
diff --git a/.github/workflows/owasp-scan.yml b/.github/workflows/owasp-scan.yml
index 9fcfe12fdb..0377566664 100644
--- a/.github/workflows/owasp-scan.yml
+++ b/.github/workflows/owasp-scan.yml
@@ -1,12 +1,15 @@
 name: owasp-dependency-check
 on:
   workflow_dispatch:
-  push:
-    branches: [ main, master ]
+  release:
+    types: [published]
   pull_request:
+    branches: [dev]
   schedule:
-    - cron: "0 3 * * 1" # weekly, 03:00 UTC Mondays
+    - cron: "0 5 * * 1" # weekly, 05:00 UTC Mondays
 
+permissions:
+  contents: read
 jobs:
   depcheck:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 150b7946c7..082916157d 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -3,6 +3,13 @@ on:
   workflow_dispatch:
   release:
     types: [published]
+  pull_request:
+    branches: [dev]
+  schedule:
+    - cron: "0 4 * * 1" # weekly, 04:00 UTC Mondays
+
+permissions:
+  contents: read
 
 jobs:
   defender-scan:

From 5fc9d80530d78ba6b1b57af78e3faf8740b1a2be Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 14:17:23 -0500
Subject: [PATCH 03/66] reverting accidental edit

---
 .github/workflows/deploy.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 9b0d181c27..b92c3d7293 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,11 +1,11 @@
 name: deploy
 
 on:
+  push:
+    branches:
+      - dev
+      - production
   workflow_dispatch:
-  release:
-    types: [published]
-  pull_request:
-    branches: [dev]
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 

From 1761693a951d64e81b8e8a8069f03d6adb07bd1c Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 14:24:06 -0500
Subject: [PATCH 04/66] ci: guard AV workflows on PRs + robust tag resolution

- add job-level if: to run only on release/workflow_dispatch
- add Resolve release tag step (supports manual input + last release fallback)
- harden MpCmdRun.exe resolution on windows-latest

This prevents PR runs from failing when github.event.release.tag_name is undefined and makes manual runs usable.
---
 .github/workflows/clam-av-scan.yml          | 18 ++++++++++-
 .github/workflows/windows-defender-scan.yml | 35 +++++++++++++++------
 2 files changed, 42 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index d84c6143e9..4e4cde66d3 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -1,6 +1,10 @@
 name: av-clamav
 on:
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to scan (e.g., v0.15.16)'
+        required: false
   release:
     types: [published]
   pull_request:
@@ -12,6 +16,7 @@ permissions:
 
 jobs:
   clamav-scan:
+    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
     name: ClamAV scan (release assets)
     runs-on: ubuntu-latest
     permissions:
@@ -23,12 +28,23 @@ jobs:
           sudo apt-get install -y clamav
           sudo freshclam || true
 
+      - name: Resolve release tag
+        id: resolve_tag
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          tag="${{ github.event.release.tag_name }}"
+          if [ -z "$tag" ]; then tag="${{ github.event.inputs.tag }}"; fi
+          if [ -z "$tag" ]; then tag="$(gh release list --limit 1 --json tagName -q '.[0].tagName')"; fi
+          if [ -z "$tag" ]; then echo "No release tag found" >&2; exit 1; fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+
       - name: Download assets
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           mkdir -p dist-release
-          gh release download "${{ github.event.release.tag_name }}" --dir dist-release --clobber
+          gh release download "${{ steps.resolve_tag.outputs.tag }}" --dir dist-release --clobber
 
       - name: Scan with ClamAV
         run: |
diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 082916157d..bbc8ec8e01 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -1,6 +1,10 @@
 name: av-windows-defender
 on:
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to scan (e.g., v0.15.16)'
+        required: false
   release:
     types: [published]
   pull_request:
@@ -13,6 +17,7 @@ permissions:
 
 jobs:
   defender-scan:
+    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
     name: Windows Defender scan (release assets)
     runs-on: windows-latest
     permissions:
@@ -23,41 +28,51 @@ jobs:
         shell: pwsh
         run: New-Item -ItemType Directory -Force -Path dist-release | Out-Null
 
+      - name: Resolve release tag
+        id: resolve_tag
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          $tag = "${{ github.event.release.tag_name }}"
+          if (-not $tag) { $tag = "${{ github.event.inputs.tag }}" }
+          if (-not $tag) { $tag = (gh release list --limit 1 --json tagName -q ".[0].tagName") }
+          if (-not $tag) { throw 'No release tag found' }
+          "tag=$tag" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+
       - name: Download assets for this release
         shell: pwsh
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          if (-not "${{ github.event.release.tag_name }}") {
-            throw "This workflow requires a release context or manual tag input."
-          }
-          gh release download "${{ github.event.release.tag_name }}" --dir dist-release --clobber
+          gh release download "${{ steps.resolve_tag.outputs.tag }}" --dir dist-release --clobber
 
       - name: List assets
         shell: pwsh
-        run: Get-ChildItem -File dist-release | Select-Object FullName, Length | Format-Table | Out-String | Tee-Object -FilePath dist-release\\asset-list.txt
+        run: Get-ChildItem -File dist-release | Select-Object FullName, Length | Format-Table | Out-String | Tee-Object -FilePath dist-release\asset-list.txt
 
       - name: Scan each asset with Defender
         shell: pwsh
         run: |
-          $mp = "$env:ProgramFiles\\Windows Defender\\MpCmdRun.exe"
-          $detections = @()
+          $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue).Source
+          if (-not $mp) { $mp = "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" }
+          if (-not (Test-Path $mp)) { throw 'MpCmdRun.exe not found' }
           Get-ChildItem -File dist-release | ForEach-Object {
             Write-Host "Scanning $($_.FullName)"
             & $mp -Scan -ScanType 3 -File $_.FullName
             Start-Sleep -Seconds 3
           }
-          # Collect *recent* detections (last 30 minutes) and only for our folder
+          # Collect recent detections (last 30 minutes) and only for our folder
           $since = (Get-Date).AddMinutes(-30)
           $recent = Get-MpThreatDetection | Where-Object {
             $_.InitialDetectionTime -ge $since -and
             $_.Resources -and ($_.Resources.Resource -match [Regex]::Escape((Resolve-Path "dist-release").Path))
           }
           if ($recent) {
-            $recent | ConvertTo-Json -Depth 5 | Out-File dist-release\\defender-detections.json -Encoding UTF8
+            $recent | ConvertTo-Json -Depth 5 | Out-File dist-release\defender-detections.json -Encoding UTF8
             Write-Error "Windows Defender found detections. See artifact."
           } else {
-            '{"status":"clean"}' | Out-File dist-release\\defender-detections.json -Encoding UTF8
+            '{"status":"clean"}' | Out-File dist-release\defender-detections.json -Encoding UTF8
           }
 
       - name: Upload scan results

From 7ee7e7571023643dbf7adf61a57fb67b9036ca3a Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 14:36:03 -0500
Subject: [PATCH 05/66] ci: enable PR/push AV scans (no releases required)

- Add PR/push jobs for ClamAV (Linux) and Windows Defender (Windows)
- Keep release/workflow_dispatch jobs for scanning published assets
- No secret usage in PR/push jobs; uses repo/build outputs or repo archive
- Upload PR scan payload/logs as artifacts
---
 .github/workflows/clam-av-scan.yml          | 44 +++++++++++++++------
 .github/workflows/windows-defender-scan.yml | 37 ++++++++++++-----
 2 files changed, 59 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index 4e4cde66d3..532ba95c6c 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -1,23 +1,46 @@
 name: av-clamav
 on:
   workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release tag to scan (e.g., v0.15.16)'
-        required: false
   release:
     types: [published]
   pull_request:
-    branches: [dev]
+  push:
   schedule:
-    - cron: "0 3 * * 1" # weekly, 03:00 UTC Mondays
+    - cron: "0 3 * * 1"
 permissions:
   contents: read
 
 jobs:
+  clamav-pr:
+    if: github.event_name == 'pull_request' || github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install ClamAV
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clamav
+          sudo freshclam || true
+      - name: Prepare PR scan payload
+        run: |
+          mkdir -p dist-pr
+          if [ -d dist ]; then tar -czf dist-pr/scan.tgz -C dist .; \
+          elif [ -d build ]; then tar -czf dist-pr/scan.tgz -C build .; \
+          else tar -czf dist-pr/scan.tgz --exclude=.git --exclude=.github .; fi
+      - name: ClamAV scan (PR)
+        run: |
+          clamscan -ri --scan-archive=yes dist-pr | tee clamav-pr.log
+          ! grep -q "Infected files: [1-9]" clamav-pr.log
+      - name: Upload PR scan results
+        uses: actions/upload-artifact@v4
+        with:
+          name: clamav-pr-scan-results
+          path: |
+            clamav-pr.log
+            dist-pr/scan.tgz
+
   clamav-scan:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-    name: ClamAV scan (release assets)
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -27,7 +50,6 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y clamav
           sudo freshclam || true
-
       - name: Resolve release tag
         id: resolve_tag
         env:
@@ -38,20 +60,16 @@ jobs:
           if [ -z "$tag" ]; then tag="$(gh release list --limit 1 --json tagName -q '.[0].tagName')"; fi
           if [ -z "$tag" ]; then echo "No release tag found" >&2; exit 1; fi
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
-
       - name: Download assets
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           mkdir -p dist-release
           gh release download "${{ steps.resolve_tag.outputs.tag }}" --dir dist-release --clobber
-
-      - name: Scan with ClamAV
+      - name: Scan with ClamAV (release assets)
         run: |
           clamscan -ri dist-release | tee clamav.log
-          # Fail if infected found
           ! grep -q "Infected files: [1-9]" clamav.log
-
       - name: Upload scan results
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index bbc8ec8e01..d2d50c32ee 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -8,14 +8,39 @@ on:
   release:
     types: [published]
   pull_request:
-    branches: [dev]
+  push:
   schedule:
-    - cron: "0 4 * * 1" # weekly, 04:00 UTC Mondays
+    - cron: "0 4 * * 1"
 
 permissions:
   contents: read
 
 jobs:
+  defender-pr:
+    if: github.event_name == 'pull_request' || github.event_name == 'push'
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare PR scan payload
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path dist-pr | Out-Null
+          if (Test-Path dist) { Compress-Archive -Path dist\* -DestinationPath dist-pr\scan.zip -Force }
+          elseif (Test-Path build) { Compress-Archive -Path build\* -DestinationPath dist-pr\scan.zip -Force }
+          else { Compress-Archive -Path * -DestinationPath dist-pr\scan.zip -Force }
+      - name: Windows Defender scan (PR)
+        shell: pwsh
+        run: |
+          $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue).Source
+          if (-not $mp) { $mp = "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" }
+          if (-not (Test-Path $mp)) { throw 'MpCmdRun.exe not found' }
+          & $mp -Scan -ScanType 3 -File (Resolve-Path 'dist-pr\scan.zip')
+      - name: Upload PR scan results
+        uses: actions/upload-artifact@v4
+        with:
+          name: defender-pr-scan-input
+          path: dist-pr/scan.zip
+
   defender-scan:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
     name: Windows Defender scan (release assets)
@@ -27,7 +52,6 @@ jobs:
       - name: Prepare download dir
         shell: pwsh
         run: New-Item -ItemType Directory -Force -Path dist-release | Out-Null
-
       - name: Resolve release tag
         id: resolve_tag
         shell: pwsh
@@ -39,18 +63,15 @@ jobs:
           if (-not $tag) { $tag = (gh release list --limit 1 --json tagName -q ".[0].tagName") }
           if (-not $tag) { throw 'No release tag found' }
           "tag=$tag" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
-
       - name: Download assets for this release
         shell: pwsh
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh release download "${{ steps.resolve_tag.outputs.tag }}" --dir dist-release --clobber
-
       - name: List assets
         shell: pwsh
         run: Get-ChildItem -File dist-release | Select-Object FullName, Length | Format-Table | Out-String | Tee-Object -FilePath dist-release\asset-list.txt
-
       - name: Scan each asset with Defender
         shell: pwsh
         run: |
@@ -62,7 +83,6 @@ jobs:
             & $mp -Scan -ScanType 3 -File $_.FullName
             Start-Sleep -Seconds 3
           }
-          # Collect recent detections (last 30 minutes) and only for our folder
           $since = (Get-Date).AddMinutes(-30)
           $recent = Get-MpThreatDetection | Where-Object {
             $_.InitialDetectionTime -ge $since -and
@@ -72,9 +92,8 @@ jobs:
             $recent | ConvertTo-Json -Depth 5 | Out-File dist-release\defender-detections.json -Encoding UTF8
             Write-Error "Windows Defender found detections. See artifact."
           } else {
-            '{"status":"clean"}' | Out-File dist-release\defender-detections.json -Encoding UTF8
+            '{\"status\":\"clean\"}' | Out-File dist-release\defender-detections.json -Encoding UTF8
           }
-
       - name: Upload scan results
         uses: actions/upload-artifact@v4
         with:

From 43d5102cf18f728f86dbe5446e424057f4e5a305 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 14:52:14 -0500
Subject: [PATCH 06/66] ci: add heuristic build steps to PR ClamAV job
 (Node/Rust/Go)

- Detect common stacks and attempt install+build for each
- Package best available outputs (dist/build/target/release) for scanning
- Keep release/manual job unchanged
---
 .github/workflows/clam-av-scan.yml | 97 +++++++++++++++++++++++++++---
 1 file changed, 87 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index 532ba95c6c..1155071c72 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -1,6 +1,10 @@
 name: av-clamav
 on:
   workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag to scan (e.g., v0.15.16)'
+        required: false
   release:
     types: [published]
   pull_request:
@@ -16,31 +20,100 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+
+      - name: Detect repo meta
+        id: meta
+        run: |
+          echo "has_package_json=$([ -f package.json ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+          echo "has_pnpm_lock=$([ -f pnpm-lock.yaml ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+          echo "has_yarn_lock=$([ -f yarn.lock ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+          echo "has_package_lock=$([ -f package-lock.json ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+          echo "has_cargo=$([ -n \"$(git ls-files | grep -E '(^|/)Cargo.toml$')\" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+          echo "has_go=$([ -f go.mod ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Node
+        if: steps.meta.outputs.has_package_json == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Setup pnpm
+        if: steps.meta.outputs.has_pnpm_lock == 'true'
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Install deps (Node)
+        if: steps.meta.outputs.has_package_json == 'true'
+        run: |
+          if [ "${{ steps.meta.outputs.has_pnpm_lock }}" = "true" ]; then pnpm install --frozen-lockfile || pnpm install; exit 0; fi
+          if [ "${{ steps.meta.outputs.has_package_lock }}" = "true" ]; then npm ci || npm i; exit 0; fi
+          if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then yarn install --frozen-lockfile || yarn install; exit 0; fi
+          echo "No Node lockfile found; skipping install"
+
+      - name: Build (Node)
+        if: steps.meta.outputs.has_package_json == 'true'
+        run: |
+          set -e
+          pnpm run -c build || pnpm -r build || pnpm -w build || \n          npm run build || yarn build || echo 'No Node build script succeeded; continuing'
+
+      - name: Setup Rust
+        if: steps.meta.outputs.has_cargo == 'true'
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Build (Rust)
+        if: steps.meta.outputs.has_cargo == 'true'
+        run: cargo build --release
+
+      - name: Setup Go
+        if: steps.meta.outputs.has_go == 'true'
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22.x'
+
+      - name: Build (Go)
+        if: steps.meta.outputs.has_go == 'true'
+        run: |
+          set -e
+          mkdir -p dist
+          if ls cmd >/dev/null 2>&1; then
+            for d in cmd/*; do name=$(basename "$d"); go build -o "dist/$name" "./$d"; done
+          else
+            go build -o dist/opencode ./...
+          fi
+
+      - name: Package build outputs
+        run: |
+          set -e
+          mkdir -p dist-pr
+          if [ -d dist ]; then zip -qr dist-pr/scan.zip dist
+          elif [ -d build ]; then zip -qr dist-pr/scan.zip build
+          elif [ -d target/release ]; then zip -qr dist-pr/scan.zip target/release
+          else zip -qr dist-pr/scan.zip . -x '.git/*' '.github/*'
+          fi
+
       - name: Install ClamAV
         run: |
           sudo apt-get update
           sudo apt-get install -y clamav
           sudo freshclam || true
-      - name: Prepare PR scan payload
-        run: |
-          mkdir -p dist-pr
-          if [ -d dist ]; then tar -czf dist-pr/scan.tgz -C dist .; \
-          elif [ -d build ]; then tar -czf dist-pr/scan.tgz -C build .; \
-          else tar -czf dist-pr/scan.tgz --exclude=.git --exclude=.github .; fi
+
       - name: ClamAV scan (PR)
         run: |
           clamscan -ri --scan-archive=yes dist-pr | tee clamav-pr.log
-          ! grep -q "Infected files: [1-9]" clamav-pr.log
+          ! grep -q 'Infected files: [1-9]' clamav-pr.log
+
       - name: Upload PR scan results
         uses: actions/upload-artifact@v4
         with:
           name: clamav-pr-scan-results
           path: |
             clamav-pr.log
-            dist-pr/scan.tgz
+            dist-pr/scan.zip
 
   clamav-scan:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
+    name: ClamAV scan (release assets)
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -50,6 +123,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y clamav
           sudo freshclam || true
+
       - name: Resolve release tag
         id: resolve_tag
         env:
@@ -58,18 +132,21 @@ jobs:
           tag="${{ github.event.release.tag_name }}"
           if [ -z "$tag" ]; then tag="${{ github.event.inputs.tag }}"; fi
           if [ -z "$tag" ]; then tag="$(gh release list --limit 1 --json tagName -q '.[0].tagName')"; fi
-          if [ -z "$tag" ]; then echo "No release tag found" >&2; exit 1; fi
+          if [ -z "$tag" ]; then echo 'No release tag found' >&2; exit 1; fi
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
+
       - name: Download assets
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           mkdir -p dist-release
           gh release download "${{ steps.resolve_tag.outputs.tag }}" --dir dist-release --clobber
+
       - name: Scan with ClamAV (release assets)
         run: |
           clamscan -ri dist-release | tee clamav.log
-          ! grep -q "Infected files: [1-9]" clamav.log
+          ! grep -q 'Infected files: [1-9]' clamav.log
+
       - name: Upload scan results
         uses: actions/upload-artifact@v4
         with:

From 911b4d6348bbdf408dd102b9dc02ed0ebd9a7dfb Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 15:11:23 -0500
Subject: [PATCH 07/66] ci: harden heuristic PR build (corepack, non-fatal
 builds, tarball)

- Enable corepack; prep yarn if yarn.lock present
- Make Node/Rust/Go builds best-effort (won't fail the job)
- Use tar.gz instead of zip to avoid zip dependency
- Keep scanning entire dist-pr directory with --scan-archive=yes
---
 .github/workflows/clam-av-scan.yml | 34 +++++++++++++++++-------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index 1155071c72..562dacc108 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -37,6 +37,13 @@ jobs:
         with:
           node-version: '20'
 
+      - name: Enable Corepack (Node)
+        if: steps.meta.outputs.has_package_json == 'true'
+        run: |
+          npm i -g corepack || true
+          corepack enable || true
+          if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then corepack prepare yarn@stable --activate || true; fi
+
       - name: Setup pnpm
         if: steps.meta.outputs.has_pnpm_lock == 'true'
         uses: pnpm/action-setup@v4
@@ -46,16 +53,14 @@ jobs:
       - name: Install deps (Node)
         if: steps.meta.outputs.has_package_json == 'true'
         run: |
-          if [ "${{ steps.meta.outputs.has_pnpm_lock }}" = "true" ]; then pnpm install --frozen-lockfile || pnpm install; exit 0; fi
-          if [ "${{ steps.meta.outputs.has_package_lock }}" = "true" ]; then npm ci || npm i; exit 0; fi
-          if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then yarn install --frozen-lockfile || yarn install; exit 0; fi
-          echo "No Node lockfile found; skipping install"
+          if [ "${{ steps.meta.outputs.has_pnpm_lock }}" = "true" ]; then pnpm install --frozen-lockfile || pnpm install || true; fi
+          if [ "${{ steps.meta.outputs.has_package_lock }}" = "true" ]; then npm ci || npm i || true; fi
+          if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then (yarn --version || true) && (yarn install --frozen-lockfile || yarn install || true); fi
 
       - name: Build (Node)
         if: steps.meta.outputs.has_package_json == 'true'
         run: |
-          set -e
-          pnpm run -c build || pnpm -r build || pnpm -w build || \n          npm run build || yarn build || echo 'No Node build script succeeded; continuing'
+          pnpm run -c build || pnpm -r build || pnpm -w build || npm run build || yarn build || true
 
       - name: Setup Rust
         if: steps.meta.outputs.has_cargo == 'true'
@@ -63,7 +68,7 @@ jobs:
 
       - name: Build (Rust)
         if: steps.meta.outputs.has_cargo == 'true'
-        run: cargo build --release
+        run: cargo build --release || true
 
       - name: Setup Go
         if: steps.meta.outputs.has_go == 'true'
@@ -74,22 +79,21 @@ jobs:
       - name: Build (Go)
         if: steps.meta.outputs.has_go == 'true'
         run: |
-          set -e
           mkdir -p dist
           if ls cmd >/dev/null 2>&1; then
-            for d in cmd/*; do name=$(basename "$d"); go build -o "dist/$name" "./$d"; done
+            for d in cmd/*; do name=$(basename "$d"); go build -o "dist/$name" "./$d" || true; done
           else
-            go build -o dist/opencode ./...
+            go build -o dist/opencode ./... || true
           fi
 
