[stack 1/8] ci: harden verification and release compatibility

[sethkarten]

Stack 1/8 — ci: harden verification and release compatibility

Active review snapshot — do not merge yet. The complete stack is open for architecture/design review, while final cumulative audit, CI, Cursor Bug Bot, and Macroscope findings are being remediated. Branches will be force-updated after validation.

Base: main
Review order: merge only after the preceding stack layer is accepted. This PR is not intended to merge independently out of order.

Stack navigation

1. #1158 — ci: harden verification and release compatibility
2. #1159 — fix(security): harden session and autonomous execution boundaries
3. #1160 — fix(coding-agent): make persisted state crash-safe
4. #1161 — fix(daemon): fence worker and supervisor lifecycle state
5. #1162 — fix(coding-agent): repair queued and archived session lifecycle
6. #1163 — fix(coding-agent): complete Windows kernel and daemon startup
7. #1164 — fix(providers): harden MCP OAuth and Codex transports
8. #1165 — fix(runtime): bound transcript and autonomous recovery

Summary

• Gate PRs and releases on the locked Python runtime suite across Python 3.10–3.14.
• Verify the complete emitted node-only provider bundle closure, including Bedrock.
• Support npm 12 remote-dependency policy with accurate interactive consent and a real local-HTTP regression.

Validation

• npm run check; targeted installer/release suites; real npm 12 policy smoke; Python 3.10–3.14 locked runtime suites; release pack smoke.
• Residual/non-blocking: npm12 transitive scripts warnings; broader fix: npm 10+ compatibility across the update and install surfaces #773 TUI/update routing not included

Provenance

• Authored independently from upstream/main using issue reports and PR descriptions/comments only.
• No external contributor branch, diff, commit, implementation code, or test code was fetched, inspected, copied, or reused.
• The implementation and regression tests in this stack are maintainer-owned.

Linked-item disposition

Fixed on merge

• Fixes Run Python runtime tests in CI #945 — Run Python runtime tests in CI
• Fixes v0.7.0 & v0.7.1 release tarball is missing dist/bundle/amazon-bedrock.js, breaking the amazon-bedrock provider #751 — v0.7.0 & v0.7.1 release tarball is missing dist/bundle/amazon-bedrock.js, breaking the amazon-bedrock provider
• Fixes install fails on npm 12+ due to allow-remote=none #741 — install fails on npm 12+ due to allow-remote=none

Independently superseded pull requests

• ci: run Python runtime tests in CI (#945) #1018 (open) — ci: run Python runtime tests in CI (Run Python runtime tests in CI #945) — will be closed with a pointer to this independently authored PR
• fix(coding-agent): emit the Bedrock provider into the CLI bundle #1085 (open) — fix(coding-agent): emit the Bedrock provider into the CLI bundle — will be closed with a pointer to this independently authored PR

Partial/distinct overlap — remains open

• fix(ai): declare Smithy dependencies used by Bedrock #1013 — fix(ai): declare Smithy dependencies used by Bedrock
• fix: npm 10+ compatibility across the update and install surfaces #773 — fix: npm 10+ compatibility across the update and install surfaces

Related reports — no closure claim

• /update --extensions always fails with "Update exited with code 1"; update-available notice is a false positive on npm >= 11 #738 — /update --extensions always fails with "Update exited with code 1"; update-available notice is a false positive on npm >= 11
• Installer gives unsupported npm bin -g PATH instructions on npm 10+ #749 — Installer gives unsupported npm bin -g PATH instructions on npm 10+
• packages/coding-agent: track official Homebrew core submission readiness #843 — packages/coding-agent: track official Homebrew core submission readiness

Distinct follow-up — remains open

• fix(installer): isolate npm tarball install prefix #1129 — fix(installer): isolate npm tarball install prefix
• fix installer fallback for protected npm prefixes #706 — fix installer fallback for protected npm prefixes
• fix(coding-agent): keep Homebrew installs package-manager owned #857 — fix(coding-agent): keep Homebrew installs package-manager owned

Reviewer notes

• Please review this layer against its immediate stack base, not against main, to avoid cumulative duplicate diffs.
• No merge is requested; the complete stack is being left for human review.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a1d2e83. Configure here.}

[cursor]

PATH hint expands too early

Medium Severity

The PATH recovery hint uses an unquoted heredoc, so $(npm prefix -g) runs while the installer prints the message instead of remaining a command for the user. That replaces the intended npm bin -g substitute with an already-expanded echo "/some/path" line, which makes the “check with” instructions misleading right when the binary is missing from PATH.

 

^{Reviewed by Cursor Bugbot for commit a1d2e83. Configure here.}