build: fix the two breaks that keep CI red on main

.github/workflows/ci.yml

@@ -36,6 +36,20 @@ jobs:
         run: bun run build:sdk
 
       - name: Build Freebuff binary
+        # The compiled binary inlines NEXT_PUBLIC_* at build time, so the values
+        # must be present HERE, not only when the binary is run: with an empty
+        # build environment they are baked in as undefined and every later
+        # invocation dies in the env schema (smoke-binary.ts documents the same
+        # contract from the probe side).
+        env:
+          NEXT_PUBLIC_CB_ENVIRONMENT: prod
+          NEXT_PUBLIC_CODEBUFF_APP_URL: https://codebuff.com
+          NEXT_PUBLIC_SUPPORT_EMAIL: support@freebuff.com
+          NEXT_PUBLIC_POSTHOG_API_KEY: phc_public_placeholder
+          NEXT_PUBLIC_POSTHOG_HOST_URL: https://us.i.posthog.com
+          NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY: pk_test_placeholder
+          NEXT_PUBLIC_STRIPE_CUSTOMER_PORTAL: https://billing.stripe.com/p/login/test
+          NEXT_PUBLIC_WEB_PORT: '3000'
         run: bun freebuff/cli/build.ts 0.0.0-ci
 
       - name: Smoke test Freebuff binary

cli/package.json

@@ -41,6 +41,7 @@
     "jimp": "^1.6.0",
     "node-machine-id": "^1.1.12",
     "open": "^10.1.0",
+    "picocolors": "^1.1.1",
     "pino": "9.4.0",
     "react": "^19.0.0",
     "remark-breaks": "^4.0.0",

common/src/types/json.ts

@@ -21,9 +21,16 @@ export const jsonValueSchema: z.ZodType<JSONValue> = z.lazy(() =>
 export const jsonObjectSchema: z.ZodType<JSONObject> = z.lazy(() =>
   z.record(z.string(), jsonValueSchema.optional()),
 )
-export type JSONObject = { [key in string]: JSONValue | undefined }
+/**
+ * JSON as it actually crosses boundaries: read-only. The model SDKs type their
+ * payloads with `Readonly<...>` objects and arrays, and a mutable index
+ * signature does not accept them, so every `providerOptions` assignment was a
+ * type error. Reading is all the CLI does with this data anyway; the one place
+ * that needs a mutable copy builds `Record<string, unknown>` for itself.
+ */
+export type JSONObject = { readonly [key in string]: JSONValue | undefined }
 
 export const jsonArraySchema: z.ZodType<JSONArray> = z.lazy(() =>
   z.array(jsonValueSchema),
 )
-export type JSONArray = JSONValue[]
+export type JSONArray = readonly JSONValue[]

packages/agent-runtime/src/tools/handlers/tool/gravity-index.ts

@@ -16,7 +16,9 @@ import type { Message } from '@codebuff/common/types/messages/codebuff-message'
 import type { AgentState } from '@codebuff/common/types/session-state'
 
 const omitUndefined = (value: Record<string, JSONValue | undefined>) => {
-  const result: JSONObject = {}
+  // Built mutably and returned as `JSONObject`: JSON is read-only on the way
+  // back in, but assembling a new payload needs a writable index here.
+  const result: Record<string, JSONValue | undefined> = {}
   for (const [key, field] of Object.entries(value)) {
     if (field !== undefined) {
       result[key] = field