[integration] big-agents

.agents/skills/agenta-package-practices/SKILL.md

@@ -134,6 +134,8 @@ via `ModalFooter`, theme integration.
 
 ## Style utilities and presentational components
 
+When adding or changing UI elements, implement appearance and interaction states for both light and dark themes, and verify both before considering the work complete.
+
 ```typescript
 import {cn, textColors, bgColors} from "@agenta/ui"
 

.github/workflows/12-check-unit-tests.yml

@@ -316,3 +316,194 @@ jobs:
           files: services/oss/tests/results/junit.xml
           check_name: Application services Unit Test Results
           comment_mode: off
+
+  run-runner-tests:
+    # The agent runner (services/runner) is a standalone Node/pnpm package, not part of the
+    # Python services suite above. It runs its own vitest unit tests plus a tsc typecheck gate.
+    # No "has_tests" guard on purpose: this suite is established, so a missing/empty suite must
+    # FAIL the job (vitest exits non-zero on no test files), not silently skip it.
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      pull-requests: write
+      contents: read
+    env:
+      AGENTA_LICENSE: oss
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Skip when package selection excludes services
+        if: github.event_name == 'workflow_dispatch' && !contains(fromJSON('["all","services-only"]'), inputs.packages)
+        run: exit 0
+
+      - name: Set up Node.js
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Enable Corepack
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        run: corepack enable
+
+      - name: Cache pnpm store
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        uses: actions/cache@v4
+        with:
+          path: ~/.pnpm-store
+          key: ${{ runner.os }}-runner-pnpm-${{ hashFiles('services/runner/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-runner-pnpm-
+
+      - name: Set up pnpm store
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        working-directory: services/runner
+        run: pnpm config set store-dir ~/.pnpm-store
+
+      - name: Install dependencies
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        working-directory: services/runner
+        run: pnpm install --frozen-lockfile
+
+      - name: Typecheck (tsc --noEmit, src + tests + config)
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        working-directory: services/runner
+        run: pnpm run typecheck
+
+      # The code-tool unit test spawns python3 and node end-to-end; both are preinstalled on
+      # ubuntu runners (node is also set up above), so no setup-python step is needed.
+      - name: Run agent runner unit tests
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        working-directory: services/runner
+        run: pnpm run test:unit
+
+      - name: Publish agent runner unit test results
+        if: always() && (github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages))
+        uses: EnricoMi/publish-unit-test-result-action@v2
+        with:
+          files: services/runner/tests/results/junit-unit.xml
+          check_name: Agent Runner Unit Test Results
+          comment_mode: off
+
+  run-runner-integration-tests:
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      pull-requests: write
+      contents: read
+    env:
+      AGENTA_LICENSE: oss
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Skip when package selection excludes services
+        if: github.event_name == 'workflow_dispatch' && !contains(fromJSON('["all","services-only"]'), inputs.packages)
+        run: exit 0
+
+      - name: Set up Node.js
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Enable Corepack
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        run: corepack enable
+
+      - name: Cache pnpm store
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        uses: actions/cache@v4
+        with:
+          path: ~/.pnpm-store
+          key: ${{ runner.os }}-runner-pnpm-${{ hashFiles('services/runner/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-runner-pnpm-
+
+      - name: Set up pnpm store
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        working-directory: services/runner
+        run: pnpm config set store-dir ~/.pnpm-store
+
+      - name: Install dependencies
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        working-directory: services/runner
+        run: pnpm install --frozen-lockfile
+
+      - name: Run agent runner integration tests
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        working-directory: services/runner
+        run: pnpm run test:integration
+
+      - name: Publish agent runner integration test results
+        if: always() && (github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages))
+        uses: EnricoMi/publish-unit-test-result-action@v2
+        with:
+          files: services/runner/tests/results/junit-integration.xml
+          check_name: Agent Runner Integration Test Results
+          comment_mode: off
+
+  run-runner-acceptance-tests:
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    permissions:
+      checks: write
+      pull-requests: write
+      contents: read
+    env:
+      AGENTA_LICENSE: oss
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Skip when package selection excludes services
+        if: github.event_name == 'workflow_dispatch' && !contains(fromJSON('["all","services-only"]'), inputs.packages)
+        run: exit 0
+
+      - name: Set up Node.js