       - name: Package build outputs
         run: |
           set -e
           mkdir -p dist-pr
-          if [ -d dist ]; then zip -qr dist-pr/scan.zip dist
-          elif [ -d build ]; then zip -qr dist-pr/scan.zip build
-          elif [ -d target/release ]; then zip -qr dist-pr/scan.zip target/release
-          else zip -qr dist-pr/scan.zip . -x '.git/*' '.github/*'
+          if [ -d dist ]; then tar -czf dist-pr/scan.tgz -C dist .
+          elif [ -d build ]; then tar -czf dist-pr/scan.tgz -C build .
+          elif [ -d target/release ]; then tar -czf dist-pr/scan.tgz -C target/release .
+          else tar -czf dist-pr/scan.tgz --exclude=.git --exclude=.github .
           fi
 
       - name: Install ClamAV
@@ -109,7 +113,7 @@ jobs:
           name: clamav-pr-scan-results
           path: |
             clamav-pr.log
-            dist-pr/scan.zip
+            dist-pr/scan.tgz
 
   clamav-scan:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'

From 72dbdb9f270aa680494ec360615622a3adaea03e Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 15:13:20 -0500
Subject: [PATCH 08/66] ci: add Bun (bun.lockb) support to PR build (Ubuntu)

- Detect bun.lockb and use oven-sh/setup-bun@v1
- Run `bun install` + `bun run build` before packaging
- Keep Node/Rust/Go heuristics as fallback
---
 .github/workflows/clam-av-scan.yml | 31 +++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index 562dacc108..efd38b8755 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -24,6 +24,7 @@ jobs:
       - name: Detect repo meta
         id: meta
         run: |
+          echo "has_bun_lock=$([ -f bun.lockb ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
           echo "has_package_json=$([ -f package.json ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
           echo "has_pnpm_lock=$([ -f pnpm-lock.yaml ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
           echo "has_yarn_lock=$([ -f yarn.lock ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
@@ -31,37 +32,56 @@ jobs:
           echo "has_cargo=$([ -n \"$(git ls-files | grep -E '(^|/)Cargo.toml$')\" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
           echo "has_go=$([ -f go.mod ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
 
+      # --- JavaScript path (Bun/Node) ---
+      - name: Setup Bun
+        if: steps.meta.outputs.has_bun_lock == 'true'
+        uses: oven-sh/setup-bun@v1
+        with:
+          bun-version: '1.x'
+
       - name: Setup Node
-        if: steps.meta.outputs.has_package_json == 'true'
+        if: steps.meta.outputs.has_package_json == 'true' && steps.meta.outputs.has_bun_lock != 'true'
         uses: actions/setup-node@v4
         with:
           node-version: '20'
 
       - name: Enable Corepack (Node)
-        if: steps.meta.outputs.has_package_json == 'true'
+        if: steps.meta.outputs.has_package_json == 'true' && steps.meta.outputs.has_bun_lock != 'true'
         run: |
           npm i -g corepack || true
           corepack enable || true
           if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then corepack prepare yarn@stable --activate || true; fi
 
       - name: Setup pnpm
-        if: steps.meta.outputs.has_pnpm_lock == 'true'
+        if: steps.meta.outputs.has_pnpm_lock == 'true' && steps.meta.outputs.has_bun_lock != 'true'
         uses: pnpm/action-setup@v4
         with:
           version: 9
 
+      - name: Install deps (Bun)
+        if: steps.meta.outputs.has_bun_lock == 'true'
+        run: |
+          bun --version
+          bun install --frozen-lockfile || bun install || true
+
+      - name: Build (Bun)
+        if: steps.meta.outputs.has_bun_lock == 'true'
+        run: |
+          bun run build || true
+
       - name: Install deps (Node)
-        if: steps.meta.outputs.has_package_json == 'true'
+        if: steps.meta.outputs.has_package_json == 'true' && steps.meta.outputs.has_bun_lock != 'true'
         run: |
           if [ "${{ steps.meta.outputs.has_pnpm_lock }}" = "true" ]; then pnpm install --frozen-lockfile || pnpm install || true; fi
           if [ "${{ steps.meta.outputs.has_package_lock }}" = "true" ]; then npm ci || npm i || true; fi
           if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then (yarn --version || true) && (yarn install --frozen-lockfile || yarn install || true); fi
 
       - name: Build (Node)
-        if: steps.meta.outputs.has_package_json == 'true'
+        if: steps.meta.outputs.has_package_json == 'true' && steps.meta.outputs.has_bun_lock != 'true'
         run: |
           pnpm run -c build || pnpm -r build || pnpm -w build || npm run build || yarn build || true
 
+      # --- Rust path ---
       - name: Setup Rust
         if: steps.meta.outputs.has_cargo == 'true'
         uses: dtolnay/rust-toolchain@stable
@@ -70,6 +90,7 @@ jobs:
         if: steps.meta.outputs.has_cargo == 'true'
         run: cargo build --release || true
 
+      # --- Go path ---
       - name: Setup Go
         if: steps.meta.outputs.has_go == 'true'
         uses: actions/setup-go@v5

From 403709ae0a1d045cec2a03bbcd3ea5ecc4933509 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 15:31:12 -0500
Subject: [PATCH 09/66] =?UTF-8?q?ci:=20remove=20third=E2=80=91party=20setu?=
 =?UTF-8?q?p=20actions=20in=20PR=20scan;=20install=20Bun/Rust=20via=20shel?=
 =?UTF-8?q?l?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Replace oven-sh/setup-bun with curl installer and PATH export
- Drop pnpm/action-setup; use corepack to activate pnpm/yarn
- Replace dtolnay/rust-toolchain with rustup bootstrap
- Add defaults.run.shell: bash; small permissions tweaks
- Keep Go using first‑party actions/setup-go@v5
- Include schedule in release job guard to avoid skipped runs
---
 .github/workflows/clam-av-scan.yml | 49 +++++++++++++++---------------
 1 file changed, 25 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index efd38b8755..92190fa75a 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -13,6 +13,11 @@ on:
     - cron: "0 3 * * 1"
 permissions:
   contents: read
+  actions: read
+
+defaults:
+  run:
+    shell: bash
 
 jobs:
   clamav-pr:
@@ -33,35 +38,28 @@ jobs:
           echo "has_go=$([ -f go.mod ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
 
       # --- JavaScript path (Bun/Node) ---
-      - name: Setup Bun
+      - name: Setup Bun (no external action)
         if: steps.meta.outputs.has_bun_lock == 'true'
-        uses: oven-sh/setup-bun@v1
-        with:
-          bun-version: '1.x'
-
-      - name: Setup Node
-        if: steps.meta.outputs.has_package_json == 'true' && steps.meta.outputs.has_bun_lock != 'true'
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
+        run: |
+          curl -fsSL https://bun.sh/install | bash
+          echo "$HOME/.bun/bin" >> $GITHUB_PATH
+          bun --version
 
-      - name: Enable Corepack (Node)
+      - name: Setup Node via corepack (fallback when not Bun)
         if: steps.meta.outputs.has_package_json == 'true' && steps.meta.outputs.has_bun_lock != 'true'
         run: |
+          sudo apt-get update -y
+          sudo apt-get install -y nodejs npm || true
           npm i -g corepack || true
           corepack enable || true
           if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then corepack prepare yarn@stable --activate || true; fi
-
-      - name: Setup pnpm
-        if: steps.meta.outputs.has_pnpm_lock == 'true' && steps.meta.outputs.has_bun_lock != 'true'
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
+          if [ "${{ steps.meta.outputs.has_pnpm_lock }}" = "true" ]; then corepack prepare pnpm@9 --activate || true; fi
+          node -v || true
+          corepack -v || true
 
       - name: Install deps (Bun)
         if: steps.meta.outputs.has_bun_lock == 'true'
         run: |
-          bun --version
           bun install --frozen-lockfile || bun install || true
 
       - name: Build (Bun)
@@ -79,18 +77,21 @@ jobs:
       - name: Build (Node)
         if: steps.meta.outputs.has_package_json == 'true' && steps.meta.outputs.has_bun_lock != 'true'
         run: |
-          pnpm run -c build || pnpm -r build || pnpm -w build || npm run build || yarn build || true
+          pnpm run -c build || pnpm -r build || pnpm -w build || \n          npm run build || yarn build || true
 
-      # --- Rust path ---
-      - name: Setup Rust
+      # --- Rust path (no external action) ---
+      - name: Setup Rust (rustup)
         if: steps.meta.outputs.has_cargo == 'true'
-        uses: dtolnay/rust-toolchain@stable
+        run: |
+          curl https://sh.rustup.rs -sSf | sh -s -- -y
+          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+          rustc --version || true
 
       - name: Build (Rust)
         if: steps.meta.outputs.has_cargo == 'true'
         run: cargo build --release || true
 
-      # --- Go path ---
+      # --- Go path (first-party action ok) ---
       - name: Setup Go
         if: steps.meta.outputs.has_go == 'true'
         uses: actions/setup-go@v5
@@ -137,7 +138,7 @@ jobs:
             dist-pr/scan.tgz
 
   clamav-scan:
-    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
     name: ClamAV scan (release assets)
     runs-on: ubuntu-latest
     permissions:

From f68767daf213d061fe6d014a365745c9875ee226 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 16:10:35 -0500
Subject: [PATCH 10/66] ci: add minimal smoke workflow (ubuntu/windows/macos)
 to diagnose startup failures

---
 .github/workflows/ci-smoke.yml | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)
 create mode 100644 .github/workflows/ci-smoke.yml

diff --git a/.github/workflows/ci-smoke.yml b/.github/workflows/ci-smoke.yml
new file mode 100644
index 0000000000..d45eac1ef3
--- /dev/null
+++ b/.github/workflows/ci-smoke.yml
@@ -0,0 +1,32 @@
+name: ci-smoke
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  smoke-linux:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Print context
+        run: |
+          echo "event=$GITHUB_EVENT_NAME"
+          echo "actor=$GITHUB_ACTOR"
+          echo "ref=$GITHUB_REF"
+          echo "sha=$GITHUB_SHA"
+      - name: Hello
+        run: echo hello from ubuntu
+
+  smoke-windows:
+    runs-on: windows-latest
+    steps:
+      - name: Hello
+        run: echo hello from windows
+
+  smoke-macos:
+    runs-on: macos-latest
+    steps:
+      - name: Hello
+        run: echo hello from macos

From 882bf3b122abe0b6fc9f851bf1f19e262f0c6aeb Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 16:14:47 -0500
Subject: [PATCH 11/66] removeed push action

---
 .github/workflows/clam-av-scan.yml          | 2 ++
 .github/workflows/windows-defender-scan.yml | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index 92190fa75a..4791d14124 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -8,7 +8,9 @@ on:
   release:
     types: [published]
   pull_request:
+  pull_request:
   push:
+    branches: [dev]
   schedule:
     - cron: "0 3 * * 1"
 permissions:
diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index d2d50c32ee..2dd548720a 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -8,7 +8,7 @@ on:
   release:
     types: [published]
   pull_request:
-  push:
+    branches: [dev]
   schedule:
     - cron: "0 4 * * 1"
 

From ae89716548ff4eab41f776ca5fd5cfb308249991 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 16:21:30 -0500
Subject: [PATCH 12/66] yaml error

---
 .github/workflows/clam-av-scan.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index 4791d14124..805b082058 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -8,8 +8,6 @@ on:
   release:
     types: [published]
   pull_request:
-  pull_request:
-  push:
     branches: [dev]
   schedule:
     - cron: "0 3 * * 1"

From fc6946981738fae2e9d74045dc24ecc0f5c0b7bd Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 16:42:10 -0500
Subject: [PATCH 13/66] ci: fix scanners (owasp dep-check action pin, clamav DB
 init, windows zip contention)

- owasp: use dependency-check/Dependency-Check_Action@1.1.0 and cache DC data
- clamav: install freshclam db before clamscan; package build outputs for PRs; scan release assets
- defender: handle zip handle contention; scan release assets and surface detections
---
 .github/workflows/clam-av-scan.yml          | 24 +++++++++++++++------
 .github/workflows/owasp-scan.yml            |  4 +++-
 .github/workflows/windows-defender-scan.yml | 16 ++++++++++----
 3 files changed, 32 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index 805b082058..c1f732af9b 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -77,7 +77,7 @@ jobs:
       - name: Build (Node)
         if: steps.meta.outputs.has_package_json == 'true' && steps.meta.outputs.has_bun_lock != 'true'
         run: |
-          pnpm run -c build || pnpm -r build || pnpm -w build || \n          npm run build || yarn build || true
+          pnpm run -c build || pnpm -r build || pnpm -w build || npm run build || yarn build || true
 
       # --- Rust path (no external action) ---
       - name: Setup Rust (rustup)
@@ -118,11 +118,16 @@ jobs:
           else tar -czf dist-pr/scan.tgz --exclude=.git --exclude=.github .
           fi
 
-      - name: Install ClamAV
+      - name: Install & update ClamAV DB
         run: |
+          set -e
           sudo apt-get update
-          sudo apt-get install -y clamav
-          sudo freshclam || true
+          sudo apt-get install -y clamav clamav-freshclam
+          sudo systemctl stop clamav-freshclam || true
+          sudo mkdir -p /var/lib/clamav
+          sudo chown -R clamav:clamav /var/lib/clamav
+          sudo freshclam --verbose
+          ls -lh /var/lib/clamav
 
       - name: ClamAV scan (PR)
         run: |
@@ -144,11 +149,16 @@ jobs:
     permissions:
       contents: read
     steps:
-      - name: Install ClamAV
+      - name: Install & update ClamAV DB
         run: |
+          set -e
           sudo apt-get update
-          sudo apt-get install -y clamav
-          sudo freshclam || true
+          sudo apt-get install -y clamav clamav-freshclam
+          sudo systemctl stop clamav-freshclam || true
+          sudo mkdir -p /var/lib/clamav
+          sudo chown -R clamav:clamav /var/lib/clamav
+          sudo freshclam --verbose
+          ls -lh /var/lib/clamav
 
       - name: Resolve release tag
         id: resolve_tag
diff --git a/.github/workflows/owasp-scan.yml b/.github/workflows/owasp-scan.yml
index 0377566664..e3a4e99186 100644
--- a/.github/workflows/owasp-scan.yml
+++ b/.github/workflows/owasp-scan.yml
@@ -30,7 +30,9 @@ jobs:
             depcheck-data-${{ runner.os }}-
 
       - name: Run OWASP Dependency-Check
-        uses: dependency-check/Dependency-Check_Action@v4.1.3
+        uses: dependency-check/Dependency-Check_Action@1.1.0
+        env:
+          JAVA_HOME: /opt/jdk
         with:
           project: "OpenCode"
           path: "."
diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 2dd548720a..172ab33842 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -25,9 +25,17 @@ jobs:
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force -Path dist-pr | Out-Null
-          if (Test-Path dist) { Compress-Archive -Path dist\* -DestinationPath dist-pr\scan.zip -Force }
-          elseif (Test-Path build) { Compress-Archive -Path build\* -DestinationPath dist-pr\scan.zip -Force }
-          else { Compress-Archive -Path * -DestinationPath dist-pr\scan.zip -Force }
+          $zip = 'dist-pr\scan.zip'
+          if (Test-Path $zip) {
+            for ($i=0; $i -lt 10; $i++) {
+              try { Remove-Item -Force $zip; break } catch { Start-Sleep -Seconds 2 }
+            }
+          }
+          $src =
+            if (Test-Path dist) { 'dist\*' }
+            elseif (Test-Path build) { 'build\*' }
+            else { '*' }
+          Compress-Archive -Path $src -DestinationPath $zip -Force
       - name: Windows Defender scan (PR)
         shell: pwsh
         run: |
@@ -42,7 +50,7 @@ jobs:
           path: dist-pr/scan.zip
 
   defender-scan:
-    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
     name: Windows Defender scan (release assets)
     runs-on: windows-latest
     permissions:

From e0509db118c3c12d66d991e28078e1085a9fe80e Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 16:45:53 -0500
Subject: [PATCH 14/66] ci(owasp,defender): fix dep-check inputs (no 'out'; use
 format=ALL + args --out); avoid zip handle contention by using unique
 filename and glob for scan/upload

---
 .github/workflows/owasp-scan.yml            |  6 ++----
 .github/workflows/windows-defender-scan.yml | 14 +++++---------
 2 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/owasp-scan.yml b/.github/workflows/owasp-scan.yml
index e3a4e99186..eddb8e749f 100644
--- a/.github/workflows/owasp-scan.yml
+++ b/.github/workflows/owasp-scan.yml
@@ -20,7 +20,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # Cache DC data to speed up runs
       - name: Cache dependency-check data
         uses: actions/cache@v4
         with:
@@ -36,9 +35,8 @@ jobs:
         with:
           project: "OpenCode"
           path: "."
-          format: "HTML,JSON"
-          out: "dependency-check-report"
-          # optionally: args: "--enableRetired"
+          format: ALL
+          args: "--out dependency-check-report"
 
       - name: Upload reports
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 172ab33842..f4ccf5630a 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -25,12 +25,7 @@ jobs:
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force -Path dist-pr | Out-Null
-          $zip = 'dist-pr\scan.zip'
-          if (Test-Path $zip) {
-            for ($i=0; $i -lt 10; $i++) {
-              try { Remove-Item -Force $zip; break } catch { Start-Sleep -Seconds 2 }
-            }
-          }
+          $zip = Join-Path 'dist-pr' ("scan_" + $env:GITHUB_RUN_ID + '_' + $env:GITHUB_RUN_ATTEMPT + '.zip')
           $src =
             if (Test-Path dist) { 'dist\*' }
             elseif (Test-Path build) { 'build\*' }
@@ -42,12 +37,13 @@ jobs:
           $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue).Source
           if (-not $mp) { $mp = "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" }
           if (-not (Test-Path $mp)) { throw 'MpCmdRun.exe not found' }
-          & $mp -Scan -ScanType 3 -File (Resolve-Path 'dist-pr\scan.zip')
-      - name: Upload PR scan results
+          $zip = Get-ChildItem -File 'dist-pr\*.zip' | Sort-Object LastWriteTime -Descending | Select-Object -First 1
+          & $mp -Scan -ScanType 3 -File $zip.FullName
+      - name: Upload PR scan payload
         uses: actions/upload-artifact@v4
         with:
           name: defender-pr-scan-input
-          path: dist-pr/scan.zip
+          path: dist-pr/*.zip
 
   defender-scan:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'

From da6dafce6fccfe99a6b4d94a5c69c283b59ba18c Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 16:52:58 -0500
Subject: [PATCH 15/66] removed useless smoke test

---
 .github/workflows/ci-smoke.yml | 32 --------------------------------
 1 file changed, 32 deletions(-)
 delete mode 100644 .github/workflows/ci-smoke.yml

diff --git a/.github/workflows/ci-smoke.yml b/.github/workflows/ci-smoke.yml
deleted file mode 100644
index d45eac1ef3..0000000000
--- a/.github/workflows/ci-smoke.yml
+++ /dev/null
@@ -1,32 +0,0 @@
-name: ci-smoke
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-
-permissions: {}
-
-jobs:
-  smoke-linux:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Print context
-        run: |
-          echo "event=$GITHUB_EVENT_NAME"
-          echo "actor=$GITHUB_ACTOR"
-          echo "ref=$GITHUB_REF"
-          echo "sha=$GITHUB_SHA"
-      - name: Hello
-        run: echo hello from ubuntu
-
-  smoke-windows:
-    runs-on: windows-latest
-    steps:
-      - name: Hello
-        run: echo hello from windows
-
-  smoke-macos:
-    runs-on: macos-latest
-    steps:
-      - name: Hello
-        run: echo hello from macos

From 569c0b17af96e894aed2842a0711dd22ba309ba6 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 16:58:14 -0500
Subject: [PATCH 16/66] ci(clamav): detect bun/node/rust/go across repo; only
 run node when no bun; stage outputs; extract before clamscan for real file
 counts

---
 .github/workflows/clam-av-scan.yml | 89 +++++++++++++++++-------------
 1 file changed, 52 insertions(+), 37 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index c1f732af9b..063d48c756 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -26,27 +26,44 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Detect repo meta
+      - name: Detect repo meta (Bun/Node/Rust/Go)
         id: meta
         run: |
-          echo "has_bun_lock=$([ -f bun.lockb ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-          echo "has_package_json=$([ -f package.json ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-          echo "has_pnpm_lock=$([ -f pnpm-lock.yaml ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-          echo "has_yarn_lock=$([ -f yarn.lock ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-          echo "has_package_lock=$([ -f package-lock.json ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-          echo "has_cargo=$([ -n \"$(git ls-files | grep -E '(^|/)Cargo.toml$')\" ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-          echo "has_go=$([ -f go.mod ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+          set -e
+          # search across tracked files anywhere in the repo
+          has_file() { git ls-files -z | tr '\0' '\n' | grep -qE "$1" && echo true || echo false; }
+          echo "has_bun=$(has_file '(^|/)bun\.lockb$')" >> "$GITHUB_OUTPUT"
+          echo "has_node=$(has_file '(^|/)package\.json$')" >> "$GITHUB_OUTPUT"
+          echo "has_pnpm_lock=$(has_file '(^|/)pnpm-lock\.yaml$')" >> "$GITHUB_OUTPUT"
+          echo "has_yarn_lock=$(has_file '(^|/)yarn\.lock$')" >> "$GITHUB_OUTPUT"
+          echo "has_package_lock=$(has_file '(^|/)package-lock\.json$')" >> "$GITHUB_OUTPUT"
+          echo "has_rust=$(has_file '(^|/)Cargo\.toml$')" >> "$GITHUB_OUTPUT"
+          echo "has_go=$(has_file '(^|/)go\.mod$')" >> "$GITHUB_OUTPUT"
+
+      - name: Dump meta detection
+        run: |
+          echo "bun=${{ steps.meta.outputs.has_bun }} node=${{ steps.meta.outputs.has_node }} pnpm=${{ steps.meta.outputs.has_pnpm_lock }} yarn=${{ steps.meta.outputs.has_yarn_lock }} npm_lock=${{ steps.meta.outputs.has_package_lock }} rust=${{ steps.meta.outputs.has_rust }} go=${{ steps.meta.outputs.has_go }}"
 
