fix: harden runtime lifecycle, storage boundaries, and release safety

.github/workflows/ci.yml

@@ -31,5 +31,11 @@ jobs:
       - name: Run TypeScript build
         run: bun run ts:build
 
+      - name: Type-check SDK tests
+        run: bunx tsc -p packages/sdk/tsconfig.test.json --noEmit
+
       - name: Run tests
         run: bun run test
+
+      - name: Run release tooling tests
+        run: bun run test:release

.github/workflows/publish.yml

@@ -12,6 +12,10 @@ permissions:
   id-token: write
   contents: read
 
+concurrency:
+  group: publish-${{ github.repository }}
+  cancel-in-progress: false
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -21,6 +25,9 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Verify release ancestry
+        run: git merge-base --is-ancestor "${{ github.sha }}" origin/main
+
       - uses: actions/setup-node@v4
         with:
           node-version: '24'
@@ -45,8 +52,22 @@ jobs:
       - name: TypeScript build
         run: bun run ts:build
 
+      - name: Type-check SDK tests
+        run: bunx tsc -p packages/sdk/tsconfig.test.json --noEmit
+
+      - name: Run tests
+        run: bun run test
+
+      - name: Run release tooling tests
+        run: bun run test:release
+
       - name: Prepare package manifests
-        run: node ./scripts/npm-publish/prepare-packages.mjs "${{ github.ref_name }}"
+        run: node ./scripts/npm-publish/prepare-packages.mjs "$RELEASE_VERSION"
+        env:
+          RELEASE_VERSION: ${{ github.ref_name }}
+
+      - name: Pack and validate published artifacts
+        run: node ./scripts/npm-publish/pack-and-validate.mjs
 
       - name: Publish NPM
         run: bash ./scripts/npm-publish/run.sh

.gitignore

@@ -93,3 +93,4 @@ buzola.gen.ts
 # jj
 .jj/
 .claude/agent-canvas/
+.smellhunt/

package.json

@@ -7,7 +7,8 @@
 		"ts:watch": "tsc --build --watch",
 		"lint": "biome lint .",
 		"lint:fix": "biome lint . --write",
-		"test": "bun test packages/*/src packages/*/tests"
+		"test": "bun test packages/*/src packages/*/tests",
+		"test:release": "bun test scripts/npm-publish"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "catalog:build",

packages/cli/package.json

@@ -3,6 +3,9 @@
 	"version": "0.1.0",
 	"type": "module",
 	"main": "./dist/main.js",
+	"bin": {
+		"roj-cli": "./dist/main.js"
+	},
 	"files": [
 		"src",
 		"dist"

packages/cli/src/main.ts

@@ -1,3 +1,4 @@
+#!/usr/bin/env bun
 import { SessionId } from '@roj-ai/shared'
 import { RpcError } from '@roj-ai/shared/rpc'
 import { createCliClient } from './client.js'

packages/client-react/package.json

@@ -48,17 +48,16 @@
 		"zustand": "5.0.11"
 	},
 	"devDependencies": {
-		"@roj-ai/sdk": "workspace:*",
 		"@types/react": "19.2.14",
 		"@types/react-dom": "19.2.3",
 		"react": "19.2.4",
 		"react-dom": "19.2.4",
 		"typescript": "5.9.3"
 	},
 	"peerDependencies": {
-		"lucide-react": "*",
-		"react": "19.2.4",
-		"react-dom": "19.2.4"
+		"lucide-react": ">=0.400.0 <1",
+		"react": "^19.0.0",
+		"react-dom": "^19.0.0"
 	},
 	"types": "./dist/index.d.ts"
 }

packages/client/src/platform/index.ts

@@ -33,5 +33,10 @@ export type { BuildPreviewUrlOptions, BuildWsUrlOptions } from './urls.js'
 export { createRojClient } from './rest-client.js'
 export type { RojClient, RojClientOptions, SessionRpcInput } from './rest-client.js'
 