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Enable Corepack
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        run: corepack enable
+
+      - name: Cache pnpm store
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        uses: actions/cache@v4
+        with:
+          path: ~/.pnpm-store
+          key: ${{ runner.os }}-runner-pnpm-${{ hashFiles('services/runner/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-runner-pnpm-
+
+      - name: Set up pnpm store
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        working-directory: services/runner
+        run: pnpm config set store-dir ~/.pnpm-store
+
+      - name: Install dependencies
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        working-directory: services/runner
+        run: pnpm install --frozen-lockfile
+
+      - name: Run agent runner acceptance tests
+        if: github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages)
+        working-directory: services/runner
+        run: pnpm run test:acceptance
+
+      - name: Publish agent runner acceptance test results
+        if: always() && (github.event_name != 'workflow_dispatch' || contains(fromJSON('["all","services-only"]'), inputs.packages))
+        uses: EnricoMi/publish-unit-test-result-action@v2
+        with:
+          files: services/runner/tests/results/junit-acceptance.xml
+          check_name: Agent Runner Acceptance Test Results
+          comment_mode: off

.github/workflows/42-railway-build.yml

@@ -109,6 +109,7 @@ jobs:
           - agenta-api
           - agenta-web
           - agenta-services
+          - agenta-runner
         arch:
           - amd64
           - arm64
@@ -127,6 +128,9 @@ jobs:
           - image_name: agenta-services
             context: .
             dockerfile: services/oss/docker/Dockerfile.gh
+          - image_name: agenta-runner
+            context: services/runner
+            dockerfile: services/runner/docker/Dockerfile
           # Per-arch config (runner + platform string)
           - arch: amd64
             runner: ubuntu-24.04
@@ -215,6 +219,7 @@ jobs:
           - agenta-api
           - agenta-web
           - agenta-services
+          - agenta-runner
     steps:
       - name: Log in to GHCR
         uses: docker/login-action@v3

.github/workflows/43-railway-deploy.yml

@@ -94,6 +94,7 @@ jobs:
           SENDGRID_API_KEY: ${{ secrets.AGENTA_TEST_OSS_SENDGRID_API_KEY }}
           COMPOSIO_API_KEY: ${{ secrets.AGENTA_TEST_OSS_COMPOSIO_API_KEY }}
           DAYTONA_API_KEY: ${{ secrets.AGENTA_TEST_OSS_DAYTONA_API_KEY }}
+          DAYTONA_API_KEY: ${{ secrets.AGENTA_TEST_OSS_DAYTONA_API_KEY }}
           RAILWAY_POST_BOOTSTRAP_SLEEP: "2"
           RAILWAY_INFRA_SETTLE_SECONDS: "20"
           RAILWAY_APP_SETTLE_SECONDS: "0"

.gitignore

@@ -12,6 +12,10 @@
 **/*dont_commit_me*
 web/packages/agenta-api-client/dist/
 web/tsconfig.tsbuildinfo
+# Agent Pi extension bundle, built by `pnpm run build:extension` and in the Docker image.
+services/runner/dist/
+# Agent runner test/coverage artifacts (vitest writes these on `pnpm test` / coverage runs).
+services/runner/coverage/
 
 __pycache__/
 **/__pycache__/
@@ -63,6 +67,7 @@ sdks/python/oss/tests/results/
 sdks/python/ee/tests/results/
 services/oss/tests/results/
 services/ee/tests/results/
+services/runner/tests/results/
 .*
 !**/.gitkeep
 !.github/

.gitleaks.toml

@@ -18,6 +18,13 @@ paths = [
   '''^.*/\.next/.*''',
   # -------------------------------------------------------------- ALL ENV FILES
   '''^.*\.env.*$''',
+  # -------------------------------------------------- LOCAL-DEV STORE FALLBACK KEY
+  # webidentity.py ships a hardcoded RSA key used ONLY as the local-dev fallback for
+  # signing the object-store's web-identity token (production setups must set
+  # AGENTA_STORE_JWT_PRIVATE_KEY or must not use it).
+  # IT IS NOT A REAL SECRET — it only signs throwaway dev store creds.
+  # See the comment there.
+  '''^api/oss/src/core/store/webidentity\.py$''',
   # ----------------------------------------------------------------------------
 ]
 regexes = [
@@ -32,6 +39,10 @@ regexes = [
   '''phc_CwyyDlHGNnRFptVWhTe0HOeKnq1jeOZNk9hduYiOClp''',  # POSTHOG
   '''phc_qH8GezjMAeToR9ygdsnTH0C9c2njhO7CFqf66pTUX7H''',  # POSTHOG
   '''18ab633e81d706cbda7c78d25d0fe763''',                 # ALGOLIA
+  # ------------------------------------------------- LOCAL-DEV STORE SIGNING KEY
+  # Dummy SeaweedFS STS signing key shown (commented) as a format hint in the dev
+  # env examples. Decodes to "this-is-a-signing-key-for-mounts" — not a real secret.
+  '''dGhpcy1pcy1hLXNpZ25pbmcta2V5LWZvci1tb3VudHM=''',
   # ----------------------------------------------------------------------------
 ]
 

.gitleaksignore

@@ -286,3 +286,6 @@ a00f015276504fbf7a4820b26d17eb725c63635b:bench_bulk_insert.py:generic-api-key:30
 70b9ab08f0f2c96f78ea436691ea161958ff9f18:docs/design/evaluation-runtime-heartbeats/README.md:generic-api-key:234
 70b9ab08f0f2c96f78ea436691ea161958ff9f18:docs/design/evaluation-runtime-heartbeats/plan.md:generic-api-key:46
 70b9ab08f0f2c96f78ea436691ea161958ff9f18:docs/design/evaluation-runtime-heartbeats/plan.md:generic-api-key:58
+607ab14c7c9b7b0b7d277da79c0da22bb0b3cddc:docs/design/agent-workflows/qa/scripts/mcp_qa_server.mjs:generic-api-key:13
+0ab95c73ed4e993b69081805d1db96dbcc052653:docs/design/agent-workflows/projects/qa/scripts/mcp_qa_server.mjs:generic-api-key:13
+0ab95c73ed4e993b69081805d1db96dbcc052653:docs/design/agent-workflows/projects/qa/scripts/mcp_qa_server.mjs:generic-api-key:13