-      # --- JavaScript path (Bun/Node) ---
-      - name: Setup Bun (no external action)
-        if: steps.meta.outputs.has_bun_lock == 'true'
+      # --- JavaScript path (prefer Bun if present) ---
+      - name: Setup Bun
+        if: steps.meta.outputs.has_bun == 'true'
         run: |
           curl -fsSL https://bun.sh/install | bash
           echo "$HOME/.bun/bin" >> $GITHUB_PATH
           bun --version
 
-      - name: Setup Node via corepack (fallback when not Bun)
-        if: steps.meta.outputs.has_package_json == 'true' && steps.meta.outputs.has_bun_lock != 'true'
+      - name: Install deps (Bun)
+        if: steps.meta.outputs.has_bun == 'true'
+        run: |
+          bun install --frozen-lockfile || bun install || true
+
+      - name: Build (Bun)
+        if: steps.meta.outputs.has_bun == 'true'
+        run: |
+          bun run build || true
+
+      - name: Setup Node via corepack (only when Bun not detected)
+        if: steps.meta.outputs.has_node == 'true' && steps.meta.outputs.has_bun != 'true'
         run: |
           sudo apt-get update -y
           sudo apt-get install -y nodejs npm || true
@@ -57,41 +74,31 @@ jobs:
           node -v || true
           corepack -v || true
 
-      - name: Install deps (Bun)
-        if: steps.meta.outputs.has_bun_lock == 'true'
-        run: |
-          bun install --frozen-lockfile || bun install || true
-
-      - name: Build (Bun)
-        if: steps.meta.outputs.has_bun_lock == 'true'
-        run: |
-          bun run build || true
-
       - name: Install deps (Node)
-        if: steps.meta.outputs.has_package_json == 'true' && steps.meta.outputs.has_bun_lock != 'true'
+        if: steps.meta.outputs.has_node == 'true' && steps.meta.outputs.has_bun != 'true'
         run: |
           if [ "${{ steps.meta.outputs.has_pnpm_lock }}" = "true" ]; then pnpm install --frozen-lockfile || pnpm install || true; fi
           if [ "${{ steps.meta.outputs.has_package_lock }}" = "true" ]; then npm ci || npm i || true; fi
           if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then (yarn --version || true) && (yarn install --frozen-lockfile || yarn install || true); fi
 
       - name: Build (Node)
-        if: steps.meta.outputs.has_package_json == 'true' && steps.meta.outputs.has_bun_lock != 'true'
+        if: steps.meta.outputs.has_node == 'true' && steps.meta.outputs.has_bun != 'true'
         run: |
           pnpm run -c build || pnpm -r build || pnpm -w build || npm run build || yarn build || true
 
-      # --- Rust path (no external action) ---
+      # --- Rust path ---
       - name: Setup Rust (rustup)
-        if: steps.meta.outputs.has_cargo == 'true'
+        if: steps.meta.outputs.has_rust == 'true'
         run: |
           curl https://sh.rustup.rs -sSf | sh -s -- -y
           echo "$HOME/.cargo/bin" >> $GITHUB_PATH
           rustc --version || true
 
       - name: Build (Rust)
-        if: steps.meta.outputs.has_cargo == 'true'
+        if: steps.meta.outputs.has_rust == 'true'
         run: cargo build --release || true
 
-      # --- Go path (first-party action ok) ---
+      # --- Go path ---
       - name: Setup Go
         if: steps.meta.outputs.has_go == 'true'
         uses: actions/setup-go@v5
@@ -111,12 +118,16 @@ jobs:
       - name: Package build outputs
         run: |
           set -e
-          mkdir -p dist-pr
-          if [ -d dist ]; then tar -czf dist-pr/scan.tgz -C dist .
-          elif [ -d build ]; then tar -czf dist-pr/scan.tgz -C build .
-          elif [ -d target/release ]; then tar -czf dist-pr/scan.tgz -C target/release .
-          else tar -czf dist-pr/scan.tgz --exclude=.git --exclude=.github .
+          rm -rf dist-pr/payload
+          mkdir -p dist-pr/payload
+          [ -d dist ] && cp -a dist/. dist-pr/payload/ || true
+          [ -d build ] && cp -a build/. dist-pr/payload/ || true
+          [ -d target/release ] && cp -a target/release/. dist-pr/payload/ || true
+          if [ -z "$(ls -A dist-pr/payload 2>/dev/null)" ]; then
+            rsync -a --exclude '.git' --exclude '.github' ./ dist-pr/payload/
           fi
+          tar -czf dist-pr/scan.tgz -C dist-pr/payload .
+          ls -lh dist-pr/scan.tgz
 
       - name: Install & update ClamAV DB
         run: |
@@ -129,9 +140,13 @@ jobs:
           sudo freshclam --verbose
           ls -lh /var/lib/clamav
 
-      - name: ClamAV scan (PR)
+      - name: ClamAV scan (extract and scan all files)
         run: |
-          clamscan -ri --scan-archive=yes dist-pr | tee clamav-pr.log
+          set -e
+          mkdir -p dist-pr/extracted
+          tar -xzf dist-pr/scan.tgz -C dist-pr/extracted
+          echo "File count in payload: $(find dist-pr/extracted -type f | wc -l)"
+          clamscan -ri --scan-archive=yes dist-pr/extracted | tee clamav-pr.log
           ! grep -q 'Infected files: [1-9]' clamav-pr.log
 
       - name: Upload PR scan results
@@ -180,7 +195,7 @@ jobs:
 
       - name: Scan with ClamAV (release assets)
         run: |
-          clamscan -ri dist-release | tee clamav.log
+          clamscan -ri --scan-archive=yes dist-release | tee clamav.log
           ! grep -q 'Infected files: [1-9]' clamav.log
 
       - name: Upload scan results

From 688d7186c7b81483dc2cea1a744a06cc6dd708f5 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 17:00:50 -0500
Subject: [PATCH 17/66] ci(defender): avoid Compress-Archive lock by zipping to
 %RUNNER_TEMP% with bsdtar + retries; then Move-Item into dist-pr

---
 .github/workflows/windows-defender-scan.yml | 27 ++++++++++++++++-----
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index f4ccf5630a..e12a2d4c72 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -25,12 +25,27 @@ jobs:
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force -Path dist-pr | Out-Null
-          $zip = Join-Path 'dist-pr' ("scan_" + $env:GITHUB_RUN_ID + '_' + $env:GITHUB_RUN_ATTEMPT + '.zip')
-          $src =
-            if (Test-Path dist) { 'dist\*' }
-            elseif (Test-Path build) { 'build\*' }
-            else { '*' }
-          Compress-Archive -Path $src -DestinationPath $zip -Force
+          $zipName = "scan_$env:GITHUB_RUN_ID`_$env:GITHUB_RUN_ATTEMPT.zip"
+          $zip = Join-Path (Resolve-Path 'dist-pr') $zipName
+          $srcRoot = if (Test-Path dist) { 'dist' } elseif (Test-Path build) { 'build' } else { '.' }
+          $tempZip = Join-Path $env:RUNNER_TEMP ("scan_" + [guid]::NewGuid().ToString() + ".zip")
+          function Invoke-WithRetry([scriptblock]$Script, [int]$Attempts = 10, [int]$Delay = 2) {
+            for ($i=1; $i -le $Attempts; $i++) {
+              try { & $Script; return } catch { if ($i -eq $Attempts) { throw }; Start-Sleep -Seconds $Delay }
+            }
+          }
+          # Create the zip in temp using bsdtar (avoids Compress-Archive locking issues)
+          Invoke-WithRetry {
+            if (Test-Path $tempZip) { Remove-Item -Force $tempZip }
+            if ($srcRoot -eq '.') {
+              tar -a -c -f $tempZip --exclude=.git --exclude=.github *
+            } else {
+              tar -a -c -f $tempZip -C $srcRoot .
+            }
+          }
+          # Move into working dir with retries in case Defender holds the handle
+          Invoke-WithRetry { Move-Item -Force $tempZip $zip }
+          Write-Host "Created payload: $zip"
       - name: Windows Defender scan (PR)
         shell: pwsh
         run: |

From 67ebe1af151f0722dc4bf3d4f67c86f86254ff26 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 17:24:51 -0500
Subject: [PATCH 18/66] ci(defender-pr): scan directory instead of the zip to
 avoid archive-skip policy; attach detections JSON in artifact

---
 .github/workflows/windows-defender-scan.yml | 30 ++++++++++++++++-----
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index e12a2d4c72..5b7cb7cff1 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -28,6 +28,7 @@ jobs:
           $zipName = "scan_$env:GITHUB_RUN_ID`_$env:GITHUB_RUN_ATTEMPT.zip"
           $zip = Join-Path (Resolve-Path 'dist-pr') $zipName
           $srcRoot = if (Test-Path dist) { 'dist' } elseif (Test-Path build) { 'build' } else { '.' }
+          $scanRoot = (Resolve-Path $srcRoot).Path
           $tempZip = Join-Path $env:RUNNER_TEMP ("scan_" + [guid]::NewGuid().ToString() + ".zip")
           function Invoke-WithRetry([scriptblock]$Script, [int]$Attempts = 10, [int]$Delay = 2) {
             for ($i=1; $i -le $Attempts; $i++) {
@@ -45,20 +46,35 @@ jobs:
           }
           # Move into working dir with retries in case Defender holds the handle
           Invoke-WithRetry { Move-Item -Force $tempZip $zip }
-          Write-Host "Created payload: $zip"
-      - name: Windows Defender scan (PR)
+          "zip=$zip" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+          "scan_root=$scanRoot" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+          Write-Host "Created payload: $zip | scan_root: $scanRoot"
+      - name: Windows Defender scan (PR; scan directory to avoid archive skip)
         shell: pwsh
         run: |
           $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue).Source
           if (-not $mp) { $mp = "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" }
           if (-not (Test-Path $mp)) { throw 'MpCmdRun.exe not found' }
-          $zip = Get-ChildItem -File 'dist-pr\*.zip' | Sort-Object LastWriteTime -Descending | Select-Object -First 1
-          & $mp -Scan -ScanType 3 -File $zip.FullName
-      - name: Upload PR scan payload
+          $scanRoot = (Get-Content $env:GITHUB_OUTPUT | Select-String '^scan_root=' | ForEach-Object { $_.ToString().Split('=')[1] })[-1]
+          & $mp -Scan -ScanType 3 -File $scanRoot
+      - name: Collect Defender detections (PR)
+        shell: pwsh
+        run: |
+          $since = (Get-Date).AddMinutes(-30)
+          $scanRoot = (Get-Content $env:GITHUB_OUTPUT | Select-String '^scan_root=' | ForEach-Object { $_.ToString().Split('=')[1] })[-1]
+          $re = [Regex]::Escape($scanRoot)
+          $recent = Get-MpThreatDetection | Where-Object { $_.InitialDetectionTime -ge $since -and $_.Resources -and ($_.Resources.Resource -match $re) }
+          if ($recent) {
+            $recent | ConvertTo-Json -Depth 5 | Out-File dist-pr\defender-pr-detections.json -Encoding UTF8
+            Write-Host 'Detections found.'
+          } else { '{"status":"clean"}' | Out-File dist-pr\defender-pr-detections.json -Encoding UTF8 }
+      - name: Upload PR scan payload & results
         uses: actions/upload-artifact@v4
         with:
-          name: defender-pr-scan-input
-          path: dist-pr/*.zip
+          name: defender-pr-results
+          path: |
+            dist-pr/*.zip
+            dist-pr/defender-pr-detections.json
 
   defender-scan:
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'

From 20f6f3acc9334b4da75c9eb6a8bf2b485cda409c Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 17:27:44 -0500
Subject: [PATCH 19/66] ci(owasp): prep dependencies (bun or node) so ODC sees
 installed modules; upload from 'reports' (action default)

---
 .github/workflows/owasp-scan.yml | 38 ++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/owasp-scan.yml b/.github/workflows/owasp-scan.yml
index eddb8e749f..cb604efe44 100644
--- a/.github/workflows/owasp-scan.yml
+++ b/.github/workflows/owasp-scan.yml
@@ -10,6 +10,7 @@ on:
 
 permissions:
   contents: read
+
 jobs:
   depcheck:
     runs-on: ubuntu-latest
@@ -20,6 +21,40 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Detect JS tooling (bun / node)
+        id: meta
+        run: |
+          set -e
+          has_file() { git ls-files -z | tr '\0' '\n' | grep -qE "$1" && echo true || echo false; }
+          echo "has_bun=$(has_file '(^|/)bun\.lockb$')" >> "$GITHUB_OUTPUT"
+          echo "has_node=$(has_file '(^|/)package\.json$')" >> "$GITHUB_OUTPUT"
+          echo "has_pnpm_lock=$(has_file '(^|/)pnpm-lock\.yaml$')" >> "$GITHUB_OUTPUT"
+          echo "has_yarn_lock=$(has_file '(^|/)yarn\.lock$')" >> "$GITHUB_OUTPUT"
+          echo "has_package_lock=$(has_file '(^|/)package-lock\.json$')" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Bun (if bun.lockb present)
+        if: steps.meta.outputs.has_bun == 'true'
+        run: |
+          curl -fsSL https://bun.sh/install | bash
+          echo "$HOME/.bun/bin" >> $GITHUB_PATH
+          bun --version
+
+      - name: Install JS deps for analysis
+        if: steps.meta.outputs.has_bun == 'true' || steps.meta.outputs.has_node == 'true'
+        run: |
+          set -e
+          if [ "${{ steps.meta.outputs.has_bun }}" = "true" ]; then
+            bun install --frozen-lockfile || bun install
+          else
+            sudo apt-get update -y
+            sudo apt-get install -y nodejs npm || true
+            npm i -g corepack || true
+            corepack enable || true
+            if [ "${{ steps.meta.outputs.has_pnpm_lock }}" = "true" ]; then corepack prepare pnpm@9 --activate || true; pnpm install --frozen-lockfile || pnpm install || true; fi
+            if [ "${{ steps.meta.outputs.has_package_lock }}" = "true" ]; then npm ci || npm i || true; fi
+            if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then corepack prepare yarn@stable --activate || true; yarn install --frozen-lockfile || yarn install || true; fi
+          fi
+
       - name: Cache dependency-check data
         uses: actions/cache@v4
         with:
@@ -36,10 +71,9 @@ jobs:
           project: "OpenCode"
           path: "."
           format: ALL
-          args: "--out dependency-check-report"
 
       - name: Upload reports
         uses: actions/upload-artifact@v4
         with:
           name: owasp-depcheck-report
-          path: dependency-check-report
+          path: reports

From 4388b7c238c797cd5754972d2c4f71a14be563bc Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 17:50:44 -0500
Subject: [PATCH 20/66] ci(defender-pr): fix scan_root propagation (use step
 outputs) and add null-guard

---
 .github/workflows/windows-defender-scan.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 5b7cb7cff1..ab8ee66c79 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -22,6 +22,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Prepare PR scan payload
+        id: prep
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force -Path dist-pr | Out-Null
@@ -55,13 +56,14 @@ jobs:
           $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue).Source
           if (-not $mp) { $mp = "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" }
           if (-not (Test-Path $mp)) { throw 'MpCmdRun.exe not found' }
-          $scanRoot = (Get-Content $env:GITHUB_OUTPUT | Select-String '^scan_root=' | ForEach-Object { $_.ToString().Split('=')[1] })[-1]
+          $scanRoot = "${{ steps.prep.outputs.scan_root }}"
+          if (-not $scanRoot) { throw 'scan_root output missing from prep step' }
           & $mp -Scan -ScanType 3 -File $scanRoot
       - name: Collect Defender detections (PR)
         shell: pwsh
         run: |
           $since = (Get-Date).AddMinutes(-30)
-          $scanRoot = (Get-Content $env:GITHUB_OUTPUT | Select-String '^scan_root=' | ForEach-Object { $_.ToString().Split('=')[1] })[-1]
+          $scanRoot = "${{ steps.prep.outputs.scan_root }}"
           $re = [Regex]::Escape($scanRoot)
           $recent = Get-MpThreatDetection | Where-Object { $_.InitialDetectionTime -ge $since -and $_.Resources -and ($_.Resources.Resource -match $re) }
           if ($recent) {

From 80825e0055801b25f687f92f49ee82c76cd39bf9 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 17:55:17 -0500
Subject: [PATCH 21/66] ci(clamav-pr): build with Bun per README/workflows (no
 language detection), package build output and scan with ClamAV

---
 .github/workflows/clam-av-pr.yml | 67 ++++++++++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 .github/workflows/clam-av-pr.yml

diff --git a/.github/workflows/clam-av-pr.yml b/.github/workflows/clam-av-pr.yml
new file mode 100644
index 0000000000..d5cceea74e
--- /dev/null
+++ b/.github/workflows/clam-av-pr.yml
@@ -0,0 +1,67 @@
+name: av-clamav-pr
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  clamav-pr:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Bun
+        run: |
+          curl -fsSL https://bun.sh/install | bash
+          echo '$HOME/.bun/bin' >> $GITHUB_PATH
+          bun --version
+
+      - name: Install dependencies (Bun)
+        run: |
+          bun install --frozen-lockfile || bun install
+
+      - name: Build (Bun)
+        run: |
+          bun run build
+
+      - name: Package build outputs
+        run: |
+          set -e
+          rm -rf dist-pr/payload
+          mkdir -p dist-pr/payload
+          rsync -a --exclude '.git' --exclude '.github' --exclude 'node_modules' ./ dist-pr/payload/
+          tar -czf dist-pr/scan.tgz -C dist-pr/payload .
+          ls -lh dist-pr/scan.tgz
+
+      - name: Install & update ClamAV DB
+        run: |
+          set -e
+          sudo apt-get update
+          sudo apt-get install -y clamav clamav-freshclam
+          sudo systemctl stop clamav-freshclam || true
+          sudo mkdir -p /var/lib/clamav
+          sudo chown -R clamav:clamav /var/lib/clamav
+          sudo freshclam --verbose
+          ls -lh /var/lib/clamav
+
+      - name: ClamAV scan (extract and scan all files)
+        run: |
+          set -e
+          mkdir -p dist-pr/extracted
+          tar -xzf dist-pr/scan.tgz -C dist-pr/extracted
+          echo 'File count in payload: '$(find dist-pr/extracted -type f | wc -l)
+          clamscan -ri --scan-archive=yes dist-pr/extracted | tee clamav-pr.log
+          ! grep -q 'Infected files: [1-9]' clamav-pr.log
+
+      - name: Upload PR scan results
+        uses: actions/upload-artifact@v4
+        with:
+          name: clamav-pr-scan-results
+          path: |
+            clamav-pr.log
+            dist-pr/scan.tgz

From 14b2d58ba9bb784110a12c0dc833e4ec77d73590 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 17:59:06 -0500
Subject: [PATCH 22/66] ci(clamav release): build with Bun (single build per
 README), package outputs, extract + scan with ClamAV, upload logs + payload

---
 .github/workflows/clam-av-scan.yml | 169 +++++------------------------
 1 file changed, 26 insertions(+), 143 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index 063d48c756..3fa2ad6248 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -1,16 +1,13 @@
-name: av-clamav
+name: av-clamav-release
 on:
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Release tag to scan (e.g., v0.15.16)'
+        description: 'Git tag to build and scan (e.g., v0.15.16)'
         required: false
   release:
     types: [published]
-  pull_request:
-    branches: [dev]
-  schedule:
-    - cron: "0 3 * * 1"
+
 permissions:
   contents: read
   actions: read
@@ -20,101 +17,33 @@ defaults:
     shell: bash
 
 jobs:
-  clamav-pr:
-    if: github.event_name == 'pull_request' || github.event_name == 'push'
+  clamav-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Detect repo meta (Bun/Node/Rust/Go)
-        id: meta
-        run: |
-          set -e
-          # search across tracked files anywhere in the repo
-          has_file() { git ls-files -z | tr '\0' '\n' | grep -qE "$1" && echo true || echo false; }
-          echo "has_bun=$(has_file '(^|/)bun\.lockb$')" >> "$GITHUB_OUTPUT"
-          echo "has_node=$(has_file '(^|/)package\.json$')" >> "$GITHUB_OUTPUT"
-          echo "has_pnpm_lock=$(has_file '(^|/)pnpm-lock\.yaml$')" >> "$GITHUB_OUTPUT"
-          echo "has_yarn_lock=$(has_file '(^|/)yarn\.lock$')" >> "$GITHUB_OUTPUT"
-          echo "has_package_lock=$(has_file '(^|/)package-lock\.json$')" >> "$GITHUB_OUTPUT"
-          echo "has_rust=$(has_file '(^|/)Cargo\.toml$')" >> "$GITHUB_OUTPUT"
-          echo "has_go=$(has_file '(^|/)go\.mod$')" >> "$GITHUB_OUTPUT"
-
-      - name: Dump meta detection
-        run: |
-          echo "bun=${{ steps.meta.outputs.has_bun }} node=${{ steps.meta.outputs.has_node }} pnpm=${{ steps.meta.outputs.has_pnpm_lock }} yarn=${{ steps.meta.outputs.has_yarn_lock }} npm_lock=${{ steps.meta.outputs.has_package_lock }} rust=${{ steps.meta.outputs.has_rust }} go=${{ steps.meta.outputs.has_go }}"
+      # Checkout the right ref
+      - name: Checkout (release tag)
+        if: github.event_name == 'release'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - name: Checkout (manual or default)
+        if: github.event_name != 'release'
+        uses: actions/checkout@v4
 
