feat(plugins): migrate F202 Train C1 package runtimes

.github/workflows/contract-ci.yml

@@ -13,16 +13,26 @@ on:
       - 'packages/plugin-contract/**'
       - 'packages/plugin-sdk/**'
       - 'packages/companion/**'
+      - 'packages/connector-dingtalk/**'
+      - 'packages/connector-feishu/**'
+      - 'packages/connector-telegram/**'
+      - 'packages/connector-wecom-agent/**'
+      - 'packages/connector-wecom-bot/**'
+      - 'packages/connector-weixin/**'
+      - 'packages/connector-xiaoyi/**'
+      - 'packages/enterprise-workflow/**'
+      - 'packages/personal-chrome-companion/**'
       - 'packages/feishu-meeting-intake/**'
       - 'packages/video-analysis/**'
+      - 'packages/video-generation/**'
+      - 'packages/wechat-visible-reader/**'
+      - 'packages/weixin-mp/**'
       - 'packages/xiangqi/**'
       - 'packages/genoffice-docx/**'
+      - 'packages/github-operations/**'
+      - 'packages/stackchan/**'
       - 'catalog/**'
-      - 'scripts/fresh-consumer-install.test.mjs'
-      - 'scripts/desktop-window-consumer.test.mjs'
-      - 'scripts/catalog-check.mjs'
-      - 'scripts/catalog-static-package*'
-      - 'scripts/pack-publish-artifact.mjs'
+      - 'scripts/**'
       - 'package.json'
       - '.npmrc'
       - 'pnpm-lock.yaml'
@@ -38,11 +48,33 @@ jobs:
   validate:
     name: Typecheck + Conformance
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
+      # B1 class: a run must test the PR's live head. A push to the wrong
+      # remote (or a head advance after checkout) otherwise leaves a stale
+      # green run readable as "the new head passed".
+      - name: Assert tested HEAD is the PR's live head
+        if: github.event_name == 'pull_request'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          checked_out="$(git rev-parse HEAD)"
+          expected="${{ github.event.pull_request.head.sha }}"
+          if [ "$checked_out" != "$expected" ]; then
+            echo "checkout mismatch: git rev-parse HEAD=$checked_out but PR head is $expected" >&2
+            exit 1
+          fi
+          node scripts/assert-pr-head.mjs \
+            "${{ github.repository }}" \
+            "${{ github.event.pull_request.number }}" \
+            "$expected"
+
       - uses: pnpm/action-setup@v4
         with:
           version: 9
@@ -52,89 +84,24 @@ jobs:
           node-version: ${{ env.ARTIFACT_NODE_VERSION }}
           cache: 'pnpm'
 
-      - name: Verify artifact toolchain
-        run: node packages/plugin-contract/scripts/verify-artifact-toolchain.mjs
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Generated contract freshness
-        run: pnpm --filter @clowder-ai/plugin-contract generate:check
-
-      - name: Typecheck
-        run: pnpm --filter @clowder-ai/plugin-contract typecheck
-
-      - name: Unit tests
-        run: pnpm --filter @clowder-ai/plugin-contract test
-
-      - name: Build
-        run: pnpm --filter @clowder-ai/plugin-contract build
-
-      - name: SDK typecheck
-        run: pnpm --filter @clowder-ai/plugin-sdk typecheck
-
-      - name: SDK unit tests
-        run: pnpm --filter @clowder-ai/plugin-sdk test
-
-      - name: SDK build
-        run: pnpm --filter @clowder-ai/plugin-sdk build
-
-      - name: Desktop window packed consumer
-        run: node --test scripts/desktop-window-consumer.test.mjs
-
-      - name: Companion package consumer
-        run: |
-          pnpm --filter @clowder-ai/companion build
-          pnpm --filter @clowder-ai/companion test
-          pnpm --filter @clowder-ai/companion lint
+      # Local gate replica: `pnpm gate:ci` (scripts/ci-gate.mjs) runs the
+      # artifact-toolchain check, install, and every check through pack:gate
+      # in this job's former order. The workflow delegates to the script so
+      # local pre-push runs and CI cannot drift apart; edit steps there.
+      - name: Local gate (toolchain to pack:gate)
+        run: pnpm gate:ci
 
       - name: Companion browser layout contract
         run: pnpm --filter @clowder-ai/companion exec playwright install --with-deps chromium && pnpm --filter @clowder-ai/companion test:browser
 