+// File upload wire contract — shared with @roj-ai/platform-cli, which posts to
+// the same /api/v1/files/upload endpoint against a server outside this repo.
+export { postFile, sha256Hex } from './rest-client.js'
+export type { PostFileArgs, PostFileResult } from './rest-client.js'
+
 // Errors
 export { RojApiError } from './errors.js'

packages/client/src/platform/rest-client.ts

@@ -240,7 +240,7 @@ export function createRojClient(options: RojClientOptions): RojClient {
 	}
 }
 
-interface PostFileArgs {
+export interface PostFileArgs {
 	url: string
 	apiKey: string
 	contentHash: string
@@ -249,7 +249,7 @@ interface PostFileArgs {
 	body?: Blob
 }
 
-interface PostFileResult {
+export interface PostFileResult {
 	status: number
 	body: {
 		ok?: boolean
@@ -263,7 +263,7 @@ interface PostFileResult {
 	} | null
 }
 
-async function postFile(args: PostFileArgs): Promise<PostFileResult> {
+export async function postFile(args: PostFileArgs): Promise<PostFileResult> {
 	const formData = new FormData()
 	formData.append('contentHash', args.contentHash)
 	formData.append('filename', args.filename)
@@ -280,7 +280,7 @@ async function postFile(args: PostFileArgs): Promise<PostFileResult> {
 	return { status: response.status, body }
 }
 
-async function sha256Hex(buf: ArrayBuffer): Promise<string> {
+export async function sha256Hex(buf: ArrayBuffer): Promise<string> {
 	const digest = await crypto.subtle.digest('SHA-256', buf)
 	const bytes = new Uint8Array(digest)
 	let hex = ''

packages/debug/package.json

@@ -31,22 +31,22 @@
 	},
 	"dependencies": {
 		"@roj-ai/client": "workspace:*",
+		"@roj-ai/sdk": "workspace:*",
 		"@roj-ai/shared": "workspace:*",
 		"tokenx": "1.3.0",
 		"zustand": "5.0.11"
 	},
 	"devDependencies": {
-		"@roj-ai/sdk": "workspace:*",
 		"@types/react": "19.2.14",
 		"@types/react-dom": "19.2.3",
 		"react": "19.2.4",
 		"react-dom": "19.2.4",
 		"typescript": "5.9.3"
 	},
 	"peerDependencies": {
-		"lucide-react": "*",
-		"react": "19.2.4",
-		"react-dom": "19.2.4"
+		"lucide-react": ">=0.400.0 <1",
+		"react": "^19.0.0",
+		"react-dom": "^19.0.0"
 	},
 	"types": "./dist/index.d.ts"
 }

packages/debug/src/components/debug/ResumeAgentButton.tsx

@@ -0,0 +1,48 @@
+import { api, unwrap } from "@roj-ai/client";
+import { AgentId } from "@roj-ai/shared";
+import { type FormEvent, useCallback, useState } from "react";
+
+/**
+ * Resume a paused agent. Shared by DashboardPage and AgentDetailPage, which
+ * each carried a byte-identical copy.
+ */
+export function ResumeAgentButton({
+	sessionId,
+	agentId,
+}: {
+	sessionId: string;
+	agentId: string;
+}) {
+	const [resuming, setResuming] = useState(false);
+
+	const handleResume = useCallback(
+		async (e: FormEvent) => {
+			e.stopPropagation();
+			setResuming(true);
+			try {
+				unwrap(
+					await api.call("agents.resume", {
+						sessionId,
+						agentId: AgentId(agentId),
+					}),
+				);
+			} catch {
+				// Error is visible via state change (or lack thereof)
+			} finally {
+				setResuming(false);
+			}
+		},
+		[sessionId, agentId],
+	);
+
+	return (
+		<button
+			type="button"
+			onClick={handleResume}
+			disabled={resuming}
+			className="text-[11px] font-semibold text-white bg-red-600 hover:bg-red-700 px-2.5 py-1 rounded-lg disabled:opacity-50 disabled:cursor-not-allowed transition-colors shrink-0 cursor-pointer"
+		>
+			{resuming ? "Resuming..." : "Resume"}
+		</button>
+	);
+}