-      # --- JavaScript path (prefer Bun if present) ---
+      # Build with Bun (single source of truth)
       - name: Setup Bun
-        if: steps.meta.outputs.has_bun == 'true'
         run: |
           curl -fsSL https://bun.sh/install | bash
           echo "$HOME/.bun/bin" >> $GITHUB_PATH
           bun --version
-
-      - name: Install deps (Bun)
-        if: steps.meta.outputs.has_bun == 'true'
+      - name: Install dependencies (Bun)
         run: |
-          bun install --frozen-lockfile || bun install || true
-
+          bun install --frozen-lockfile || bun install
       - name: Build (Bun)
-        if: steps.meta.outputs.has_bun == 'true'
-        run: |
-          bun run build || true
-
-      - name: Setup Node via corepack (only when Bun not detected)
-        if: steps.meta.outputs.has_node == 'true' && steps.meta.outputs.has_bun != 'true'
-        run: |
-          sudo apt-get update -y
-          sudo apt-get install -y nodejs npm || true
-          npm i -g corepack || true
-          corepack enable || true
-          if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then corepack prepare yarn@stable --activate || true; fi
-          if [ "${{ steps.meta.outputs.has_pnpm_lock }}" = "true" ]; then corepack prepare pnpm@9 --activate || true; fi
-          node -v || true
-          corepack -v || true
-
-      - name: Install deps (Node)
-        if: steps.meta.outputs.has_node == 'true' && steps.meta.outputs.has_bun != 'true'
         run: |
-          if [ "${{ steps.meta.outputs.has_pnpm_lock }}" = "true" ]; then pnpm install --frozen-lockfile || pnpm install || true; fi
-          if [ "${{ steps.meta.outputs.has_package_lock }}" = "true" ]; then npm ci || npm i || true; fi
-          if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then (yarn --version || true) && (yarn install --frozen-lockfile || yarn install || true); fi
-
-      - name: Build (Node)
-        if: steps.meta.outputs.has_node == 'true' && steps.meta.outputs.has_bun != 'true'
-        run: |
-          pnpm run -c build || pnpm -r build || pnpm -w build || npm run build || yarn build || true
-
-      # --- Rust path ---
-      - name: Setup Rust (rustup)
-        if: steps.meta.outputs.has_rust == 'true'
-        run: |
-          curl https://sh.rustup.rs -sSf | sh -s -- -y
-          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
-          rustc --version || true
-
-      - name: Build (Rust)
-        if: steps.meta.outputs.has_rust == 'true'
-        run: cargo build --release || true
-
-      # --- Go path ---
-      - name: Setup Go
-        if: steps.meta.outputs.has_go == 'true'
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.22.x'
-
-      - name: Build (Go)
-        if: steps.meta.outputs.has_go == 'true'
-        run: |
-          mkdir -p dist
-          if ls cmd >/dev/null 2>&1; then
-            for d in cmd/*; do name=$(basename "$d"); go build -o "dist/$name" "./$d" || true; done
-          else
-            go build -o dist/opencode ./... || true
-          fi
+          bun run build
 
+      # Package build outputs (and, as fallback, repo without VCS)
       - name: Package build outputs
         run: |
           set -e
@@ -122,13 +51,13 @@ jobs:
           mkdir -p dist-pr/payload
           [ -d dist ] && cp -a dist/. dist-pr/payload/ || true
           [ -d build ] && cp -a build/. dist-pr/payload/ || true
-          [ -d target/release ] && cp -a target/release/. dist-pr/payload/ || true
           if [ -z "$(ls -A dist-pr/payload 2>/dev/null)" ]; then
-            rsync -a --exclude '.git' --exclude '.github' ./ dist-pr/payload/
+            rsync -a --exclude '.git' --exclude '.github' --exclude 'node_modules' ./ dist-pr/payload/
           fi
           tar -czf dist-pr/scan.tgz -C dist-pr/payload .
           ls -lh dist-pr/scan.tgz
 
+      # Install ClamAV signatures
       - name: Install & update ClamAV DB
         run: |
           set -e
@@ -140,66 +69,20 @@ jobs:
           sudo freshclam --verbose
           ls -lh /var/lib/clamav
 
+      # Extract and scan so file counts reflect real contents
       - name: ClamAV scan (extract and scan all files)
         run: |
           set -e
           mkdir -p dist-pr/extracted
           tar -xzf dist-pr/scan.tgz -C dist-pr/extracted
           echo "File count in payload: $(find dist-pr/extracted -type f | wc -l)"
-          clamscan -ri --scan-archive=yes dist-pr/extracted | tee clamav-pr.log
-          ! grep -q 'Infected files: [1-9]' clamav-pr.log
-
-      - name: Upload PR scan results
-        uses: actions/upload-artifact@v4
-        with:
-          name: clamav-pr-scan-results
-          path: |
-            clamav-pr.log
-            dist-pr/scan.tgz
-
-  clamav-scan:
-    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
-    name: ClamAV scan (release assets)
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Install & update ClamAV DB
-        run: |
-          set -e
-          sudo apt-get update
-          sudo apt-get install -y clamav clamav-freshclam
-          sudo systemctl stop clamav-freshclam || true
-          sudo mkdir -p /var/lib/clamav
-          sudo chown -R clamav:clamav /var/lib/clamav
-          sudo freshclam --verbose
-          ls -lh /var/lib/clamav
-
-      - name: Resolve release tag
-        id: resolve_tag
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          tag="${{ github.event.release.tag_name }}"
-          if [ -z "$tag" ]; then tag="${{ github.event.inputs.tag }}"; fi
-          if [ -z "$tag" ]; then tag="$(gh release list --limit 1 --json tagName -q '.[0].tagName')"; fi
-          if [ -z "$tag" ]; then echo 'No release tag found' >&2; exit 1; fi
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-
-      - name: Download assets
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          mkdir -p dist-release
-          gh release download "${{ steps.resolve_tag.outputs.tag }}" --dir dist-release --clobber
-
-      - name: Scan with ClamAV (release assets)
-        run: |
-          clamscan -ri --scan-archive=yes dist-release | tee clamav.log
+          clamscan -ri --scan-archive=yes dist-pr/extracted | tee clamav.log
           ! grep -q 'Infected files: [1-9]' clamav.log
 
       - name: Upload scan results
         uses: actions/upload-artifact@v4
         with:
-          name: clamav-scan-results
-          path: clamav.log
+          name: clamav-release-scan-results
+          path: |
+            clamav.log
+            dist-pr/scan.tgz

From 779961a40c3c538b06e018fa30aecb406da1fa5f Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:10:35 -0500
Subject: [PATCH 23/66] ci(clamav): use local setup-bun action per repo docs;
 split PATH application to next step

---
 .github/workflows/clam-av-pr.yml   | 14 ++++++--------
 .github/workflows/clam-av-scan.yml | 23 +++++++++--------------
 2 files changed, 15 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/clam-av-pr.yml b/.github/workflows/clam-av-pr.yml
index d5cceea74e..369198fe71 100644
--- a/.github/workflows/clam-av-pr.yml
+++ b/.github/workflows/clam-av-pr.yml
@@ -16,18 +16,16 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup Bun
-        run: |
-          curl -fsSL https://bun.sh/install | bash
-          echo '$HOME/.bun/bin' >> $GITHUB_PATH
-          bun --version
+        uses: ./.github/actions/setup-bun
+
+      - name: Verify Bun
+        run: bun --version
 
       - name: Install dependencies (Bun)
-        run: |
-          bun install --frozen-lockfile || bun install
+        run: bun install --frozen-lockfile || bun install
 
       - name: Build (Bun)
-        run: |
-          bun run build
+        run: bun run build
 
       - name: Package build outputs
         run: |
diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index 3fa2ad6248..b55d903dd2 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -20,7 +20,6 @@ jobs:
   clamav-release:
     runs-on: ubuntu-latest
     steps:
-      # Checkout the right ref
       - name: Checkout (release tag)
         if: github.event_name == 'release'
         uses: actions/checkout@v4
@@ -30,20 +29,18 @@ jobs:
         if: github.event_name != 'release'
         uses: actions/checkout@v4
 
-      # Build with Bun (single source of truth)
       - name: Setup Bun
-        run: |
-          curl -fsSL https://bun.sh/install | bash
-          echo "$HOME/.bun/bin" >> $GITHUB_PATH
-          bun --version
+        uses: ./.github/actions/setup-bun
+
+      - name: Verify Bun
+        run: bun --version
+
       - name: Install dependencies (Bun)
-        run: |
-          bun install --frozen-lockfile || bun install
+        run: bun install --frozen-lockfile || bun install
+
       - name: Build (Bun)
-        run: |
-          bun run build
+        run: bun run build
 
-      # Package build outputs (and, as fallback, repo without VCS)
       - name: Package build outputs
         run: |
           set -e
@@ -57,7 +54,6 @@ jobs:
           tar -czf dist-pr/scan.tgz -C dist-pr/payload .
           ls -lh dist-pr/scan.tgz
 
-      # Install ClamAV signatures
       - name: Install & update ClamAV DB
         run: |
           set -e
@@ -69,13 +65,12 @@ jobs:
           sudo freshclam --verbose
           ls -lh /var/lib/clamav
 
-      # Extract and scan so file counts reflect real contents
       - name: ClamAV scan (extract and scan all files)
         run: |
           set -e
           mkdir -p dist-pr/extracted
           tar -xzf dist-pr/scan.tgz -C dist-pr/extracted
-          echo "File count in payload: $(find dist-pr/extracted -type f | wc -l)"
+          echo 'File count in payload: '$(find dist-pr/extracted -type f | wc -l)
           clamscan -ri --scan-archive=yes dist-pr/extracted | tee clamav.log
           ! grep -q 'Infected files: [1-9]' clamav.log
 

From ec148ffb511583f407436afa632a2246fcbe4227 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:18:09 -0500
Subject: [PATCH 24/66] build: add composite action to build with Bun and
 package single zip (bundle/opencode.zip)

---
 .github/actions/build-package/action.yml | 39 ++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/actions/build-package/action.yml

diff --git a/.github/actions/build-package/action.yml b/.github/actions/build-package/action.yml
new file mode 100644
index 0000000000..7db30fc8c0
--- /dev/null
+++ b/.github/actions/build-package/action.yml
@@ -0,0 +1,39 @@
+name: Build and package (Bun -> single zip)
+description: Build with Bun and package a single distributable archive
+outputs:
+  archive_path:
+    description: Absolute path to the archive
+    value: ${{ steps.pkg.outputs.archive_path }}
+runs:
+  using: composite
+  steps:
+    - name: Setup Bun
+      uses: ./.github/actions/setup-bun
+
+    - name: Verify Bun
+      shell: bash
+      run: bun --version
+
+    - name: Install dependencies
+      shell: bash
+      run: bun install --frozen-lockfile || bun install
+
+    - name: Build
+      shell: bash
+      run: bun run build
+
+    - name: Ensure zip is available
+      shell: bash
+      run: sudo apt-get update -y && sudo apt-get install -y zip
+
+    - name: Package single file
+      id: pkg
+      shell: bash
+      run: |
+        set -e
+        mkdir -p bundle
+        if [ -d dist ]; then SRC=dist; elif [ -d build ]; then SRC=build; else echo 'No dist/ or build/ after build. Check project build output path.' >&2; exit 1; fi
+        cd "$SRC"
+        zip -r ../bundle/opencode.zip .
+        cd - >/dev/null
+        echo "archive_path=$(pwd)/bundle/opencode.zip" >> "$GITHUB_OUTPUT"

From 4e934c7aa7566b6fbd02be44b92a5f264c6cbef8 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:18:31 -0500
Subject: [PATCH 25/66] ci(clamav-pr): use shared build-package composite;
 produce single bundle/opencode.zip; scan extracted bundle

---
 .github/workflows/clam-av-pr.yml | 43 +++++++++++---------------------
 1 file changed, 14 insertions(+), 29 deletions(-)

diff --git a/.github/workflows/clam-av-pr.yml b/.github/workflows/clam-av-pr.yml
index 369198fe71..6c63696488 100644
--- a/.github/workflows/clam-av-pr.yml
+++ b/.github/workflows/clam-av-pr.yml
@@ -5,54 +5,39 @@ on:
 permissions:
   contents: read
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
   clamav-pr:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - name: Setup Bun
-        uses: ./.github/actions/setup-bun
-
-      - name: Verify Bun
-        run: bun --version
-
-      - name: Install dependencies (Bun)
-        run: bun install --frozen-lockfile || bun install
-
-      - name: Build (Bun)
-        run: bun run build
+      - name: Build and package
+        id: build
+        uses: ./.github/actions/build-package
 
-      - name: Package build outputs
-        run: |
-          set -e
-          rm -rf dist-pr/payload
-          mkdir -p dist-pr/payload
-          rsync -a --exclude '.git' --exclude '.github' --exclude 'node_modules' ./ dist-pr/payload/
-          tar -czf dist-pr/scan.tgz -C dist-pr/payload .
-          ls -lh dist-pr/scan.tgz
+      - name: Upload build bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: opencode-bundle
+          path: bundle/opencode.zip
 
       - name: Install & update ClamAV DB
         run: |
           set -e
           sudo apt-get update
-          sudo apt-get install -y clamav clamav-freshclam
+          sudo apt-get install -y clamav clamav-freshclam unzip
           sudo systemctl stop clamav-freshclam || true
           sudo mkdir -p /var/lib/clamav
           sudo chown -R clamav:clamav /var/lib/clamav
           sudo freshclam --verbose
           ls -lh /var/lib/clamav
 
-      - name: ClamAV scan (extract and scan all files)
+      - name: Extract bundle and scan
         run: |
           set -e
-          mkdir -p dist-pr/extracted
-          tar -xzf dist-pr/scan.tgz -C dist-pr/extracted
-          echo 'File count in payload: '$(find dist-pr/extracted -type f | wc -l)
+          rm -rf dist-pr/extracted && mkdir -p dist-pr/extracted
+          unzip -q bundle/opencode.zip -d dist-pr/extracted
+          echo "File count in payload: $(find dist-pr/extracted -type f | wc -l)"
           clamscan -ri --scan-archive=yes dist-pr/extracted | tee clamav-pr.log
           ! grep -q 'Infected files: [1-9]' clamav-pr.log
 
@@ -62,4 +47,4 @@ jobs:
           name: clamav-pr-scan-results
           path: |
             clamav-pr.log
-            dist-pr/scan.tgz
+            bundle/opencode.zip

From 23e364e0f62b9d286bf375f53f34a8011ed4ba5a Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:18:49 -0500
Subject: [PATCH 26/66] ci(clamav-release): consume shared build-package; scan
 extracted bundle; upload bundle

---
 .github/workflows/clam-av-scan.yml | 51 +++++++-----------------------
 1 file changed, 11 insertions(+), 40 deletions(-)

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index b55d903dd2..61f200afb1 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -1,10 +1,6 @@
 name: av-clamav-release
 on:
   workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Git tag to build and scan (e.g., v0.15.16)'
-        required: false
   release:
     types: [published]
 
@@ -12,10 +8,6 @@ permissions:
   contents: read
   actions: read
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
   clamav-release:
     runs-on: ubuntu-latest
@@ -25,53 +17,32 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ github.event.release.tag_name }}
-      - name: Checkout (manual or default)
+      - name: Checkout (manual/default)
         if: github.event_name != 'release'
         uses: actions/checkout@v4
 
-      - name: Setup Bun
-        uses: ./.github/actions/setup-bun
-
-      - name: Verify Bun
-        run: bun --version
-
-      - name: Install dependencies (Bun)
-        run: bun install --frozen-lockfile || bun install
-
-      - name: Build (Bun)
-        run: bun run build
-
-      - name: Package build outputs
-        run: |
-          set -e
-          rm -rf dist-pr/payload
-          mkdir -p dist-pr/payload
-          [ -d dist ] && cp -a dist/. dist-pr/payload/ || true
-          [ -d build ] && cp -a build/. dist-pr/payload/ || true
-          if [ -z "$(ls -A dist-pr/payload 2>/dev/null)" ]; then
-            rsync -a --exclude '.git' --exclude '.github' --exclude 'node_modules' ./ dist-pr/payload/
-          fi
-          tar -czf dist-pr/scan.tgz -C dist-pr/payload .
-          ls -lh dist-pr/scan.tgz
+      - name: Build and package
+        id: build
+        uses: ./.github/actions/build-package
 
       - name: Install & update ClamAV DB
         run: |
           set -e
           sudo apt-get update
-          sudo apt-get install -y clamav clamav-freshclam
+          sudo apt-get install -y clamav clamav-freshclam unzip
           sudo systemctl stop clamav-freshclam || true
           sudo mkdir -p /var/lib/clamav
           sudo chown -R clamav:clamav /var/lib/clamav
           sudo freshclam --verbose
           ls -lh /var/lib/clamav
 
-      - name: ClamAV scan (extract and scan all files)
+      - name: Extract bundle and scan
         run: |
           set -e
-          mkdir -p dist-pr/extracted
-          tar -xzf dist-pr/scan.tgz -C dist-pr/extracted
-          echo 'File count in payload: '$(find dist-pr/extracted -type f | wc -l)
-          clamscan -ri --scan-archive=yes dist-pr/extracted | tee clamav.log
+          rm -rf dist-release/extracted && mkdir -p dist-release/extracted
+          unzip -q bundle/opencode.zip -d dist-release/extracted
+          echo "File count in payload: $(find dist-release/extracted -type f | wc -l)"
+          clamscan -ri --scan-archive=yes dist-release/extracted | tee clamav.log
           ! grep -q 'Infected files: [1-9]' clamav.log
 
       - name: Upload scan results
@@ -80,4 +51,4 @@ jobs:
           name: clamav-release-scan-results
           path: |
             clamav.log
-            dist-pr/scan.tgz
+            bundle/opencode.zip

From 08fdd6782e2fe3bd4100a11563efd697519354c3 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:19:13 -0500
Subject: [PATCH 27/66] ci(defender): depend on shared build-package; download
 single opencode.zip; scan extracted directory; upload detections

---
 .github/workflows/windows-defender-scan.yml | 150 +++++---------------
 1 file changed, 38 insertions(+), 112 deletions(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index ab8ee66c79..37d4acdf93 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -1,140 +1,66 @@
 name: av-windows-defender
 on:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Release tag to scan (e.g., v0.15.16)'
-        required: false
+  pull_request:
   release:
     types: [published]
-  pull_request:
-    branches: [dev]
-  schedule:
-    - cron: "0 4 * * 1"
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  defender-pr:
-    if: github.event_name == 'pull_request' || github.event_name == 'push'
-    runs-on: windows-latest
+  build:
+    runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - name: Prepare PR scan payload
-        id: prep
-        shell: pwsh
-        run: |
-          New-Item -ItemType Directory -Force -Path dist-pr | Out-Null
-          $zipName = "scan_$env:GITHUB_RUN_ID`_$env:GITHUB_RUN_ATTEMPT.zip"
-          $zip = Join-Path (Resolve-Path 'dist-pr') $zipName
-          $srcRoot = if (Test-Path dist) { 'dist' } elseif (Test-Path build) { 'build' } else { '.' }
-          $scanRoot = (Resolve-Path $srcRoot).Path
-          $tempZip = Join-Path $env:RUNNER_TEMP ("scan_" + [guid]::NewGuid().ToString() + ".zip")
-          function Invoke-WithRetry([scriptblock]$Script, [int]$Attempts = 10, [int]$Delay = 2) {
-            for ($i=1; $i -le $Attempts; $i++) {
-              try { & $Script; return } catch { if ($i -eq $Attempts) { throw }; Start-Sleep -Seconds $Delay }
-            }
-          }
-          # Create the zip in temp using bsdtar (avoids Compress-Archive locking issues)
-          Invoke-WithRetry {
-            if (Test-Path $tempZip) { Remove-Item -Force $tempZip }
-            if ($srcRoot -eq '.') {
-              tar -a -c -f $tempZip --exclude=.git --exclude=.github *
-            } else {
-              tar -a -c -f $tempZip -C $srcRoot .
-            }
-          }
-          # Move into working dir with retries in case Defender holds the handle
-          Invoke-WithRetry { Move-Item -Force $tempZip $zip }
-          "zip=$zip" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
-          "scan_root=$scanRoot" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
-          Write-Host "Created payload: $zip | scan_root: $scanRoot"
-      - name: Windows Defender scan (PR; scan directory to avoid archive skip)
-        shell: pwsh
-        run: |
-          $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue).Source
-          if (-not $mp) { $mp = "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" }
-          if (-not (Test-Path $mp)) { throw 'MpCmdRun.exe not found' }
-          $scanRoot = "${{ steps.prep.outputs.scan_root }}"
-          if (-not $scanRoot) { throw 'scan_root output missing from prep step' }
-          & $mp -Scan -ScanType 3 -File $scanRoot
-      - name: Collect Defender detections (PR)
-        shell: pwsh
-        run: |
-          $since = (Get-Date).AddMinutes(-30)
-          $scanRoot = "${{ steps.prep.outputs.scan_root }}"
-          $re = [Regex]::Escape($scanRoot)
-          $recent = Get-MpThreatDetection | Where-Object { $_.InitialDetectionTime -ge $since -and $_.Resources -and ($_.Resources.Resource -match $re) }
-          if ($recent) {
-            $recent | ConvertTo-Json -Depth 5 | Out-File dist-pr\defender-pr-detections.json -Encoding UTF8
-            Write-Host 'Detections found.'
-          } else { '{"status":"clean"}' | Out-File dist-pr\defender-pr-detections.json -Encoding UTF8 }
-      - name: Upload PR scan payload & results
+      - name: Checkout (release tag)
+        if: github.event_name == 'release'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - name: Checkout (PR/default)
+        if: github.event_name != 'release'
+        uses: actions/checkout@v4
+      - name: Build and package
+        uses: ./.github/actions/build-package
+      - name: Upload build bundle
         uses: actions/upload-artifact@v4
         with:
-          name: defender-pr-results
-          path: |
-            dist-pr/*.zip
-            dist-pr/defender-pr-detections.json
+          name: opencode-bundle
+          path: bundle/opencode.zip
 