-      - name: Feishu intake typecheck
-        run: pnpm --filter @clowder-ai/feishu-meeting-intake typecheck
-
-      - name: Feishu intake tests
-        run: pnpm --filter @clowder-ai/feishu-meeting-intake test
-
-      - name: Feishu intake lint
-        run: pnpm --filter @clowder-ai/feishu-meeting-intake lint
-
-      - name: Feishu intake build
-        run: pnpm --filter @clowder-ai/feishu-meeting-intake build
-
-      - name: Video analysis typecheck
-        run: pnpm --filter @clowder-ai/video-analysis typecheck
-
-      - name: Video analysis tests
-        run: pnpm --filter @clowder-ai/video-analysis test
-
-      - name: Video analysis lint
-        run: pnpm --filter @clowder-ai/video-analysis lint
-
-      - name: Video analysis build
-        run: pnpm --filter @clowder-ai/video-analysis build
-
+      # gate:ci does not cover xiangqi (playwright browser journey is kept
+      # as an explicit step, mirroring main).
       - name: Xiangqi package tests and build
         run: pnpm --filter @clowder-ai/xiangqi test && pnpm --filter @clowder-ai/xiangqi lint && pnpm --filter @clowder-ai/xiangqi build
 
       - name: Xiangqi browser journey
         run: pnpm --filter @clowder-ai/xiangqi test:browser
 
-      - name: GenOffice typecheck and tests
-        run: |
-          pnpm --filter @clowder-ai/genoffice-docx typecheck
-          pnpm --filter @clowder-ai/genoffice-docx test
-
-      - name: Git guards
-        run: pnpm test:guards
-
-      - name: Fresh consumer install
-        run: pnpm test:fresh-consumer
-
-      - name: Machine catalog
-        run: pnpm catalog:check
-
       - name: Loopback fixture typecheck
         run: pnpm --filter @clowder-ai/loopback-fixture-plugin typecheck
 
@@ -151,70 +118,14 @@ jobs:
         run: pnpm --filter @clowder-ai/plugin-contract conformance
 
       - name: Capture exact-head pack evidence
-        working-directory: packages/plugin-contract
         env:
           EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
-          PACK_EVIDENCE_PATH: ${{ runner.temp }}/plugin-contract-pack-evidence.json
-        run: |
-          set -euo pipefail
-          ACTUAL_HEAD_SHA=$(git rev-parse HEAD)
-          export ACTUAL_HEAD_SHA
-          if [[ "$ACTUAL_HEAD_SHA" != "$EXPECTED_HEAD_SHA" ]]; then
-            echo "checkout HEAD mismatch: $ACTUAL_HEAD_SHA != $EXPECTED_HEAD_SHA" >&2
-            exit 1
-          fi
-          if [[ -n "$(git status --porcelain --untracked-files=no)" ]]; then
-            echo "tracked files changed before pack evidence capture" >&2
-            git status --short >&2
-            exit 1
-          fi
-
-          PACK_JSON_PATH="$RUNNER_TEMP/plugin-contract-pack.json"
-          export PACK_JSON_PATH
-          npm pack --json --ignore-scripts --pack-destination "$RUNNER_TEMP" > "$PACK_JSON_PATH"
-          node --input-type=module <<'NODE'
-          import { execFileSync } from 'node:child_process';
-          import { appendFileSync, readFileSync, writeFileSync } from 'node:fs';
-
-          const [artifact] = JSON.parse(readFileSync(process.env.PACK_JSON_PATH, 'utf8'));
-          const stringFields = ['name', 'version', 'filename', 'integrity', 'shasum'];
-          const numberFields = ['size', 'unpackedSize'];
-          for (const field of stringFields) {
-            if (typeof artifact?.[field] !== 'string' || artifact[field].length === 0) {
-              throw new Error(`npm pack did not report ${field}`);
-            }
-          }
-          for (const field of numberFields) {
-            if (!Number.isFinite(artifact?.[field]) || artifact[field] <= 0) {
-              throw new Error(`npm pack did not report ${field}`);
-            }
-          }
-          if (!Array.isArray(artifact?.files) || artifact.files.length === 0) {
-            throw new Error('npm pack did not report files');
-          }
+        run: node scripts/capture-exact-head-pack-evidence.mjs packages/plugin-contract "$RUNNER_TEMP/plugin-contract-pack.json" "$RUNNER_TEMP/plugin-contract-pack-evidence.json" "$EXPECTED_HEAD_SHA"
 
-          const evidence = {
-            headSha: process.env.ACTUAL_HEAD_SHA,
-            name: artifact.name,
-            version: artifact.version,
-            filename: artifact.filename,
-            integrity: artifact.integrity,
-            shasum: artifact.shasum,
-            size: artifact.size,
-            unpackedSize: artifact.unpackedSize,
-            entryCount: artifact.files?.length,
-            toolchain: {
-              node: process.version,
-              npm: execFileSync('npm', ['--version'], { encoding: 'utf8' }).trim(),
-              zlib: process.versions.zlib,
-            },
-          };
-          writeFileSync(process.env.PACK_EVIDENCE_PATH, `${JSON.stringify(evidence, null, 2)}\n`);
-          appendFileSync(
-            process.env.GITHUB_STEP_SUMMARY,
-            `### Exact-head pack evidence\n\n\`\`\`json\n${JSON.stringify(evidence, null, 2)}\n\`\`\`\n`,
-          );
-          NODE
+      - name: Capture exact-head SDK pack evidence
+        env:
+          EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: node scripts/capture-exact-head-pack-evidence.mjs packages/plugin-sdk "$RUNNER_TEMP/plugin-sdk-pack.json" "$RUNNER_TEMP/plugin-sdk-pack-evidence.json" "$EXPECTED_HEAD_SHA"
 
