ci: add test workflow for PR gate

.dockerignore

@@ -0,0 +1,23 @@
+node_modules
+node_modules/
+*/node_modules
+*/node_modules/
+*/*/node_modules
+*/*/node_modules/
+*/*/*/node_modules
+*/*/*/node_modules/
+.git/
+.git
+dist/
+dist
+.vite/
+.vite
+*.tsbuildinfo
+*.log
+.env
+.env.local
+.DS_Store
+loopat-data/
+loopat-data
+server/src/*.js
+server/src/*.js.map

.github/workflows/ci.yml

@@ -0,0 +1,20 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install
+      - run: cd server && bun test

.github/workflows/docker.yml

@@ -0,0 +1,52 @@
+name: Publish Docker image
+
+# Build and push the Docker image to GHCR on a version tag (same v* tags
+# that trigger the npm publish). Manually runnable via workflow_dispatch.
+#
+# Uses the built-in GITHUB_TOKEN — no extra secret needed. The image lands
+# at ghcr.io/<owner>/<repo>, e.g. ghcr.io/simpx/loopat.
+
+# Opt all JS actions into the Node 24 runtime (Node 20 is deprecated).
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=raw,value=latest
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: false

.github/workflows/publish.yml

@@ -0,0 +1,40 @@
+name: Publish to npm
+
+# Publish loopat to npm when a version tag is pushed.
+#
+# Release flow:
+#   npm version patch          # bumps package.json, commits, tags vX.Y.Z
+#   git push origin main --tags
+#
+# Setup (one time): add the npm Automation token (bypasses 2FA) as a repo
+# secret named NPM_TOKEN — Settings -> Secrets and variables -> Actions.
+
+# Opt all JS actions into the Node 24 runtime (Node 20 is deprecated).
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - uses: actions/checkout@v5
+
+      # Bun is needed to build web/dist (vite) during prepublishOnly.
+      - uses: oven-sh/setup-bun@v2
+
+      # Node provides npm and wires NODE_AUTH_TOKEN into the registry.
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      # prepublishOnly runs `bun install && bun run build:web` for us.
+      - run: npm publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/sandbox-image.yml

@@ -0,0 +1,72 @@
+name: Publish sandbox image to GHCR
+
+# Build the loopat sandbox base image and push it to GHCR so end users pull a
+# ready 700MB+ image instead of apt-installing ~150 packages over a flaky China
+# mirror at first run. Tagged by the Containerfile content hash (must match
+# baseContainerfileHash() in server/src/podman.ts) so loopat can pull the exact
+# image its Containerfile describes; also tagged :<version> and :latest.
+#
+# Multi-arch (amd64 + arm64): macs are arm64, most linux servers amd64. The
+# arm64 leg builds under QEMU emulation — slow (apt + mise can take 10-20 min),
+# but this only runs at release time.
+#
+# One-time setup: after the first successful run, make the GHCR package PUBLIC
+# (GitHub -> repo -> Packages -> loopat-sandbox -> Package settings -> Change
+# visibility -> Public). Anonymous pulls fail until then, and loopat silently
+# falls back to a local build.
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+env:
+  IMAGE: ghcr.io/${{ github.repository_owner }}/loopat-sandbox
+
+jobs:
+  publish-sandbox:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compute Containerfile content hash
+        id: hash
+        run: |
+          cd server/templates/sandbox
+          # Must match baseContainerfileHash(): sha256(Containerfile || loopat-host), first 16 hex.
+          H=$(cat Containerfile loopat-host | sha256sum | cut -c1-16)
+          echo "hash=$H" >> "$GITHUB_OUTPUT"
+          echo "sandbox content hash: $H"
+
+      - name: Derive version tag
+        id: ver
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: echo "version=${REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push (amd64 + arm64)
+        uses: docker/build-push-action@v6
+        with:
+          context: server/templates/sandbox
+          file: server/templates/sandbox/Containerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          provenance: false
+          tags: |
+            ${{ env.IMAGE }}:${{ steps.hash.outputs.hash }}
+            ${{ env.IMAGE }}:${{ steps.ver.outputs.version }}
+            ${{ env.IMAGE }}:latest

.gitignore

@@ -1,15 +1,43 @@
-# Nested repos with their own histories
-claw-code/
-loop/
-opencode/
-loopat-ts/
+node_modules/
+dist/
+.vite/
+.run/
+.env
+.env.local
+*.log
+.DS_Store
+bun.lock
+*.tsbuildinfo
+test-results/
+playwright-report/
+e2e/.auth.json
+e2e/.test-meta.json
+dogfood/.auth.json
+dogfood/.test-meta.json
+dogfood/first-run/.test-meta.json
+dogfood/sync/.test-meta.json
+dogfood/sync/.authA.json
+dogfood/sync/.authB.json
+server/src/*.js
+server/src/*.js.map
+
+# Rust
+**/target/
+
+# Python
+__pycache__/
+*.pyc
 