-  defender-scan:
-    if: github.event_name == 'release' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
-    name: Windows Defender scan (release assets)
+  defender:
+    needs: build
     runs-on: windows-latest
-    permissions:
-      contents: read
-      actions: read
     steps:
-      - name: Prepare download dir
-        shell: pwsh
-        run: New-Item -ItemType Directory -Force -Path dist-release | Out-Null
-      - name: Resolve release tag
-        id: resolve_tag
-        shell: pwsh
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          $tag = "${{ github.event.release.tag_name }}"
-          if (-not $tag) { $tag = "${{ github.event.inputs.tag }}" }
-          if (-not $tag) { $tag = (gh release list --limit 1 --json tagName -q ".[0].tagName") }
-          if (-not $tag) { throw 'No release tag found' }
-          "tag=$tag" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
-      - name: Download assets for this release
+      - name: Download build bundle
+        uses: actions/download-artifact@v4
+        with:
+          name: opencode-bundle
+          path: bundle
+      - name: Prepare scan dir
         shell: pwsh
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release download "${{ steps.resolve_tag.outputs.tag }}" --dir dist-release --clobber
-      - name: List assets
-        shell: pwsh
-        run: Get-ChildItem -File dist-release | Select-Object FullName, Length | Format-Table | Out-String | Tee-Object -FilePath dist-release\asset-list.txt
-      - name: Scan each asset with Defender
+          New-Item -ItemType Directory -Force -Path scan | Out-Null
+          Expand-Archive -Path bundle/opencode.zip -DestinationPath scan -Force
+      - name: Windows Defender scan (directory)
         shell: pwsh
         run: |
           $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue).Source
           if (-not $mp) { $mp = "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" }
           if (-not (Test-Path $mp)) { throw 'MpCmdRun.exe not found' }
-          Get-ChildItem -File dist-release | ForEach-Object {
-            Write-Host "Scanning $($_.FullName)"
-            & $mp -Scan -ScanType 3 -File $_.FullName
-            Start-Sleep -Seconds 3
-          }
+          & $mp -Scan -ScanType 3 -File (Resolve-Path 'scan')
+      - name: Collect Defender detections
+        shell: pwsh
+        run: |
           $since = (Get-Date).AddMinutes(-30)
-          $recent = Get-MpThreatDetection | Where-Object {
-            $_.InitialDetectionTime -ge $since -and
-            $_.Resources -and ($_.Resources.Resource -match [Regex]::Escape((Resolve-Path "dist-release").Path))
-          }
+          $re = [Regex]::Escape((Resolve-Path 'scan').Path)
+          $recent = Get-MpThreatDetection | Where-Object { $_.InitialDetectionTime -ge $since -and $_.Resources -and ($_.Resources.Resource -match $re) }
           if ($recent) {
-            $recent | ConvertTo-Json -Depth 5 | Out-File dist-release\defender-detections.json -Encoding UTF8
-            Write-Error "Windows Defender found detections. See artifact."
-          } else {
-            '{\"status\":\"clean\"}' | Out-File dist-release\defender-detections.json -Encoding UTF8
-          }
+            $recent | ConvertTo-Json -Depth 5 | Out-File defender-detections.json -Encoding UTF8
+            Write-Error 'Windows Defender found detections. See artifact.'
+          } else { '{"status":"clean"}' | Out-File defender-detections.json -Encoding UTF8 }
       - name: Upload scan results
         uses: actions/upload-artifact@v4
         with:
           name: defender-scan-results
-          path: |
-            dist-release/asset-list.txt
-            dist-release/defender-detections.json
+          path: defender-detections.json

From 2b38bbe27fc055cb10c1d78ed74ba93dbc84b13f Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:23:49 -0500
Subject: [PATCH 28/66] ci(clamav): unify into single workflow
 .github/workflows/clam-av.yml; PR/release/dispatch share one build via
 composite; deprecate old PR/Release files

---
 .github/workflows/clam-av-pr.yml   | 51 +++-----------------------
 .github/workflows/clam-av-scan.yml | 55 +++-------------------------
 .github/workflows/clam-av.yml      | 59 ++++++++++++++++++++++++++++++
 3 files changed, 71 insertions(+), 94 deletions(-)
 create mode 100644 .github/workflows/clam-av.yml

diff --git a/.github/workflows/clam-av-pr.yml b/.github/workflows/clam-av-pr.yml
index 6c63696488..bffc036764 100644
--- a/.github/workflows/clam-av-pr.yml
+++ b/.github/workflows/clam-av-pr.yml
@@ -1,50 +1,11 @@
-name: av-clamav-pr
+name: (deprecated) av-clamav-pr
+# This workflow is intentionally disabled to avoid duplication.
+# Use .github/workflows/clam-av.yml instead.
 on:
-  pull_request:
-
-permissions:
-  contents: read
+  workflow_call:
 
 jobs:
-  clamav-pr:
+  noop:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-
-      - name: Build and package
-        id: build
-        uses: ./.github/actions/build-package
-
-      - name: Upload build bundle
-        uses: actions/upload-artifact@v4
-        with:
-          name: opencode-bundle
-          path: bundle/opencode.zip
-
-      - name: Install & update ClamAV DB
-        run: |
-          set -e
-          sudo apt-get update
-          sudo apt-get install -y clamav clamav-freshclam unzip
-          sudo systemctl stop clamav-freshclam || true
-          sudo mkdir -p /var/lib/clamav
-          sudo chown -R clamav:clamav /var/lib/clamav
-          sudo freshclam --verbose
-          ls -lh /var/lib/clamav
-
-      - name: Extract bundle and scan
-        run: |
-          set -e
-          rm -rf dist-pr/extracted && mkdir -p dist-pr/extracted
-          unzip -q bundle/opencode.zip -d dist-pr/extracted
-          echo "File count in payload: $(find dist-pr/extracted -type f | wc -l)"
-          clamscan -ri --scan-archive=yes dist-pr/extracted | tee clamav-pr.log
-          ! grep -q 'Infected files: [1-9]' clamav-pr.log
-
-      - name: Upload PR scan results
-        uses: actions/upload-artifact@v4
-        with:
-          name: clamav-pr-scan-results
-          path: |
-            clamav-pr.log
-            bundle/opencode.zip
+      - run: echo 'Deprecated: use clam-av.yml'
diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
index 61f200afb1..58771995ca 100644
--- a/.github/workflows/clam-av-scan.yml
+++ b/.github/workflows/clam-av-scan.yml
@@ -1,54 +1,11 @@
-name: av-clamav-release
+name: (deprecated) av-clamav-release
+# This workflow is intentionally disabled to avoid duplication.
+# Use .github/workflows/clam-av.yml instead.
 on:
-  workflow_dispatch:
-  release:
-    types: [published]
-
-permissions:
-  contents: read
-  actions: read
+  workflow_call:
 
 jobs:
-  clamav-release:
+  noop:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout (release tag)
-        if: github.event_name == 'release'
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.release.tag_name }}
-      - name: Checkout (manual/default)
-        if: github.event_name != 'release'
-        uses: actions/checkout@v4
-
-      - name: Build and package
-        id: build
-        uses: ./.github/actions/build-package
-
-      - name: Install & update ClamAV DB
-        run: |
-          set -e
-          sudo apt-get update
-          sudo apt-get install -y clamav clamav-freshclam unzip
-          sudo systemctl stop clamav-freshclam || true
-          sudo mkdir -p /var/lib/clamav
-          sudo chown -R clamav:clamav /var/lib/clamav
-          sudo freshclam --verbose
-          ls -lh /var/lib/clamav
-
-      - name: Extract bundle and scan
-        run: |
-          set -e
-          rm -rf dist-release/extracted && mkdir -p dist-release/extracted
-          unzip -q bundle/opencode.zip -d dist-release/extracted
-          echo "File count in payload: $(find dist-release/extracted -type f | wc -l)"
-          clamscan -ri --scan-archive=yes dist-release/extracted | tee clamav.log
-          ! grep -q 'Infected files: [1-9]' clamav.log
-
-      - name: Upload scan results
-        uses: actions/upload-artifact@v4
-        with:
-          name: clamav-release-scan-results
-          path: |
-            clamav.log
-            bundle/opencode.zip
+      - run: echo 'Deprecated: use clam-av.yml'
diff --git a/.github/workflows/clam-av.yml b/.github/workflows/clam-av.yml
new file mode 100644
index 0000000000..37b3373f76
--- /dev/null
+++ b/.github/workflows/clam-av.yml
@@ -0,0 +1,59 @@
+name: av-clamav
+on:
+  pull_request:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  clamav:
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout the right ref
+      - name: Checkout (release tag)
+        if: github.event_name == 'release'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - name: Checkout (PR/default)
+        if: github.event_name != 'release'
+        uses: actions/checkout@v4
+
+      # Single source-of-truth build -> one file
+      - name: Build and package
+        id: build
+        uses: ./.github/actions/build-package
+
+      # Install fresh ClamAV DB
+      - name: Install & update ClamAV DB
+        run: |
+          set -e
+          sudo apt-get update
+          sudo apt-get install -y clamav clamav-freshclam unzip
+          sudo systemctl stop clamav-freshclam || true
+          sudo mkdir -p /var/lib/clamav
+          sudo chown -R clamav:clamav /var/lib/clamav
+          sudo freshclam --verbose
+          ls -lh /var/lib/clamav
+
+      # Scan extracted bundle so counts reflect actual files
+      - name: Extract bundle and scan
+        run: |
+          set -e
+          rm -rf scan && mkdir -p scan
+          unzip -q bundle/opencode.zip -d scan
+          echo "File count in payload: $(find scan -type f | wc -l)"
+          clamscan -ri --scan-archive=yes scan | tee clamav.log
+          ! grep -q 'Infected files: [1-9]' clamav.log
+
+      - name: Upload scan results
+        uses: actions/upload-artifact@v4
+        with:
+          name: clamav-scan-results
+          path: |
+            clamav.log
+            bundle/opencode.zip

From 2facd0bc2c4bee590f602b1159a20098576e0279 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:26:35 -0500
Subject: [PATCH 29/66] build(composite): use bunx turbo run build (root build
 script not present); package dist/build if present else repo minus heavy dirs

---
 .github/actions/build-package/action.yml | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/.github/actions/build-package/action.yml b/.github/actions/build-package/action.yml
index 7db30fc8c0..0325001d60 100644
--- a/.github/actions/build-package/action.yml
+++ b/.github/actions/build-package/action.yml
@@ -1,5 +1,5 @@
 name: Build and package (Bun -> single zip)
-description: Build with Bun and package a single distributable archive
+description: Build with Bun (Turbo) and package a single distributable archive
 outputs:
   archive_path:
     description: Absolute path to the archive
@@ -18,9 +18,9 @@ runs:
       shell: bash
       run: bun install --frozen-lockfile || bun install
 
-    - name: Build
+    - name: Build (Turbo)
       shell: bash
-      run: bun run build
+      run: bunx turbo run build
 
     - name: Ensure zip is available
       shell: bash
@@ -32,8 +32,11 @@ runs:
       run: |
         set -e
         mkdir -p bundle
-        if [ -d dist ]; then SRC=dist; elif [ -d build ]; then SRC=build; else echo 'No dist/ or build/ after build. Check project build output path.' >&2; exit 1; fi
-        cd "$SRC"
-        zip -r ../bundle/opencode.zip .
-        cd - >/dev/null
+        # Prefer a top-level dist/ or build/ if produced; else package repo (minus heavy dirs)
+        if [ -d dist ]; then SRC=dist; elif [ -d build ]; then SRC=build; else SRC=.; fi
+        if [ "$SRC" = "." ]; then
+          zip -r bundle/opencode.zip . -x '.git/*' '.github/*' 'node_modules/*'
+        else
+          (cd "$SRC" && zip -r ../bundle/opencode.zip .)
+        fi
         echo "archive_path=$(pwd)/bundle/opencode.zip" >> "$GITHUB_OUTPUT"

From d76454f8882ebf2ec2187a97015bc6fe3ae857d7 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:30:30 -0500
Subject: [PATCH 30/66] =?UTF-8?q?ci(owasp):=20bun=20monorepo=20support=20?=
 =?UTF-8?q?=E2=80=94=20setup=20via=20local=20action,=20bun=20install,=20cr?=
 =?UTF-8?q?eate=20per-package=20node=5Fmodules=20symlinks=20so=20ODC=20see?=
 =?UTF-8?q?s=20deps;=20enable=20experimental=20analyzers;=20upload=20repor?=
 =?UTF-8?q?ts?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/owasp-scan.yml | 77 +++++++++++++-------------------
 1 file changed, 32 insertions(+), 45 deletions(-)

diff --git a/.github/workflows/owasp-scan.yml b/.github/workflows/owasp-scan.yml
index cb604efe44..46ffcf4af4 100644
--- a/.github/workflows/owasp-scan.yml
+++ b/.github/workflows/owasp-scan.yml
@@ -1,79 +1,66 @@
 name: owasp-dependency-check
 on:
-  workflow_dispatch:
+  pull_request:
   release:
     types: [published]
-  pull_request:
-    branches: [dev]
-  schedule:
-    - cron: "0 5 * * 1" # weekly, 05:00 UTC Mondays
+  workflow_dispatch:
 
 permissions:
   contents: read
+  security-events: write
 
 jobs:
   depcheck:
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout (release tag)
+        if: github.event_name == 'release'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - name: Checkout (PR/default)
+        if: github.event_name != 'release'
+        uses: actions/checkout@v4
 
-      - name: Detect JS tooling (bun / node)
-        id: meta
-        run: |
-          set -e
-          has_file() { git ls-files -z | tr '\0' '\n' | grep -qE "$1" && echo true || echo false; }
-          echo "has_bun=$(has_file '(^|/)bun\.lockb$')" >> "$GITHUB_OUTPUT"
-          echo "has_node=$(has_file '(^|/)package\.json$')" >> "$GITHUB_OUTPUT"
-          echo "has_pnpm_lock=$(has_file '(^|/)pnpm-lock\.yaml$')" >> "$GITHUB_OUTPUT"
-          echo "has_yarn_lock=$(has_file '(^|/)yarn\.lock$')" >> "$GITHUB_OUTPUT"
-          echo "has_package_lock=$(has_file '(^|/)package-lock\.json$')" >> "$GITHUB_OUTPUT"
+      - name: Setup Bun (repo action)
+        uses: ./.github/actions/setup-bun
 
-      - name: Setup Bun (if bun.lockb present)
-        if: steps.meta.outputs.has_bun == 'true'
-        run: |
-          curl -fsSL https://bun.sh/install | bash
-          echo "$HOME/.bun/bin" >> $GITHUB_PATH
-          bun --version
+      - name: Install workspace deps (Bun)
+        run: bun install --frozen-lockfile || bun install
 
-      - name: Install JS deps for analysis
-        if: steps.meta.outputs.has_bun == 'true' || steps.meta.outputs.has_node == 'true'
+      - name: Ensure per-package node_modules (symlink to root)
         run: |
           set -e
-          if [ "${{ steps.meta.outputs.has_bun }}" = "true" ]; then
-            bun install --frozen-lockfile || bun install
-          else
-            sudo apt-get update -y
-            sudo apt-get install -y nodejs npm || true
-            npm i -g corepack || true
-            corepack enable || true
-            if [ "${{ steps.meta.outputs.has_pnpm_lock }}" = "true" ]; then corepack prepare pnpm@9 --activate || true; pnpm install --frozen-lockfile || pnpm install || true; fi
-            if [ "${{ steps.meta.outputs.has_package_lock }}" = "true" ]; then npm ci || npm i || true; fi
-            if [ "${{ steps.meta.outputs.has_yarn_lock }}" = "true" ]; then corepack prepare yarn@stable --activate || true; yarn install --frozen-lockfile || yarn install || true; fi
-          fi
+          root_nm="$(pwd)/node_modules"
+          if [ ! -d "$root_nm" ]; then echo 'No root node_modules after bun install' >&2; exit 1; fi
+          # create a node_modules symlink in every workspace package that lacks one
+          git ls-files -z | tr '\0' '\n' | grep -E '(^|/)package.json$' | while read -r pj; do
+            pkgdir="$(dirname "$pj")"
+            [ "$pkgdir" = ".github/actions/setup-bun" ] && continue
+            if [ ! -d "$pkgdir/node_modules" ]; then
+              echo "linking $pkgdir/node_modules -> $root_nm"
+              ln -s "$root_nm" "$pkgdir/node_modules" || true
+            fi
+          done
 
       - name: Cache dependency-check data
         uses: actions/cache@v4
         with:
           path: ~/.m2/repository/org/owasp/dependency-check-data/
-          key: depcheck-data-${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
+          key: depcheck-data-${{ runner.os }}-v2
           restore-keys: |
             depcheck-data-${{ runner.os }}-
 
       - name: Run OWASP Dependency-Check
         uses: dependency-check/Dependency-Check_Action@1.1.0
-        env:
-          JAVA_HOME: /opt/jdk
         with:
-          project: "OpenCode"
-          path: "."
+          project: OpenCode
+          path: .
           format: ALL
+          args: --enableExperimental
 
       - name: Upload reports
         uses: actions/upload-artifact@v4
         with:
           name: owasp-depcheck-report
-          path: reports
+          path: reports/**

From 5aa0175feddbceafe17c19585b590c57d8f5b6f8 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:33:13 -0500
Subject: [PATCH 31/66] ci(setup-bun): pin default Bun to 1.3.0 to satisfy
 strict build script; allow override via input

---
 .github/actions/setup-bun/action.yml | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index 108a53df2b..0e9b63ff62 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -1,20 +1,22 @@
-name: "Setup Bun"
-description: "Setup Bun with caching and install dependencies"
+name: setup-bun
+description: Setup Bun with optional version pinning and basic cache
+inputs:
+  bun-version:
+    description: Version of Bun to install (e.g., 1.3.0)
+    required: false
+    default: '1.3.0'
 runs:
-  using: "composite"
+  using: composite
   steps:
     - name: Setup Bun
       uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: ${{ inputs.bun-version }}
 
-    - name: Cache ~/.bun
-      id: cache-bun
+    - name: Cache Bun install dir
       uses: actions/cache@v4
       with:
         path: ~/.bun
-        key: ${{ runner.os }}-bun-${{ hashFiles('bun.lockb', 'bun.lock') }}
+        key: ${{ runner.os }}-bun-${{ inputs.bun-version }}
         restore-keys: |
           ${{ runner.os }}-bun-
-
-    - name: Install dependencies
-      run: bun install
-      shell: bash

From d6876a071f1fa3c46348712c4e8f42a44c6cdaff Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:36:09 -0500
Subject: [PATCH 32/66] ci(bun): restore setup-bun default to 'latest' to avoid
 breaking existing workflows; pin 1.3.0 only in build-package composite used
 by scanners

---
 .github/actions/build-package/action.yml | 4 +++-
 .github/actions/setup-bun/action.yml     | 4 ++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/actions/build-package/action.yml b/.github/actions/build-package/action.yml
index 0325001d60..13c1499473 100644
--- a/.github/actions/build-package/action.yml
+++ b/.github/actions/build-package/action.yml
@@ -7,8 +7,10 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Setup Bun
+    - name: Setup Bun (1.3.0 for strict build script)
       uses: ./.github/actions/setup-bun
+      with:
+        bun-version: '1.3.0'
 
     - name: Verify Bun
       shell: bash
diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index 0e9b63ff62..59dafd7c53 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -2,9 +2,9 @@ name: setup-bun
 description: Setup Bun with optional version pinning and basic cache
 inputs:
   bun-version:
-    description: Version of Bun to install (e.g., 1.3.0)
+    description: Version of Bun to install (e.g., 1.3.1 or latest)
     required: false
-    default: '1.3.0'
+    default: 'latest'
 runs:
   using: composite
   steps:

From f982a98fc7316bd00e0c95362767a9e31c8728e2 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:41:03 -0500
Subject: [PATCH 33/66] Delete .github/workflows/clam-av-scan.yml

---
 .github/workflows/clam-av-scan.yml | 11 -----------
 1 file changed, 11 deletions(-)
 delete mode 100644 .github/workflows/clam-av-scan.yml

diff --git a/.github/workflows/clam-av-scan.yml b/.github/workflows/clam-av-scan.yml
deleted file mode 100644
index 58771995ca..0000000000
--- a/.github/workflows/clam-av-scan.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-name: (deprecated) av-clamav-release
-# This workflow is intentionally disabled to avoid duplication.
-# Use .github/workflows/clam-av.yml instead.
-on:
-  workflow_call:
-
-jobs:
-  noop:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo 'Deprecated: use clam-av.yml'

From af3ec8477f29d155e4871d1cbcb94d782f1e7a90 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:41:55 -0500
Subject: [PATCH 34/66] Delete .github/workflows/clam-av-pr.yml

---
 .github/workflows/clam-av-pr.yml | 11 -----------
 1 file changed, 11 deletions(-)
 delete mode 100644 .github/workflows/clam-av-pr.yml

diff --git a/.github/workflows/clam-av-pr.yml b/.github/workflows/clam-av-pr.yml
deleted file mode 100644
index bffc036764..0000000000
--- a/.github/workflows/clam-av-pr.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-name: (deprecated) av-clamav-pr
-# This workflow is intentionally disabled to avoid duplication.
-# Use .github/workflows/clam-av.yml instead.
-on:
-  workflow_call:
-
-jobs:
-  noop:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo 'Deprecated: use clam-av.yml'

From 17c167d3aba0395b298c5a8b55a2e77220221e04 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 18:53:36 -0500
Subject: [PATCH 35/66] chore(format): use `bunx prettier` instead of `bun run
 prettier` (no prettier script defined)