       - name: Verify immutable published package identity
         working-directory: packages/plugin-contract
@@ -282,6 +193,13 @@ jobs:
           path: ${{ runner.temp }}/plugin-contract-pack-evidence.json
           if-no-files-found: error
 
+      - name: Upload exact-head SDK pack evidence
+        uses: actions/upload-artifact@v4
+        with:
+          name: plugin-sdk-pack-evidence-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ runner.temp }}/plugin-sdk-pack-evidence.json
+          if-no-files-found: error
+
   publish:
     name: Publish to npm
     needs: validate
@@ -315,6 +233,27 @@ jobs:
       - name: Build SDK package
         run: pnpm --filter @clowder-ai/plugin-sdk build
 
+      - name: Build connector packages
+        run: |
+          set -euo pipefail
+          for package in \
+            @clowder-ai/connector-telegram \
+            @clowder-ai/connector-dingtalk \
+            @clowder-ai/connector-feishu \
+            @clowder-ai/connector-wecom-agent \
+            @clowder-ai/connector-wecom-bot \
+            @clowder-ai/connector-weixin \
+            @clowder-ai/connector-xiaoyi
+          do
+            pnpm --filter "$package" build
+          done
+
+      - name: Build enterprise workflow package
+        run: pnpm --filter @clowder-ai/enterprise-workflow build
+
+      - name: Build personal Chrome companion package
+        run: pnpm --filter @clowder-ai/personal-chrome-companion build
+
       - name: Build companion package
         run: pnpm --filter @clowder-ai/companion build
 
@@ -324,6 +263,15 @@ jobs:
       - name: Build video analysis package
         run: pnpm --filter @clowder-ai/video-analysis build
 
+      - name: Build video generation package
+        run: pnpm --filter @clowder-ai/video-generation build
+
+      - name: Build Weixin MP package
+        run: pnpm --filter @clowder-ai/weixin-mp build
+
+      - name: Build WeChat visible reader package
+        run: pnpm --filter @clowder-ai/wechat-visible-reader build
+
       - name: Build and verify frozen GenOffice renderer
         run: |
           pnpm --filter @clowder-ai/genoffice-docx build:renderer
@@ -341,6 +289,60 @@ jobs:
           package-directory: packages/plugin-sdk
           npm-token: ${{ secrets.NPM_TOKEN }}
 
+      - name: Publish enterprise workflow prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/enterprise-workflow
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish personal Chrome companion prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/personal-chrome-companion
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish Telegram connector prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/connector-telegram
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish DingTalk connector prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/connector-dingtalk
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish Feishu connector prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/connector-feishu
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish WeCom agent connector prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/connector-wecom-agent
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish WeCom bot connector prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/connector-wecom-bot
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish WeChat Personal connector prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/connector-weixin
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish XiaoYi connector prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/connector-xiaoyi
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
       - name: Publish companion prerelease
         uses: ./.github/actions/publish-prerelease
         with:
@@ -353,6 +355,24 @@ jobs:
           package-directory: packages/video-analysis
           npm-token: ${{ secrets.NPM_TOKEN }}
 
+      - name: Publish video generation prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/video-generation
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish Weixin MP prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/weixin-mp
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish WeChat visible reader prerelease
+        uses: ./.github/actions/publish-prerelease
+        with:
+          package-directory: packages/wechat-visible-reader
+          npm-token: ${{ secrets.NPM_TOKEN }}
+
       - name: Publish GenOffice prerelease
         uses: ./.github/actions/publish-prerelease
         with:

.github/workflows/personal-chrome-companion-ci.yml

@@ -46,6 +46,13 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # Companion typecheck resolves @clowder-ai/plugin-contract / plugin-sdk
+      # through workspace links whose exports point at dist/*.d.ts; a fresh
+      # checkout has no dist until the dependencies are built. Mirrors the
+      # build-deps-first pattern in packages/feishu-meeting-intake.
+      - name: Build contract and SDK dependencies
+        run: pnpm --filter @clowder-ai/plugin-contract build && pnpm --filter @clowder-ai/plugin-sdk build
+
       - name: Companion typecheck
         run: pnpm --filter @clowder-ai/personal-chrome-companion typecheck