fix: restore green main, and add the CI that would have caught it

.github/workflows/ci.yml

@@ -0,0 +1,62 @@
+name: CI
+
+# build-artifacts.yml is workflow_dispatch-only and builds without testing, so
+# nothing ran on a pull request. That is how 4d63d75 landed on main having
+# deleted three imported assets: `go vet` stays clean, and only a build or a
+# test run reaches those paths.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  go:
+    name: Go
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - run: go vet ./...
+
+      # -race because the write coordination lock in internal/app is the kind of
+      # thing a plain run will not exercise.
+      - run: go test -race ./...
+
+  frontend:
+    name: Frontend
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11.17.0
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 26
+          cache: pnpm
+          cache-dependency-path: frontend/pnpm-lock.yaml
+
+      - name: Install dependencies
+        working-directory: frontend
+        run: pnpm install --frozen-lockfile
+
+      - name: Test
+        working-directory: frontend
+        run: pnpm run test
+
+      # Runs tsc --noEmit before vite, so a type error fails here rather than in
+      # a release build. This is the step that would have caught 4d63d75.
+      - name: Build
+        working-directory: frontend
+        run: pnpm run build

agents.lock.json

@@ -132,6 +132,45 @@
         "windows"
       ],
       "rank": 5
+    },
+    "cursor": {
+      "name": "Cursor",
+      "group": "platform",
+      "command": "cursor",
+      "config_mode": "guide",
+      "platforms": [
+        "macos",
+        "linux",
+        "windows"
+      ],
+      "guide": "Use Cursor subscription or official account settings; OneAgent does not write a private Cursor configuration.",
+      "rank": 6
+    },
+    "openclaw": {
+      "name": "OpenClaw",
+      "group": "gateway",
+      "command": "openclaw",
+      "config_mode": "guide",
+      "platforms": [
+        "macos",
+        "linux",
+        "windows"
+      ],
+      "guide": "Install from OpenClaw docs, then run: openclaw onboard --install-daemon && openclaw gateway status",
+      "rank": 7
+    },
+    "hermes": {
+      "name": "Hermes",
+      "group": "gateway",
+      "command": "hermes",
+      "config_mode": "guide",
+      "platforms": [
+        "macos",
+        "linux",
+        "windows"
+      ],
+      "guide": "Install Hermes, then configure models with hermes model or ~/.hermes/config.yaml.",
+      "rank": 8
     }
   }
 }

internal/app/settings_test.go

@@ -342,11 +342,19 @@ type countingRunner struct {
 	runs int
 }
 
-func (r *countingRunner) Run(ctx context.Context, argv []string, env map[string]string, timeout time.Duration) (process.Result, error) {
+// Answers the probe itself rather than delegating to a real process. Delegating
+// made the result depend on the host: the caller simulates macOS, so the argv is
+// `defaults read -g AppleLocale`, which succeeds on a developer's Mac and is not
+// a command at all on Linux. A probe that cannot run reports "unanswered" and is
+// retried by design, so on Linux the count was 5 rather than 1 -- the assertion
+// failed while the caching it describes was working correctly.
+func (r *countingRunner) Run(context.Context, []string, map[string]string, time.Duration) (process.Result, error) {
 	r.runs++
-	return r.Runner.Run(ctx, argv, env, timeout)
+	return process.Result{ExitCode: 0, Stdout: "en_US\n"}, nil
 }
 
+func (r *countingRunner) LookPath(string) (string, bool) { return "", false }
+
 // The same preference has to reach npm, not just the runtime download. The fake
 // runner records every environment, so the assertion is the registry npm was
 // actually pointed at.