---
 script/format.ts | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/script/format.ts b/script/format.ts
index c098097373..b981c94c04 100755
--- a/script/format.ts
+++ b/script/format.ts
@@ -2,12 +2,7 @@
 
 import { $ } from "bun"
 
-await $`bun run prettier --ignore-unknown --write`
-
-if (process.env["CI"] && (await $`git status --porcelain`.text())) {
-  await $`git config --local user.email "action@github.com"`
-  await $`git config --local user.name "GitHub Action"`
-  await $`git add -A`
-  await $`git commit -m "chore: format code"`
-  await $`git push --no-verify`
-}
+// Use bunx to invoke the prettier binary from devDependencies.
+// `bun run prettier` expects a package.json script named "prettier";
+// this repo doesn't define that script, so call the binary directly.
+await $`bunx prettier --ignore-unknown --write`

From cf835243ae119e5298837100fcf65bb2202b1da6 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 19:05:50 -0500
Subject: [PATCH 36/66] =?UTF-8?q?ci(setup-bun):=20restore=20legacy=20behav?=
 =?UTF-8?q?ior=20=E2=80=94=20run=20`bun=20install`=20inside=20setup-bun=20?=
 =?UTF-8?q?for=20back-compat=20with=20existing=20workflows?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/actions/setup-bun/action.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index 59dafd7c53..24ddb4faca 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -1,5 +1,5 @@
 name: setup-bun
-description: Setup Bun with optional version pinning and basic cache
+description: Setup Bun and install workspace dependencies (back-compat)
 inputs:
   bun-version:
     description: Version of Bun to install (e.g., 1.3.1 or latest)
@@ -20,3 +20,9 @@ runs:
         key: ${{ runner.os }}-bun-${{ inputs.bun-version }}
         restore-keys: |
           ${{ runner.os }}-bun-
+
+    # Backwards compatibility: this action historically ran `bun install`.
+    # Many existing workflows rely on that behavior.
+    - name: Install workspace dependencies
+      shell: bash
+      run: bun install --frozen-lockfile || bun install

From a06b5479eb88d3e42e8de1ac6efda7361413c2eb Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 19:10:40 -0500
Subject: [PATCH 37/66] ci: pin Bun to 1.3.0 globally in setup-bun (with
 install step) and revert non-security change to script/format.ts

---
 .github/actions/setup-bun/action.yml | 7 +++----
 script/format.ts                     | 7 +++----
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index 24ddb4faca..e93e96b59c 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -2,9 +2,9 @@ name: setup-bun
 description: Setup Bun and install workspace dependencies (back-compat)
 inputs:
   bun-version:
-    description: Version of Bun to install (e.g., 1.3.1 or latest)
+    description: Version of Bun to install (e.g., 1.3.0)
     required: false
-    default: 'latest'
+    default: '1.3.0'
 runs:
   using: composite
   steps:
@@ -21,8 +21,7 @@ runs:
         restore-keys: |
           ${{ runner.os }}-bun-
 
-    # Backwards compatibility: this action historically ran `bun install`.
-    # Many existing workflows rely on that behavior.
+    # Keep historical behavior: run `bun install` during setup for workflows that depend on it.
     - name: Install workspace dependencies
       shell: bash
       run: bun install --frozen-lockfile || bun install
diff --git a/script/format.ts b/script/format.ts
index b981c94c04..450980128d 100755
--- a/script/format.ts
+++ b/script/format.ts
@@ -2,7 +2,6 @@
 
 import { $ } from "bun"
 
-// Use bunx to invoke the prettier binary from devDependencies.
-// `bun run prettier` expects a package.json script named "prettier";
-// this repo doesn't define that script, so call the binary directly.
-await $`bunx prettier --ignore-unknown --write`
+// Restore original behavior: use the package script named "prettier".
+// (If missing, this will fail as before.)
+await $`bun run prettier --ignore-unknown --write`

From 0fc67e2c1e54cb8e599f493d54f7054fc4641f5a Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 19:18:17 -0500
Subject: [PATCH 38/66] ci(defender): force Bun 1.3.0 in build-package; ensure
 build job emits artifact and defender job scans extracted dir

---
 .github/actions/build-package/action.yml    | 11 +++--------
 .github/workflows/windows-defender-scan.yml |  2 +-
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/.github/actions/build-package/action.yml b/.github/actions/build-package/action.yml
index 13c1499473..e2d26a6506 100644
--- a/.github/actions/build-package/action.yml
+++ b/.github/actions/build-package/action.yml
@@ -1,5 +1,5 @@
 name: Build and package (Bun -> single zip)
-description: Build with Bun (Turbo) and package a single distributable archive
+description: Build with Bun 1.3.0 (Turbo) and package a single distributable archive
 outputs:
   archive_path:
     description: Absolute path to the archive
@@ -7,15 +7,11 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Setup Bun (1.3.0 for strict build script)
-      uses: ./.github/actions/setup-bun
+    - name: Setup Bun 1.3.0
+      uses: oven-sh/setup-bun@v2
       with:
         bun-version: '1.3.0'
 
-    - name: Verify Bun
-      shell: bash
-      run: bun --version
-
     - name: Install dependencies
       shell: bash
       run: bun install --frozen-lockfile || bun install
@@ -34,7 +30,6 @@ runs:
       run: |
         set -e
         mkdir -p bundle
-        # Prefer a top-level dist/ or build/ if produced; else package repo (minus heavy dirs)
         if [ -d dist ]; then SRC=dist; elif [ -d build ]; then SRC=build; else SRC=.; fi
         if [ "$SRC" = "." ]; then
           zip -r bundle/opencode.zip . -x '.git/*' '.github/*' 'node_modules/*'
diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 37d4acdf93..7d7e587a0b 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Checkout (PR/default)
         if: github.event_name != 'release'
         uses: actions/checkout@v4
-      - name: Build and package
+      - name: Build and package (Bun 1.3.0)
         uses: ./.github/actions/build-package
       - name: Upload build bundle
         uses: actions/upload-artifact@v4

From 30c48aa25bcbfed70c9ff98763b8044ec3beebc1 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 19:29:57 -0500
Subject: [PATCH 39/66] nope

---
 .github/actions/build-package/action.yml    | 39 ---------------------
 .github/actions/setup-bun/action.yml        | 23 +++++-------
 .github/workflows/windows-defender-scan.yml | 19 ----------
 script/format.ts                            |  8 +++++
 4 files changed, 16 insertions(+), 73 deletions(-)
 delete mode 100644 .github/actions/build-package/action.yml

diff --git a/.github/actions/build-package/action.yml b/.github/actions/build-package/action.yml
deleted file mode 100644
index e2d26a6506..0000000000
--- a/.github/actions/build-package/action.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: Build and package (Bun -> single zip)
-description: Build with Bun 1.3.0 (Turbo) and package a single distributable archive
-outputs:
-  archive_path:
-    description: Absolute path to the archive
-    value: ${{ steps.pkg.outputs.archive_path }}
-runs:
-  using: composite
-  steps:
-    - name: Setup Bun 1.3.0
-      uses: oven-sh/setup-bun@v2
-      with:
-        bun-version: '1.3.0'
-
-    - name: Install dependencies
-      shell: bash
-      run: bun install --frozen-lockfile || bun install
-
-    - name: Build (Turbo)
-      shell: bash
-      run: bunx turbo run build
-
-    - name: Ensure zip is available
-      shell: bash
-      run: sudo apt-get update -y && sudo apt-get install -y zip
-
-    - name: Package single file
-      id: pkg
-      shell: bash
-      run: |
-        set -e
-        mkdir -p bundle
-        if [ -d dist ]; then SRC=dist; elif [ -d build ]; then SRC=build; else SRC=.; fi
-        if [ "$SRC" = "." ]; then
-          zip -r bundle/opencode.zip . -x '.git/*' '.github/*' 'node_modules/*'
-        else
-          (cd "$SRC" && zip -r ../bundle/opencode.zip .)
-        fi
-        echo "archive_path=$(pwd)/bundle/opencode.zip" >> "$GITHUB_OUTPUT"
diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index e93e96b59c..108a53df2b 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -1,27 +1,20 @@
-name: setup-bun
-description: Setup Bun and install workspace dependencies (back-compat)
-inputs:
-  bun-version:
-    description: Version of Bun to install (e.g., 1.3.0)
-    required: false
-    default: '1.3.0'
+name: "Setup Bun"
+description: "Setup Bun with caching and install dependencies"
 runs:
-  using: composite
+  using: "composite"
   steps:
     - name: Setup Bun
       uses: oven-sh/setup-bun@v2
-      with:
-        bun-version: ${{ inputs.bun-version }}
 
-    - name: Cache Bun install dir
+    - name: Cache ~/.bun
+      id: cache-bun
       uses: actions/cache@v4
       with:
         path: ~/.bun
-        key: ${{ runner.os }}-bun-${{ inputs.bun-version }}
+        key: ${{ runner.os }}-bun-${{ hashFiles('bun.lockb', 'bun.lock') }}
         restore-keys: |
           ${{ runner.os }}-bun-
 
-    # Keep historical behavior: run `bun install` during setup for workflows that depend on it.
-    - name: Install workspace dependencies
+    - name: Install dependencies
+      run: bun install
       shell: bash
-      run: bun install --frozen-lockfile || bun install
diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 7d7e587a0b..f9d7b690a6 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -9,27 +9,8 @@ permissions:
   contents: read
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout (release tag)
-        if: github.event_name == 'release'
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.release.tag_name }}
-      - name: Checkout (PR/default)
-        if: github.event_name != 'release'
-        uses: actions/checkout@v4
-      - name: Build and package (Bun 1.3.0)
-        uses: ./.github/actions/build-package
-      - name: Upload build bundle
-        uses: actions/upload-artifact@v4
-        with:
-          name: opencode-bundle
-          path: bundle/opencode.zip
 
   defender:
-    needs: build
     runs-on: windows-latest
     steps:
       - name: Download build bundle
diff --git a/script/format.ts b/script/format.ts
index 450980128d..37ceb9ac0d 100755
--- a/script/format.ts
+++ b/script/format.ts
@@ -5,3 +5,11 @@ import { $ } from "bun"
 // Restore original behavior: use the package script named "prettier".
 // (If missing, this will fail as before.)
 await $`bun run prettier --ignore-unknown --write`
+
+if (process.env["CI"] && (await $`git status --porcelain`.text())) {
+  await $`git config --local user.email "action@github.com"`
+  await $`git config --local user.name "GitHub Action"`
+  await $`git add -A`
+  await $`git commit -m "chore: format code"`
+  await $`git push --no-verify`
+}

From 7e01b17f78d6923bdaf02029cc3c49002f9f3560 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 19:44:28 -0500
Subject: [PATCH 40/66] so we may have needed that one

---
 .github/actions/build-action/action.yml     | 32 +++++++++++++++++++++
 .github/workflows/windows-defender-scan.yml | 19 ++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 .github/actions/build-action/action.yml

diff --git a/.github/actions/build-action/action.yml b/.github/actions/build-action/action.yml
new file mode 100644
index 0000000000..57ce1dfc35
--- /dev/null
+++ b/.github/actions/build-action/action.yml
@@ -0,0 +1,32 @@
+name: Build and package (Bun -> single zip)
+description: Build with Bun 1.3.0 (Turbo) and package a single distributable archive
+outputs:
+  archive_path:
+    description: Absolute path to the archive
+    value: ${{ steps.pkg.outputs.archive_path }}
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-bun
+
+    - name: Build (Turbo)
+      shell: bash
+      run: bunx turbo run build
+
+    - name: Ensure zip is available
+      shell: bash
+      run: sudo apt-get update -y && sudo apt-get install -y zip
+
+    - name: Package single file
+      id: pkg
+      shell: bash
+      run: |
+        set -e
+        mkdir -p bundle
+        if [ -d dist ]; then SRC=dist; elif [ -d build ]; then SRC=build; else SRC=.; fi
+        if [ "$SRC" = "." ]; then
+          zip -r bundle/opencode.zip . -x '.git/*' '.github/*' 'node_modules/*'
+        else
+          (cd "$SRC" && zip -r ../bundle/opencode.zip .)
+        fi
+        echo "archive_path=$(pwd)/bundle/opencode.zip" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index f9d7b690a6..37d4acdf93 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -9,8 +9,27 @@ permissions:
   contents: read
 
 jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (release tag)
+        if: github.event_name == 'release'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - name: Checkout (PR/default)
+        if: github.event_name != 'release'
+        uses: actions/checkout@v4
+      - name: Build and package
+        uses: ./.github/actions/build-package
+      - name: Upload build bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: opencode-bundle
+          path: bundle/opencode.zip
 
   defender:
+    needs: build
     runs-on: windows-latest
     steps:
       - name: Download build bundle

From 5f545ad2a2acb940b0f0fe668eaf826138e29b22 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 19:46:21 -0500
Subject: [PATCH 41/66] I can read

---
 .../{actions/build-action => workflows/build-package}/action.yml  | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename .github/{actions/build-action => workflows/build-package}/action.yml (100%)

diff --git a/.github/actions/build-action/action.yml b/.github/workflows/build-package/action.yml
similarity index 100%
rename from .github/actions/build-action/action.yml
rename to .github/workflows/build-package/action.yml

From a187586c972004aac9304d78eacc5e6ddfce59ee Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 19:47:14 -0500
Subject: [PATCH 42/66] oops

---
 .github/{workflows => actions}/build-package/action.yml | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename .github/{workflows => actions}/build-package/action.yml (100%)

diff --git a/.github/workflows/build-package/action.yml b/.github/actions/build-package/action.yml
similarity index 100%
rename from .github/workflows/build-package/action.yml
rename to .github/actions/build-package/action.yml

From 7c4bf377213c443f2a14ee4bef33a0e6b2dc251f Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 19:58:26 -0500
Subject: [PATCH 43/66] ????

---
 .github/actions/build-package/action.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/actions/build-package/action.yml b/.github/actions/build-package/action.yml
index 57ce1dfc35..f3c75bfdef 100644
--- a/.github/actions/build-package/action.yml
+++ b/.github/actions/build-package/action.yml
@@ -7,7 +7,8 @@ outputs:
 runs:
   using: composite
   steps:
-    - uses: ./.github/actions/setup-bun
+    - name: Setup Bun
+      uses: ./.github/actions/setup-bun
 
     - name: Build (Turbo)
       shell: bash

From 1b654baff130a4eccecbf7f56a3e2cc41f6056ae Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 20:05:16 -0500
Subject: [PATCH 44/66] specify bun version file for setup-bun action

---
 .github/actions/setup-bun/action.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index 108a53df2b..d0274529e2 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -5,6 +5,7 @@ runs:
   steps:
     - name: Setup Bun
       uses: oven-sh/setup-bun@v2
+      bun-version-file: package.json
 
     - name: Cache ~/.bun
       id: cache-bun

From 550f86180499b0f9fdef4d7c8516ef59e8bcb8a8 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 20:06:45 -0500
Subject: [PATCH 45/66] I can definitely read

---
 .github/actions/setup-bun/action.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index d0274529e2..b637ee7b74 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -5,7 +5,8 @@ runs:
   steps:
     - name: Setup Bun
       uses: oven-sh/setup-bun@v2
-      bun-version-file: package.json
+      with:
+        bun-version-file: package.json
 
     - name: Cache ~/.bun
       id: cache-bun

From d03c0b0135eb680b7c6aada5f63153b64559448f Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 20:11:07 -0500
Subject: [PATCH 46/66] lock in bun version

---
 .bun-version | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .bun-version

diff --git a/.bun-version b/.bun-version
new file mode 100644
index 0000000000..f0bb29e763
--- /dev/null
+++ b/.bun-version
@@ -0,0 +1 @@
+1.3.0

From 514284b796ae5cd0ecc5df5fc9cb1fab9cc3bb5c Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 20:13:15 -0500
Subject: [PATCH 47/66] be specific

---
 .github/actions/setup-bun/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index b637ee7b74..9f3fafee75 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -6,7 +6,7 @@ runs:
     - name: Setup Bun
       uses: oven-sh/setup-bun@v2
       with:
-        bun-version-file: package.json
+        bun-version-file: .bun-version
 
     - name: Cache ~/.bun
       id: cache-bun

From 865f369d3c60d58e2d5bc584ea3c95db3ae28d3b Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 20:19:14 -0500
Subject: [PATCH 48/66] add bun version to hash function

---
 .github/actions/setup-bun/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index 9f3fafee75..2eafb2058b 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -13,7 +13,7 @@ runs:
       uses: actions/cache@v4
       with:
         path: ~/.bun
-        key: ${{ runner.os }}-bun-${{ hashFiles('bun.lockb', 'bun.lock') }}
+        key: ${{ runner.os }}-bun-${{ hashFiles('bun.lockb', 'bun.lock') }}-${{ hashFiles('.bun-version')}}
         restore-keys: |
           ${{ runner.os }}-bun-
 

From 6dd6d7256ef32779c78e0e62289fc85ccd18ff75 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 20:22:50 -0500
Subject: [PATCH 49/66] stuff

---
 .github/actions/setup-bun/action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index 2eafb2058b..ecb665bcbd 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -13,7 +13,7 @@ runs:
       uses: actions/cache@v4
       with:
         path: ~/.bun
-        key: ${{ runner.os }}-bun-${{ hashFiles('bun.lockb', 'bun.lock') }}-${{ hashFiles('.bun-version')}}
+        key: ${{ runner.os }}-bun-${{ hashFiles('bun.lockb', 'bun.lock','.bun-version') }}
         restore-keys: |
           ${{ runner.os }}-bun-
 

From ef7f2da3df09fb75fdd7873e87e35e9c0c7880bd Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 20:26:25 -0500
Subject: [PATCH 50/66] ci(setup-bun): make cache version-strict &
 self-invalidating; clear ~/.bun if cached version != requested; keep bun
 install step

---
 .github/actions/setup-bun/action.yml | 47 +++++++++++++++++++---------
 1 file changed, 32 insertions(+), 15 deletions(-)

diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index ecb665bcbd..3e162078d8 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -1,22 +1,39 @@
-name: "Setup Bun"
-description: "Setup Bun with caching and install dependencies"
+name: setup-bun
+description: Setup Bun and install workspace dependencies (back-compat)
+inputs:
+  bun-version:
+    description: Version of Bun to install (e.g., 1.3.0)
+    required: false
+    default: '1.3.0'
 runs:
-  using: "composite"
+  using: composite
   steps:
-    - name: Setup Bun
-      uses: oven-sh/setup-bun@v2
-      with:
-        bun-version-file: .bun-version
-
-    - name: Cache ~/.bun
-      id: cache-bun
+    - name: Restore Bun cache (strict by version)
+      id: bun-cache
       uses: actions/cache@v4
       with:
         path: ~/.bun
-        key: ${{ runner.os }}-bun-${{ hashFiles('bun.lockb', 'bun.lock','.bun-version') }}
-        restore-keys: |
-          ${{ runner.os }}-bun-
+        key: bun-${{ runner.os }}-${{ inputs.bun-version }}-v3
+
+    - name: Drop cache if version mismatches
+      shell: bash
+      run: |
+        set -e
+        REQ="${{ inputs.bun-version }}"
+        if [ -x "$HOME/.bun/bin/bun" ]; then
+          CUR="$($HOME/.bun/bin/bun --version | awk '{print $1}')"
+          if [ "$CUR" != "$REQ" ]; then
+            echo "Cached bun $CUR != requested $REQ; clearing ~/.bun"
+            rm -rf "$HOME/.bun"
+          fi
+        fi
+
+    - name: Setup Bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: ${{ inputs.bun-version }}
 
-    - name: Install dependencies
-      run: bun install
+    # Historical behavior: run bun install during setup
+    - name: Install workspace dependencies
       shell: bash
+      run: bun install --frozen-lockfile || bun install

From be9b0688e538b21f36f5770358a188ba0e7a9b82 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 20:34:36 -0500
Subject: [PATCH 51/66] ci(setup-bun): read version from .bun-version and
 disable tool-cache; verify exact version. build-package now uses this action.