 # Editor swap / temp files
 .*.swp
 .*.swo
 *~
 
-# JS build artifacts
-node_modules/
-dist/
-.vite/
+# Misc
+*.tmp
+
+# Internal git-host provider extension + its installer — NOT open-source.
+# They carry internal hosts/URLs and are distributed out-of-band (OSS), so they
+# must never land in this repo. (Drop into LOOPAT_HOME/extensions/providers/.)
+/code.ts
+/install.sh

CLA.md

@@ -0,0 +1,114 @@
+# loopat Individual Contributor License Agreement
+
+Thank you for your interest in contributing to loopat (the "Project"),
+maintained by simpx ("we", "us", or the "Project Maintainer").
+
+This Contributor License Agreement ("Agreement") sets out the terms under
+which You ("You" or "Contributor") license Your Contributions to us. It is
+modeled on the [Apache Software Foundation Individual CLA v2.2][apache-icla]
+and uses the same definitions and structure, simplified for an
+individual-maintainer project that may, in the future, transfer ownership to
+a successor entity (such as a company or foundation).
+
+By submitting a Contribution to the Project (for example, by opening a
+pull request on GitHub and signing the CLA via [CLA Assistant][cla-assistant]),
+You accept and agree to the following terms for Your present and future
+Contributions.
+
+[apache-icla]: https://www.apache.org/licenses/contributor-agreements.html
+[cla-assistant]: https://cla-assistant.io/
+
+---
+
+## 1. Definitions
+
+- **"You"** means the individual who Submits a Contribution to Us.
+- **"Contribution"** means any original work of authorship, including any
+  modifications or additions to existing work, that You intentionally Submit
+  to Us for inclusion in the Project.
+- **"Submit"** means any form of communication sent to Us or our
+  representatives — including but not limited to pull requests, patches,
+  issues, mailing lists, and chat — for the purpose of discussing or
+  improving the Project, except communication that You conspicuously mark
+  as "Not a Contribution".
+- **"Successor"** means any individual or legal entity to whom We assign or
+  transfer ownership of the Project, in whole or in part. The rights granted
+  in this Agreement extend to Us and any Successor.
+
+## 2. Grant of Copyright License
+
+You grant to Us and to any Successor a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable copyright license to reproduce, prepare
+derivative works of, publicly display, publicly perform, sublicense, and
+distribute Your Contributions and such derivative works **under any license
+terms We choose**, including but not limited to the Apache License 2.0 and
+any later commercial, copyleft, or source-available license.
+
+This sublicensing right is the key purpose of this Agreement: it allows Us
+(or any Successor) to relicense the Project as a whole in the future without
+having to re-collect permission from every Contributor.
+
+## 3. Grant of Patent License
+
+You grant to Us, to any Successor, and to recipients of the Project
+distributed by Us, a perpetual, worldwide, non-exclusive, no-charge,
+royalty-free, irrevocable (except as stated in this section) patent license
+to make, have made, use, offer to sell, sell, import, and otherwise transfer
+the Project. This license applies only to those patent claims licensable by
+You that are necessarily infringed by Your Contribution alone or by
+combination of Your Contribution with the Project.
+
+If any entity institutes patent litigation against You or any other entity
+(including a cross-claim or counterclaim in a lawsuit) alleging that Your
+Contribution, or the Project to which You have Contributed, constitutes
+direct or contributory patent infringement, then any patent licenses
+granted to that entity under this Agreement for that Contribution or
+Project shall terminate as of the date such litigation is filed.
+
+## 4. You Are Legally Entitled to Grant These Licenses
+
+You represent that:
+
+- Each of Your Contributions is Your original creation, **or**
+- Your Contribution includes complete details of any third-party license or
+  other restriction (including, but not limited to, related patents and
+  trademarks) of which You are personally aware and which are associated
+  with any part of Your Contribution.
+- If Your employer has rights to intellectual property You create that
+  includes Your Contributions, You have received permission to make
+  Contributions on behalf of that employer, or Your employer has waived such
+  rights for Your Contributions to the Project.
+
+## 5. No Warranty
+
+You provide Your Contributions on an "AS IS" basis, without warranties or
+conditions of any kind, either express or implied, including, without
+limitation, any warranties of title, non-infringement, merchantability, or
+fitness for a particular purpose. You are not expected to provide support
+for Your Contributions, except to the extent You desire to provide support.
+
+## 6. Notification of Changes
+
+You agree to notify Us of any facts or circumstances of which You become
+aware that would make the representations in Section 4 inaccurate in any
+respect.
+
+## 7. Public Record
+
+You acknowledge that We will publicly record the fact that You have signed
+this Agreement (typically via [CLA Assistant][cla-assistant]) alongside
+Your GitHub username, so that other Contributors and users can verify that
+Your Contributions are properly licensed.
+
+---
+
+## How to sign
+
+Open any pull request against <https://github.com/simpx/loopat>. The
+CLA Assistant bot will comment with a one-click link to sign this
+Agreement. Once signed, all Your present and future Contributions to the
+Project are covered — You only need to sign once.
+
+If You prefer, You may also sign by sending an email to
+**simpxx@gmail.com** with the subject `loopat CLA: <your-github-username>`
+and the text "I agree to the loopat CLA, version 1.0" in the body.