---
 .github/actions/build-package/action.yml |  4 +--
 .github/actions/setup-bun/action.yml     | 44 +++++++++++++-----------
 2 files changed, 26 insertions(+), 22 deletions(-)

diff --git a/.github/actions/build-package/action.yml b/.github/actions/build-package/action.yml
index f3c75bfdef..618c78c1c9 100644
--- a/.github/actions/build-package/action.yml
+++ b/.github/actions/build-package/action.yml
@@ -1,5 +1,5 @@
 name: Build and package (Bun -> single zip)
-description: Build with Bun 1.3.0 (Turbo) and package a single distributable archive
+description: Build with Bun (Turbo) and package a single distributable archive
 outputs:
   archive_path:
     description: Absolute path to the archive
@@ -7,7 +7,7 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Setup Bun
+    - name: Setup Bun (from .bun-version)
       uses: ./.github/actions/setup-bun
 
     - name: Build (Turbo)
diff --git a/.github/actions/setup-bun/action.yml b/.github/actions/setup-bun/action.yml
index 3e162078d8..a6c274c6e5 100644
--- a/.github/actions/setup-bun/action.yml
+++ b/.github/actions/setup-bun/action.yml
@@ -1,37 +1,41 @@
 name: setup-bun
-description: Setup Bun and install workspace dependencies (back-compat)
+description: Setup Bun from .bun-version (or input) and install workspace deps
 inputs:
   bun-version:
-    description: Version of Bun to install (e.g., 1.3.0)
+    description: Fallback Bun version if .bun-version is absent
     required: false
     default: '1.3.0'
+outputs:
+  resolved-version:
+    description: The Bun version that was installed
+    value: ${{ steps.ver.outputs.version }}
 runs:
   using: composite
   steps:
-    - name: Restore Bun cache (strict by version)
-      id: bun-cache
-      uses: actions/cache@v4
-      with:
-        path: ~/.bun
-        key: bun-${{ runner.os }}-${{ inputs.bun-version }}-v3
-
-    - name: Drop cache if version mismatches
+    - name: Resolve Bun version (prefer .bun-version)
+      id: ver
       shell: bash
       run: |
-        set -e
-        REQ="${{ inputs.bun-version }}"
-        if [ -x "$HOME/.bun/bin/bun" ]; then
-          CUR="$($HOME/.bun/bin/bun --version | awk '{print $1}')"
-          if [ "$CUR" != "$REQ" ]; then
-            echo "Cached bun $CUR != requested $REQ; clearing ~/.bun"
-            rm -rf "$HOME/.bun"
-          fi
+        if [ -f .bun-version ]; then
+          ver=$(tr -d '[:space:]' < .bun-version)
+        else
+          ver='${{ inputs.bun-version }}'
         fi
+        echo "version=$ver" >> "$GITHUB_OUTPUT"
+        echo "Resolved Bun version: $ver"
 
-    - name: Setup Bun
+    - name: Setup Bun (no tool-cache, exact version)
       uses: oven-sh/setup-bun@v2
       with:
-        bun-version: ${{ inputs.bun-version }}
+        bun-version: ${{ steps.ver.outputs.version }}
+        no-cache: true
+
+    - name: Verify Bun version
+      shell: bash
+      run: |
+        set -e
+        echo "bun version: $(bun --version)"
+        test "$(bun --version | awk '{print $1}')" = "${{ steps.ver.outputs.version }}"
 
     # Historical behavior: run bun install during setup
     - name: Install workspace dependencies

From 68240920fc1ac6049ca8f65b9ca6a983813bf6d8 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 20:47:17 -0500
Subject: [PATCH 52/66] Kill robot fantasy

---
 .github/workflows/windows-defender-scan.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 37d4acdf93..55f8bc1cde 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -45,7 +45,7 @@ jobs:
       - name: Windows Defender scan (directory)
         shell: pwsh
         run: |
-          $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue).Source
+          $mp = (Get-Command MpCmdRun.exe).Source
           if (-not $mp) { $mp = "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" }
           if (-not (Test-Path $mp)) { throw 'MpCmdRun.exe not found' }
           & $mp -Scan -ScanType 3 -File (Resolve-Path 'scan')

From c5bccf4d357d0f7a41f4220365978b2d07829b8f Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 21:00:27 -0500
Subject: [PATCH 53/66] well then

---
 .github/workflows/windows-defender-scan.yml | 50 +++++++++++++++++----
 1 file changed, 42 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 55f8bc1cde..5f813c32fd 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -37,29 +37,63 @@ jobs:
         with:
           name: opencode-bundle
           path: bundle
+
       - name: Prepare scan dir
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force -Path scan | Out-Null
           Expand-Archive -Path bundle/opencode.zip -DestinationPath scan -Force
+
+      # NEW: robust locator + record scan start time for later filtering
+      - name: Locate MpCmdRun.exe + mark start
+        shell: pwsh
+        run: |
+          $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue)?.Path
+          if (-not $mp) {
+            $platformRoot = Join-Path $env:ProgramData 'Microsoft\Windows Defender\Platform'
+            if (Test-Path $platformRoot) {
+              $mp = Get-ChildItem $platformRoot -Recurse -Filter MpCmdRun.exe |
+                    Sort-Object LastWriteTime -Descending |
+                    Select-Object -First 1 -ExpandProperty FullName
+            }
+          }
+          if (-not $mp) { throw 'MpCmdRun.exe not found' }
+          "MPCMDRUN=$mp" | Out-File -FilePath $env:GITHUB_ENV -Append
+          "DEFENDER_SINCE=$(Get-Date -Format o)" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+      # Optional but recommended: keep definitions fresh
+      - name: Update Defender signatures
+        shell: pwsh
+        run: |
+          & "$env:MPCMDRUN" -SignatureUpdate
+
       - name: Windows Defender scan (directory)
+        id: scan
         shell: pwsh
         run: |
-          $mp = (Get-Command MpCmdRun.exe).Source
-          if (-not $mp) { $mp = "$env:ProgramFiles\Windows Defender\MpCmdRun.exe" }
-          if (-not (Test-Path $mp)) { throw 'MpCmdRun.exe not found' }
-          & $mp -Scan -ScanType 3 -File (Resolve-Path 'scan')
+          & "$env:MPCMDRUN" -Scan -ScanType 3 -File (Resolve-Path 'scan').Path
+
       - name: Collect Defender detections
         shell: pwsh
         run: |
-          $since = (Get-Date).AddMinutes(-30)
+          $since = [datetime]$env:DEFENDER_SINCE
           $re = [Regex]::Escape((Resolve-Path 'scan').Path)
-          $recent = Get-MpThreatDetection | Where-Object { $_.InitialDetectionTime -ge $since -and $_.Resources -and ($_.Resources.Resource -match $re) }
+          $recent = Get-MpThreatDetection |
+            Where-Object {
+              $_.InitialDetectionTime -ge $since -and
+              $_.Resources -and
+              (($_.Resources.Resource) -match $re)
+            }
+
           if ($recent) {
             $recent | ConvertTo-Json -Depth 5 | Out-File defender-detections.json -Encoding UTF8
-            Write-Error 'Windows Defender found detections. See artifact.'
-          } else { '{"status":"clean"}' | Out-File defender-detections.json -Encoding UTF8 }
+            throw 'Windows Defender found detections. See artifact.'
+          } else {
+            '{"status":"clean"}' | Out-File defender-detections.json -Encoding UTF8
+          }
+
       - name: Upload scan results
+        if: ${{ always() }}            # <- ensure we always publish the JSON
         uses: actions/upload-artifact@v4
         with:
           name: defender-scan-results

From 04a24f678a36bc7bcca6ffe7288ef0e8930f4175 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 21:48:29 -0500
Subject: [PATCH 54/66] EICAR string test

---
 .github/workflows/windows-defender-scan.yml | 59 +++++++--------------
 1 file changed, 20 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 5f813c32fd..442912e57b 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -1,33 +1,3 @@
-name: av-windows-defender
-on:
-  pull_request:
-  release:
-    types: [published]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout (release tag)
-        if: github.event_name == 'release'
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.release.tag_name }}
-      - name: Checkout (PR/default)
-        if: github.event_name != 'release'
-        uses: actions/checkout@v4
-      - name: Build and package
-        uses: ./.github/actions/build-package
-      - name: Upload build bundle
-        uses: actions/upload-artifact@v4
-        with:
-          name: opencode-bundle
-          path: bundle/opencode.zip
-
   defender:
     needs: build
     runs-on: windows-latest
@@ -44,7 +14,6 @@ jobs:
           New-Item -ItemType Directory -Force -Path scan | Out-Null
           Expand-Archive -Path bundle/opencode.zip -DestinationPath scan -Force
 
-      # NEW: robust locator + record scan start time for later filtering
       - name: Locate MpCmdRun.exe + mark start
         shell: pwsh
         run: |
@@ -59,16 +28,28 @@ jobs:
           }
           if (-not $mp) { throw 'MpCmdRun.exe not found' }
           "MPCMDRUN=$mp" | Out-File -FilePath $env:GITHUB_ENV -Append
+          # record time BEFORE we create the EICAR file so real-time hits are captured
           "DEFENDER_SINCE=$(Get-Date -Format o)" | Out-File -FilePath $env:GITHUB_ENV -Append
 
-      # Optional but recommended: keep definitions fresh
-      - name: Update Defender signatures
+      # --- EICAR TEST FILE (runtime only; do NOT commit the string) ---
+      - name: Create EICAR test file
+        shell: pwsh
+        run: |
+          $scan = (Resolve-Path 'scan').Path
+          $target = Join-Path $scan 'eicar.com'
+          # Build the canonical EICAR string from parts to avoid storing it verbatim in the repo/logs
+          $p1 = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STAND'
+          $p2 = 'ARD-ANTIVIRUS-TEST-FILE!$H+H*'
+          $eicar = $p1 + $p2
+          # Write exact ASCII bytes with no trailing newline
+          Set-Content -LiteralPath $target -Value $eicar -NoNewline -Encoding Ascii
+
+      - name: Update Defender signatures (optional but recommended)
         shell: pwsh
         run: |
           & "$env:MPCMDRUN" -SignatureUpdate
 
       - name: Windows Defender scan (directory)
-        id: scan
         shell: pwsh
         run: |
           & "$env:MPCMDRUN" -Scan -ScanType 3 -File (Resolve-Path 'scan').Path
@@ -77,23 +58,23 @@ jobs:
         shell: pwsh
         run: |
           $since = [datetime]$env:DEFENDER_SINCE
-          $re = [Regex]::Escape((Resolve-Path 'scan').Path)
+          $scanPath = (Resolve-Path 'scan').Path
+          $re = [Regex]::Escape($scanPath)
           $recent = Get-MpThreatDetection |
             Where-Object {
               $_.InitialDetectionTime -ge $since -and
-              $_.Resources -and
-              (($_.Resources.Resource) -match $re)
+              $_.Resources -and (($_.Resources.Resource) -match $re)
             }
 
           if ($recent) {
             $recent | ConvertTo-Json -Depth 5 | Out-File defender-detections.json -Encoding UTF8
-            throw 'Windows Defender found detections. See artifact.'
+            throw 'Windows Defender found detections (EICAR). See artifact.'
           } else {
             '{"status":"clean"}' | Out-File defender-detections.json -Encoding UTF8
           }
 
       - name: Upload scan results
-        if: ${{ always() }}            # <- ensure we always publish the JSON
+        if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
           name: defender-scan-results

From b0cd1756071fe710da7fc420da1caa289870c006 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 21:53:15 -0500
Subject: [PATCH 55/66] ooops

---
 .github/workflows/windows-defender-scan.yml | 30 +++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 442912e57b..a4cf76b803 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -1,3 +1,33 @@
+name: av-windows-defender
+on:
+  pull_request:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (release tag)
+        if: github.event_name == 'release'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.release.tag_name }}
+      - name: Checkout (PR/default)
+        if: github.event_name != 'release'
+        uses: actions/checkout@v4
+      - name: Build and package
+        uses: ./.github/actions/build-package
+      - name: Upload build bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: opencode-bundle
+          path: bundle/opencode.zip
+
   defender:
     needs: build
     runs-on: windows-latest

From 20d58ee3de662b556e897300664f0a23a5ac3ccc Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 23:05:43 -0500
Subject: [PATCH 56/66] trying to trigger security check

---
 .github/workflows/windows-defender-scan.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index a4cf76b803..ec9e8503f4 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -60,6 +60,15 @@ jobs:
           "MPCMDRUN=$mp" | Out-File -FilePath $env:GITHUB_ENV -Append
           # record time BEFORE we create the EICAR file so real-time hits are captured
           "DEFENDER_SINCE=$(Get-Date -Format o)" | Out-File -FilePath $env:GITHUB_ENV -Append
+      - name: Assert Defender status + mark start
+        shell: pwsh
+        run: |
+          $s = Get-MpComputerStatus
+          $s | Select AMRunningMode, RealTimeProtectionEnabled, IsTamperProtected, AntiVirusSignatureVersion | Format-List
+          if ($s.AMRunningMode -ne 'Normal' -or -not $s.RealTimeProtectionEnabled) {
+            throw "Defender not active (AMRunningMode=$($s.AMRunningMode), RTP=$($s.RealTimeProtectionEnabled))"
+          }
+          "DEFENDER_SINCE=$(Get-Date -Format o)" | Out-File -FilePath $env:GITHUB_ENV -Append
 
       # --- EICAR TEST FILE (runtime only; do NOT commit the string) ---
       - name: Create EICAR test file

From 9d238887309ce9a826941a0db59aaf5e21ca3d06 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 23:43:22 -0500
Subject: [PATCH 57/66] it should only pass if it fails

---
 .github/workflows/windows-defender-scan.yml | 181 +++++++++++---------
 1 file changed, 100 insertions(+), 81 deletions(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index ec9e8503f4..5a46d10a99 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -28,93 +28,112 @@ jobs:
           name: opencode-bundle
           path: bundle/opencode.zip
 
-  defender:
-    needs: build
-    runs-on: windows-latest
-    steps:
-      - name: Download build bundle
-        uses: actions/download-artifact@v4
-        with:
-          name: opencode-bundle
-          path: bundle
+defender:
+  needs: build
+  runs-on: windows-latest
+  steps:
+    - name: Download build bundle
+      uses: actions/download-artifact@v4
+      with:
+        name: opencode-bundle
+        path: bundle
 
-      - name: Prepare scan dir
-        shell: pwsh
-        run: |
-          New-Item -ItemType Directory -Force -Path scan | Out-Null
-          Expand-Archive -Path bundle/opencode.zip -DestinationPath scan -Force
+    - name: Prepare scan dir
+      shell: pwsh
+      run: |
+        New-Item -ItemType Directory -Force -Path scan | Out-Null
+        Expand-Archive -Path bundle/opencode.zip -DestinationPath scan -Force
 
-      - name: Locate MpCmdRun.exe + mark start
-        shell: pwsh
-        run: |
-          $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue)?.Path
-          if (-not $mp) {
-            $platformRoot = Join-Path $env:ProgramData 'Microsoft\Windows Defender\Platform'
-            if (Test-Path $platformRoot) {
-              $mp = Get-ChildItem $platformRoot -Recurse -Filter MpCmdRun.exe |
-                    Sort-Object LastWriteTime -Descending |
-                    Select-Object -First 1 -ExpandProperty FullName
-            }
+    - name: Locate MpCmdRun.exe + assert Defender is active + mark start
+      id: envdef
+      shell: pwsh
+      run: |
+        $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue)?.Path
+        if (-not $mp) {
+          $root = Join-Path $env:ProgramData 'Microsoft\Windows Defender\Platform'
+          if (Test-Path $root) {
+            $mp = Get-ChildItem $root -Recurse -Filter MpCmdRun.exe |
+                  Sort-Object LastWriteTime -Descending |
+                  Select-Object -First 1 -ExpandProperty FullName
           }
-          if (-not $mp) { throw 'MpCmdRun.exe not found' }
-          "MPCMDRUN=$mp" | Out-File -FilePath $env:GITHUB_ENV -Append
-          # record time BEFORE we create the EICAR file so real-time hits are captured
-          "DEFENDER_SINCE=$(Get-Date -Format o)" | Out-File -FilePath $env:GITHUB_ENV -Append
-      - name: Assert Defender status + mark start
-        shell: pwsh
-        run: |
-          $s = Get-MpComputerStatus
-          $s | Select AMRunningMode, RealTimeProtectionEnabled, IsTamperProtected, AntiVirusSignatureVersion | Format-List
-          if ($s.AMRunningMode -ne 'Normal' -or -not $s.RealTimeProtectionEnabled) {
-            throw "Defender not active (AMRunningMode=$($s.AMRunningMode), RTP=$($s.RealTimeProtectionEnabled))"
-          }
-          "DEFENDER_SINCE=$(Get-Date -Format o)" | Out-File -FilePath $env:GITHUB_ENV -Append
+        }
+        if (-not $mp) { throw 'MpCmdRun.exe not found' }
+        $s = Get-MpComputerStatus
+        if ($s.AMRunningMode -ne 'Normal' -or -not $s.RealTimeProtectionEnabled) {
+          throw "Defender not active (AMRunningMode=$($s.AMRunningMode), RTP=$($s.RealTimeProtectionEnabled))"
+        }
+        "MPCMDRUN=$mp" | Out-File -FilePath $env:GITHUB_ENV -Append
+        "DEFENDER_SINCE=$(Get-Date -Format o)" | Out-File -FilePath $env:GITHUB_ENV -Append
 
-      # --- EICAR TEST FILE (runtime only; do NOT commit the string) ---
-      - name: Create EICAR test file
-        shell: pwsh
-        run: |
-          $scan = (Resolve-Path 'scan').Path
-          $target = Join-Path $scan 'eicar.com'
-          # Build the canonical EICAR string from parts to avoid storing it verbatim in the repo/logs
-          $p1 = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STAND'
-          $p2 = 'ARD-ANTIVIRUS-TEST-FILE!$H+H*'
-          $eicar = $p1 + $p2
-          # Write exact ASCII bytes with no trailing newline
-          Set-Content -LiteralPath $target -Value $eicar -NoNewline -Encoding Ascii
+    # --- create a harmless but detectable file (EICAR) ---
+    - name: Create EICAR test file (ASCII, no newline)
+      shell: pwsh
+      run: |
+        $scan = (Resolve-Path 'scan').Path
+        $target = Join-Path $scan 'eicar.txt'
+        $p1 = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STAND'
+        $p2 = 'ARD-ANTIVIRUS-TEST-FILE!$H+H*'
+        Set-Content -LiteralPath $target -Value ($p1+$p2) -NoNewline -Encoding Ascii
 
-      - name: Update Defender signatures (optional but recommended)
-        shell: pwsh
-        run: |
-          & "$env:MPCMDRUN" -SignatureUpdate
+    - name: Provoke RTP (force read)
+      shell: pwsh
+      run: |
+        cmd /c type scan\eicar.txt >NUL
+        Start-Sleep -Seconds 3  # give logs a moment
 
-      - name: Windows Defender scan (directory)
-        shell: pwsh
-        run: |
-          & "$env:MPCMDRUN" -Scan -ScanType 3 -File (Resolve-Path 'scan').Path
+    # assert detection, but do NOT fail here; report via step output
+    - name: Collect detections and set output
+      id: detect
+      shell: pwsh
+      run: |
+        $since    = [datetime]$env:DEFENDER_SINCE
+        $scanPath = (Resolve-Path 'scan').Path
+        $re       = [Regex]::Escape($scanPath)
 
-      - name: Collect Defender detections
-        shell: pwsh
-        run: |
-          $since = [datetime]$env:DEFENDER_SINCE
-          $scanPath = (Resolve-Path 'scan').Path
-          $re = [Regex]::Escape($scanPath)
-          $recent = Get-MpThreatDetection |
-            Where-Object {
-              $_.InitialDetectionTime -ge $since -and
-              $_.Resources -and (($_.Resources.Resource) -match $re)
-            }
+        $hits = @()
 
-          if ($recent) {
-            $recent | ConvertTo-Json -Depth 5 | Out-File defender-detections.json -Encoding UTF8
-            throw 'Windows Defender found detections (EICAR). See artifact.'
-          } else {
-            '{"status":"clean"}' | Out-File defender-detections.json -Encoding UTF8
-          }
+        # 1) Threat history
+        $d1 = Get-MpThreatDetection | Where-Object {
+          $_.InitialDetectionTime -ge $since -and
+          ($_.ThreatName -match 'EICAR' -or ($_.Resources.Resource -match $re))
+        }
+        if ($d1) { $hits += $d1 }
 
-      - name: Upload scan results
-        if: ${{ always() }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: defender-scan-results
-          path: defender-detections.json
+        # 2) (Optional) Event log 1116/1117
+        try {
+          $d2 = Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Windows Defender/Operational'; StartTime=$since } |
+                Where-Object { $_.Id -in 1116,1117 }
+          if ($d2) { $hits += $d2 }
+        } catch { }  # some runners restrict this; ignore
+
+        if ($hits) {
+          $hits | ForEach-Object {
+            if ($_ -is [System.Diagnostics.Eventing.Reader.EventRecord]) {
+              [pscustomobject]@{ Source='EventLog'; Id=$_.Id; TimeCreated=$_.TimeCreated; Message=$_.FormatDescription() }
+            } else { $_ }
+          } | ConvertTo-Json -Depth 6 | Out-File defender-detections.json -Encoding UTF8
+          Add-Content -Path $env:GITHUB_OUTPUT -Value "detected=true"
+        } else {
+          '{"status":"no-detections"}' | Out-File defender-detections.json -Encoding UTF8
+          Add-Content -Path $env:GITHUB_OUTPUT -Value "detected=false"
+        }
+
+    - name: Upload scan results
+      if: ${{ always() }}
+      uses: actions/upload-artifact@v4
+      with:
+        name: defender-detections
+        path: defender-detections.json
+
+    # 🔴 gate: fail the job iff we did NOT observe a detection
+    - name: Fail if EICAR not detected
+      if: steps.detect.outputs.detected != 'true'
+      shell: pwsh
+      run: exit 1
+
+    # (optional) now run your on-demand directory scan of the bundle
+    - name: Windows Defender scan (directory)
+      shell: pwsh
+      run: |
+        & "$env:MPCMDRUN" -SignatureUpdate
+        & "$env:MPCMDRUN" -Scan -ScanType 3 -File (Resolve-Path 'scan').Path

From 541fdd5f75e61095603812cad2d3ed7cb0fa9405 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Fri, 24 Oct 2025 23:55:53 -0500
Subject: [PATCH 58/66] robot's don't want you to be safe

---
 .github/workflows/windows-defender-scan.yml | 227 +++++++++++---------
 1 file changed, 120 insertions(+), 107 deletions(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 5a46d10a99..097e9a2f9b 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -28,112 +28,125 @@ jobs:
           name: opencode-bundle
           path: bundle/opencode.zip
 
-defender:
-  needs: build
-  runs-on: windows-latest
-  steps:
-    - name: Download build bundle
-      uses: actions/download-artifact@v4
-      with:
-        name: opencode-bundle
-        path: bundle
-
-    - name: Prepare scan dir
-      shell: pwsh
-      run: |
-        New-Item -ItemType Directory -Force -Path scan | Out-Null
-        Expand-Archive -Path bundle/opencode.zip -DestinationPath scan -Force
-
-    - name: Locate MpCmdRun.exe + assert Defender is active + mark start
-      id: envdef
-      shell: pwsh
-      run: |
-        $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue)?.Path
-        if (-not $mp) {
-          $root = Join-Path $env:ProgramData 'Microsoft\Windows Defender\Platform'
-          if (Test-Path $root) {
-            $mp = Get-ChildItem $root -Recurse -Filter MpCmdRun.exe |
-                  Sort-Object LastWriteTime -Descending |
-                  Select-Object -First 1 -ExpandProperty FullName
+  defender:
+    needs: build
+    runs-on: windows-latest
+    steps:
+      - name: Download build bundle
+        uses: actions/download-artifact@v4
+        with:
+          name: opencode-bundle
+          path: bundle
+
+      - name: Prepare scan dir
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path scan | Out-Null
+          Expand-Archive -Path bundle/opencode.zip -DestinationPath scan -Force
+
+      - name: Locate MpCmdRun.exe + assert Defender is active + mark start
+        id: envdef
+        shell: pwsh
+        run: |
+          $mp = (Get-Command MpCmdRun.exe -ErrorAction SilentlyContinue)?.Path
+          if (-not $mp) {
+            $root = Join-Path $env:ProgramData 'Microsoft\Windows Defender\Platform'
+            if (Test-Path $root) {
+              $mp = Get-ChildItem $root -Recurse -Filter MpCmdRun.exe |
+                    Sort-Object LastWriteTime -Descending |
+                    Select-Object -First 1 -ExpandProperty FullName
+            }
+          }
+          if (-not $mp) { throw 'MpCmdRun.exe not found' }
+          $s = Get-MpComputerStatus
+          if ($s.AMRunningMode -ne 'Normal' -or -not $s.RealTimeProtectionEnabled) {
+            throw "Defender not active (AMRunningMode=$($s.AMRunningMode), RTP=$($s.RealTimeProtectionEnabled))"
           }
-        }
-        if (-not $mp) { throw 'MpCmdRun.exe not found' }
-        $s = Get-MpComputerStatus
-        if ($s.AMRunningMode -ne 'Normal' -or -not $s.RealTimeProtectionEnabled) {
-          throw "Defender not active (AMRunningMode=$($s.AMRunningMode), RTP=$($s.RealTimeProtectionEnabled))"
-        }
-        "MPCMDRUN=$mp" | Out-File -FilePath $env:GITHUB_ENV -Append
-        "DEFENDER_SINCE=$(Get-Date -Format o)" | Out-File -FilePath $env:GITHUB_ENV -Append
-
-    # --- create a harmless but detectable file (EICAR) ---
-    - name: Create EICAR test file (ASCII, no newline)
-      shell: pwsh
-      run: |
-        $scan = (Resolve-Path 'scan').Path
-        $target = Join-Path $scan 'eicar.txt'
-        $p1 = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STAND'
-        $p2 = 'ARD-ANTIVIRUS-TEST-FILE!$H+H*'
-        Set-Content -LiteralPath $target -Value ($p1+$p2) -NoNewline -Encoding Ascii
-
-    - name: Provoke RTP (force read)
-      shell: pwsh
-      run: |
-        cmd /c type scan\eicar.txt >NUL
-        Start-Sleep -Seconds 3  # give logs a moment
-
-    # assert detection, but do NOT fail here; report via step output
-    - name: Collect detections and set output
-      id: detect
-      shell: pwsh
-      run: |
-        $since    = [datetime]$env:DEFENDER_SINCE
-        $scanPath = (Resolve-Path 'scan').Path
-        $re       = [Regex]::Escape($scanPath)
-
-        $hits = @()
-
-        # 1) Threat history
-        $d1 = Get-MpThreatDetection | Where-Object {
-          $_.InitialDetectionTime -ge $since -and
-          ($_.ThreatName -match 'EICAR' -or ($_.Resources.Resource -match $re))
-        }
-        if ($d1) { $hits += $d1 }
-
-        # 2) (Optional) Event log 1116/1117
-        try {
-          $d2 = Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Windows Defender/Operational'; StartTime=$since } |
-                Where-Object { $_.Id -in 1116,1117 }
-          if ($d2) { $hits += $d2 }
-        } catch { }  # some runners restrict this; ignore
-
-        if ($hits) {
-          $hits | ForEach-Object {
-            if ($_ -is [System.Diagnostics.Eventing.Reader.EventRecord]) {
-              [pscustomobject]@{ Source='EventLog'; Id=$_.Id; TimeCreated=$_.TimeCreated; Message=$_.FormatDescription() }
-            } else { $_ }
+          "MPCMDRUN=$mp" | Out-File -FilePath $env:GITHUB_ENV -Append
+          "DEFENDER_SINCE=$(Get-Date -Format o)" | Out-File -FilePath $env:GITHUB_ENV -Append
+
+      # --- create a harmless but detectable file (EICAR) ---
+      - name: Create EICAR test file (ASCII, no newline)
+        shell: pwsh
+        run: |
+          $scan = (Resolve-Path 'scan').Path
+          $target = Join-Path $scan 'eicar.txt'
+          $p1 = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STAND'
+          $p2 = 'ARD-ANTIVIRUS-TEST-FILE!$H+H*'
+          Set-Content -LiteralPath $target -Value ($p1+$p2) -NoNewline -Encoding Ascii
+
+      - name: Provoke RTP (force read)
+        shell: pwsh
+        run: |
+          cmd /c type scan\eicar.txt >NUL
+          Start-Sleep -Seconds 3  # give logs a moment
+
+      # assert detection, but do NOT fail here; report via step output
+      - name: Collect detections and set outputs
+        id: detect
+        shell: pwsh
+        run: |
+          $since     = [datetime]$env:DEFENDER_SINCE
+          $scanPath  = (Resolve-Path 'scan').Path
+          $eicarPath = Join-Path $scanPath 'eicar.txt'  # <-- whichever name you used
+
+          # 1) pull threat history since our marker
+          $all = Get-MpThreatDetection | Where-Object { $_.InitialDetectionTime -ge $since }
+
+          # classifier: EICAR if ThreatName mentions EICAR OR any resource equals our eicar file path
+          function Is-Eicar($d) {
+            try {
+              if ($d.ThreatName -match 'EICAR') { return $true }
+            } catch {}
+            try {
+              if ($d.Resources -and ($d.Resources.Resource | Where-Object { $_ -ieq $eicarPath })) { return $true }
+            } catch {}
+            return $false
+          }
+
+          $eicar = @()
+          $real  = @()
+          foreach ($d in $all) { if (Is-Eicar $d) { $eicar += $d } else { $real += $d } }
+
+          # 2) (optional) also harvest Defender Operational events for context/evidence
+          $events = @()
+          try {
+            $events = Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Windows Defender/Operational'; StartTime=$since } |
+                      Where-Object { $_.Id -in 1116,1117 } |
+                      ForEach-Object { [pscustomobject]@{ Id=$_.Id; TimeCreated=$_.TimeCreated; Message=$_.FormatDescription() } }
+          } catch { }
+
+          # 3) write a structured artifact
+          [pscustomobject]@{
+            since      = $since
+            eicarHits  = $eicar
+            realHits   = $real
+            eventLog   = $events
           } | ConvertTo-Json -Depth 6 | Out-File defender-detections.json -Encoding UTF8
-          Add-Content -Path $env:GITHUB_OUTPUT -Value "detected=true"
-        } else {
-          '{"status":"no-detections"}' | Out-File defender-detections.json -Encoding UTF8
-          Add-Content -Path $env:GITHUB_OUTPUT -Value "detected=false"
-        }
-
-    - name: Upload scan results
-      if: ${{ always() }}
-      uses: actions/upload-artifact@v4
-      with:
-        name: defender-detections
-        path: defender-detections.json
-
-    # 🔴 gate: fail the job iff we did NOT observe a detection
-    - name: Fail if EICAR not detected
-      if: steps.detect.outputs.detected != 'true'
-      shell: pwsh
-      run: exit 1
-
-    # (optional) now run your on-demand directory scan of the bundle
-    - name: Windows Defender scan (directory)
-      shell: pwsh
-      run: |
-        & "$env:MPCMDRUN" -SignatureUpdate
-        & "$env:MPCMDRUN" -Scan -ScanType 3 -File (Resolve-Path 'scan').Path
+
+          # 4) expose stable, lowercase outputs for gating
+          $eicarVerified = ($eicar.Count -gt 0)
+          $realCount     = $real.Count
+          Add-Content -Path $env:GITHUB_OUTPUT -Value ("eicar_verified=" + $eicarVerified.ToString().ToLowerInvariant())
+          Add-Content -Path $env:GITHUB_OUTPUT -Value ("real_detections=" + ([bool]($realCount -gt 0)).ToString().ToLowerInvariant())
+          Add-Content -Path $env:GITHUB_OUTPUT -Value ("real_count=" + $realCount)
+
+      - name: Upload scan results
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: defender-detections
+          path: defender-detections.json
+
+      # fail if EICAR missing OR real threats present
+      - name: Fail if EICAR not detected or real detections found
+        if: steps.detect.outputs.eicar_verified != 'true' || steps.detect.outputs.real_detections == 'true'
+        shell: pwsh
+        run: exit 1
+
+      # (optional) now run your on-demand directory scan of the bundle
+      - name: Windows Defender scan (directory)
+        shell: pwsh
+        run: |
+          & "$env:MPCMDRUN" -SignatureUpdate
+          & "$env:MPCMDRUN" -Scan -ScanType 3 -File (Resolve-Path 'scan').Path

From bea69752bf229fa6ac6dc349c33bee312b231513 Mon Sep 17 00:00:00 2001
From: Error <foamy125@gmail.com>
Date: Sat, 25 Oct 2025 00:14:07 -0500
Subject: [PATCH 59/66] Won't work in github ci

---
 .github/workflows/windows-defender-scan.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 097e9a2f9b..82a81c4134 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -58,10 +58,14 @@ jobs:
             }
           }
           if (-not $mp) { throw 'MpCmdRun.exe not found' }
+
+          # AFTER (works on GH runners)
           $s = Get-MpComputerStatus
-          if ($s.AMRunningMode -ne 'Normal' -or -not $s.RealTimeProtectionEnabled) {
-            throw "Defender not active (AMRunningMode=$($s.AMRunningMode), RTP=$($s.RealTimeProtectionEnabled))"
+          if ($s.AMRunningMode -notin @('Normal','Passive') -or -not $s.AMServiceEnabled) {
+            throw "Defender engine unavailable (AMRunningMode=$($s.AMRunningMode), AMServiceEnabled=$($s.AMServiceEnabled))"
           }
+          Write-Host "Defender status: AMRunningMode=$($s.AMRunningMode), RTP=$($s.RealTimeProtectionEnabled) - continuing (RTP not required for on-demand scans)."
+
           "MPCMDRUN=$mp" | Out-File -FilePath $env:GITHUB_ENV -Append
           "DEFENDER_SINCE=$(Get-Date -Format o)" | Out-File -FilePath $env:GITHUB_ENV -Append
 

From 204c0d2f2f4f6a043f27712aef9fed8df06edba1 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Sun, 26 Oct 2025 16:19:05 -0500
Subject: [PATCH 60/66] Ensure ClamAV workflow validates EICAR detection

---
 .github/workflows/clam-av.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/clam-av.yml b/.github/workflows/clam-av.yml
index 37b3373f76..5dc864f214 100644
--- a/.github/workflows/clam-av.yml
+++ b/.github/workflows/clam-av.yml
@@ -41,6 +41,15 @@ jobs:
           ls -lh /var/lib/clamav
 
       # Scan extracted bundle so counts reflect actual files
+      - name: Verify ClamAV detects EICAR signature
+        run: |
+          set -e
+          printf 'X5O!P%%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar.com
+          clamscan eicar.com | tee eicar.log
+          grep -q 'eicar.com: Eicar-Test-Signature FOUND' eicar.log
+          grep -q 'Infected files: 1' eicar.log
+          rm -f eicar.com eicar.log
+
       - name: Extract bundle and scan
         run: |
           set -e

From 903121b245aae4d1ce3073a1d2ad63d30fcbb542 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Sun, 26 Oct 2025 16:25:59 -0500
Subject: [PATCH 61/66] Add polling for Defender detections

---
 .github/workflows/windows-defender-scan.yml | 60 +++++++++++++++------
 1 file changed, 45 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 82a81c4134..7d1271cfd5 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -94,23 +94,53 @@ jobs:
           $scanPath  = (Resolve-Path 'scan').Path
           $eicarPath = Join-Path $scanPath 'eicar.txt'  # <-- whichever name you used
 
-          # 1) pull threat history since our marker
-          $all = Get-MpThreatDetection | Where-Object { $_.InitialDetectionTime -ge $since }
-
-          # classifier: EICAR if ThreatName mentions EICAR OR any resource equals our eicar file path
-          function Is-Eicar($d) {
-            try {
-              if ($d.ThreatName -match 'EICAR') { return $true }
-            } catch {}
-            try {
-              if ($d.Resources -and ($d.Resources.Resource | Where-Object { $_ -ieq $eicarPath })) { return $true }
-            } catch {}
-            return $false
+          function Get-Detections {
+            param(
+              [datetime]$Start,
+              [string]$EicarPath
+            )
+
+            $results = Get-MpThreatDetection | Where-Object { $_.InitialDetectionTime -ge $Start }
+
+            $eicarHits = @()
+            $realHits  = @()
+
+            foreach ($item in $results) {
+              $isEicar = $false
+              try {
+                if ($item.ThreatName -match 'EICAR') { $isEicar = $true }
+              } catch {}
+              try {
+                if (-not $isEicar -and $item.Resources -and ($item.Resources.Resource | Where-Object { $_ -ieq $EicarPath })) {
+                  $isEicar = $true
+                }
+              } catch {}
+
+              if ($isEicar) { $eicarHits += $item }
+              if (-not $isEicar) { $realHits += $item }
+            }
+
+            return [pscustomobject]@{ Eicar = $eicarHits; Real = $realHits }
+          }
+
+          # poll (up to 90s) because Defender threat history entries can be delayed
+          $deadline = (Get-Date).AddSeconds(90)
+          $interval = 5
+          $detections = $null
+
+          do {
+            $detections = Get-Detections -Start $since -EicarPath $eicarPath
+            if (($detections.Eicar.Count -gt 0) -or ($detections.Real.Count -gt 0)) { break }
+            if ((Get-Date) -ge $deadline) { break }
+            Start-Sleep -Seconds $interval
+          } while ($true)
+
+          if (-not $detections) {
+            $detections = [pscustomobject]@{ Eicar = @(); Real = @() }
           }
 
-          $eicar = @()
-          $real  = @()
-          foreach ($d in $all) { if (Is-Eicar $d) { $eicar += $d } else { $real += $d } }
+          $eicar = $detections.Eicar
+          $real  = $detections.Real
 
           # 2) (optional) also harvest Defender Operational events for context/evidence
           $events = @()

From 26fb605cc083912a4ff24fdc4933b4fc06934b9c Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Sun, 26 Oct 2025 17:16:19 -0500
Subject: [PATCH 62/66] Add on-demand Defender scan for EICAR verification

---
 .github/workflows/windows-defender-scan.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index 7d1271cfd5..b69d98eca3 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -85,6 +85,14 @@ jobs:
           cmd /c type scan\eicar.txt >NUL
           Start-Sleep -Seconds 3  # give logs a moment
 
+      - name: On-demand scan EICAR file
+        shell: pwsh
+        run: |
+          $scan = (Resolve-Path 'scan').Path
+          $target = Join-Path $scan 'eicar.txt'
+          & "$env:MPCMDRUN" -Scan -ScanType 3 -File $target
+          Start-Sleep -Seconds 3  # allow detection telemetry to flush
+
       # assert detection, but do NOT fail here; report via step output
       - name: Collect detections and set outputs
         id: detect

From a4a83e3288512c2cc31564fbe24b5fa8c1e2ad92 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Sun, 26 Oct 2025 17:17:31 -0500
Subject: [PATCH 63/66] Update .github/workflows/clam-av.yml

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 .github/workflows/clam-av.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/clam-av.yml b/.github/workflows/clam-av.yml
index 37b3373f76..5f957a2b40 100644
--- a/.github/workflows/clam-av.yml
+++ b/.github/workflows/clam-av.yml
@@ -48,7 +48,7 @@ jobs:
           unzip -q bundle/opencode.zip -d scan
           echo "File count in payload: $(find scan -type f | wc -l)"
           clamscan -ri --scan-archive=yes scan | tee clamav.log
-          ! grep -q 'Infected files: [1-9]' clamav.log
+          ! grep -qE 'Infected files: [1-9][0-9]*' clamav.log
 
       - name: Upload scan results
         uses: actions/upload-artifact@v4

From dd01120222b9df543d2ef44608bbeba7e5783e68 Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Sun, 26 Oct 2025 18:28:11 -0500
Subject: [PATCH 64/66] Ensure ClamAV workflow validates EICAR detection

---
 .github/workflows/clam-av.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/clam-av.yml b/.github/workflows/clam-av.yml
index 5dc864f214..693da477e4 100644
--- a/.github/workflows/clam-av.yml
+++ b/.github/workflows/clam-av.yml
@@ -43,9 +43,15 @@ jobs:
       # Scan extracted bundle so counts reflect actual files
       - name: Verify ClamAV detects EICAR signature
         run: |
-          set -e
+          set -euo pipefail
           printf 'X5O!P%%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar.com
-          clamscan eicar.com | tee eicar.log
+          status=0
+          clamscan eicar.com > eicar.log || status=$?
+          cat eicar.log
+          if [ "$status" -ne 1 ]; then
+            echo "ClamAV failed to report the EICAR signature" >&2
+            exit 1
+          fi
           grep -q 'eicar.com: Eicar-Test-Signature FOUND' eicar.log
           grep -q 'Infected files: 1' eicar.log
           rm -f eicar.com eicar.log

From 18f8956eaf7118f7b84db5b5c1b1e2eb1cc56d8c Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Wed, 29 Oct 2025 12:39:06 -0500
Subject: [PATCH 65/66] Adjust Defender EICAR wait

---
 .github/workflows/windows-defender-scan.yml | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/windows-defender-scan.yml b/.github/workflows/windows-defender-scan.yml
index b69d98eca3..1a4d8b5094 100644
--- a/.github/workflows/windows-defender-scan.yml
+++ b/.github/workflows/windows-defender-scan.yml
@@ -74,7 +74,7 @@ jobs:
         shell: pwsh
         run: |
           $scan = (Resolve-Path 'scan').Path
-          $target = Join-Path $scan 'eicar.txt'
+          $target = Join-Path $scan 'eicar.com'
           $p1 = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STAND'
           $p2 = 'ARD-ANTIVIRUS-TEST-FILE!$H+H*'
           Set-Content -LiteralPath $target -Value ($p1+$p2) -NoNewline -Encoding Ascii
@@ -82,16 +82,16 @@ jobs:
       - name: Provoke RTP (force read)
         shell: pwsh
         run: |
-          cmd /c type scan\eicar.txt >NUL
-          Start-Sleep -Seconds 3  # give logs a moment
+          cmd /c type scan\eicar.com >NUL
+          Start-Sleep -Seconds 10  # give logs time to surface
 
       - name: On-demand scan EICAR file
         shell: pwsh
         run: |
           $scan = (Resolve-Path 'scan').Path
-          $target = Join-Path $scan 'eicar.txt'
+          $target = Join-Path $scan 'eicar.com'
           & "$env:MPCMDRUN" -Scan -ScanType 3 -File $target
-          Start-Sleep -Seconds 3  # allow detection telemetry to flush
+          Start-Sleep -Seconds 10  # allow detection telemetry to flush
 
       # assert detection, but do NOT fail here; report via step output
       - name: Collect detections and set outputs
@@ -100,7 +100,7 @@ jobs:
         run: |
           $since     = [datetime]$env:DEFENDER_SINCE
           $scanPath  = (Resolve-Path 'scan').Path
-          $eicarPath = Join-Path $scanPath 'eicar.txt'  # <-- whichever name you used
+          $eicarPath = Join-Path $scanPath 'eicar.com'
 
           function Get-Detections {
             param(
@@ -131,8 +131,8 @@ jobs:
             return [pscustomobject]@{ Eicar = $eicarHits; Real = $realHits }
           }
 
-          # poll (up to 90s) because Defender threat history entries can be delayed
-          $deadline = (Get-Date).AddSeconds(90)
+          # poll (up to 120s) because Defender threat history entries can be delayed
+          $deadline = (Get-Date).AddSeconds(120)
           $interval = 5
           $detections = $null
 

From 8b2060f5941cd67c760b41afe0e49954dc827dea Mon Sep 17 00:00:00 2001
From: Err <foamy125@gmail.com>
Date: Wed, 29 Oct 2025 17:25:45 -0500
Subject: [PATCH 66/66] Allow ClamAV workflow to tolerate EICAR detections

---
 .github/workflows/clam-av.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/clam-av.yml b/.github/workflows/clam-av.yml
index 5bc7b4b766..345a23238b 100644
--- a/.github/workflows/clam-av.yml
+++ b/.github/workflows/clam-av.yml
@@ -58,12 +58,20 @@ jobs:
 
       - name: Extract bundle and scan
         run: |
-          set -e
+          set -euo pipefail
           rm -rf scan && mkdir -p scan
           unzip -q bundle/opencode.zip -d scan
           echo "File count in payload: $(find scan -type f | wc -l)"
           clamscan -ri --scan-archive=yes scan | tee clamav.log
-          ! grep -qE 'Infected files: [1-9][0-9]*' clamav.log
+          if grep -qE 'Infected files: [1-9][0-9]*' clamav.log; then
+            findings=$(grep 'FOUND' clamav.log | grep -v 'Eicar-Test-Signature' || true)
+            if [ -n "${findings}" ]; then
+              echo "Unexpected detections found:" >&2
+              echo "${findings}" >&2
+              exit 1
+            fi
+            echo 'Only EICAR detections observed; continuing.'
+          fi
 
       - name: Upload scan results
         uses: actions/upload-artifact@v4