merge: sync dev into main

# Conflicts:
#	package.json

Author: 777genius

.github/workflows/release.yml

@@ -166,10 +166,10 @@ jobs:
         include:
           - arch: arm64
             runner: macos-14
-            dist_command: pnpm dist:mac:arm64
+            dist_command: pnpm pack:mac:arm64
           - arch: x64
             runner: macos-15-intel
-            dist_command: pnpm dist:mac:x64
+            dist_command: pnpm pack:mac:x64
     runs-on: ${{ matrix.runner }}
 
     steps:
@@ -206,32 +206,18 @@ jobs:
           VERSION="${GITHUB_REF#refs/tags/v}"
           pnpm pkg set version="$VERSION"
 
-      - name: Resolve runtime asset name (macOS ${{ matrix.arch }})
-        if: startsWith(github.ref, 'refs/tags/v')
-        id: runtime-asset
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [[ "${{ matrix.arch }}" == "arm64" ]]; then
-            platform="darwin-arm64"
-          else
-            platform="darwin-x64"
-          fi
-          echo "asset_name=$(node ./scripts/runtime-lock.mjs asset-name "$platform")" >> "$GITHUB_OUTPUT"
-
       - name: Stage bundled runtime (macOS ${{ matrix.arch }})
-        if: startsWith(github.ref, 'refs/tags/v')
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: bash
         run: |
           set -euo pipefail
-          TAG="${GITHUB_REF#refs/tags/}"
-          rm -rf .runtime-download resources/runtime
-          mkdir -p .runtime-download resources/runtime
-          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern "${{ steps.runtime-asset.outputs.asset_name }}" --dir .runtime-download
-          tar -xzf ".runtime-download/${{ steps.runtime-asset.outputs.asset_name }}" -C .runtime-download
-          cp -R .runtime-download/runtime/. resources/runtime/
+          if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
+            TAG="${GITHUB_REF#refs/tags/}"
+            node ./scripts/stage-runtime.mjs --platform "darwin-${{ matrix.arch }}" --release-tag "$TAG"
+          else
+            node ./scripts/stage-runtime.mjs --platform "darwin-${{ matrix.arch }}"
+          fi
 
       - name: Build app (macOS ${{ matrix.arch }})
         env:
@@ -248,9 +234,7 @@ jobs:
           test -f dist-electron/preload/index.js
           test -f out/renderer/index.html
           test -f mcp-server/dist/index.js
-          if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
-            test -f resources/runtime/VERSION
-          fi
+          test -f resources/runtime/VERSION
 
       - name: Package (macOS ${{ matrix.arch }})
         env:
@@ -321,28 +305,18 @@ jobs:
           VERSION="${GITHUB_REF#refs/tags/v}"
           pnpm pkg set version="$VERSION"
 
-      - name: Resolve runtime asset name (Windows)
-        if: startsWith(github.ref, 'refs/tags/v')
-        id: runtime-asset
-        shell: bash
-        run: |
-          echo "asset_name=$(node ./scripts/runtime-lock.mjs asset-name win32-x64)" >> "$GITHUB_OUTPUT"
-
       - name: Stage bundled runtime (Windows)
-        if: startsWith(github.ref, 'refs/tags/v')
         shell: pwsh
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           $ErrorActionPreference = "Stop"
-          $tag = $env:GITHUB_REF.Replace('refs/tags/', '')
-          Remove-Item .runtime-download -Recurse -Force -ErrorAction SilentlyContinue
-          Remove-Item resources/runtime/* -Recurse -Force -ErrorAction SilentlyContinue
-          New-Item -ItemType Directory -Force -Path .runtime-download | Out-Null
-          New-Item -ItemType Directory -Force -Path resources/runtime | Out-Null
-          gh release download $tag --repo $env:GITHUB_REPOSITORY --pattern "${{ steps.runtime-asset.outputs.asset_name }}" --dir .runtime-download
-          Expand-Archive -Path ".runtime-download/${{ steps.runtime-asset.outputs.asset_name }}" -DestinationPath .runtime-download/unpacked -Force
-          Copy-Item .runtime-download/unpacked/runtime/* resources/runtime -Recurse -Force
+          if ($env:GITHUB_REF -like 'refs/tags/v*') {
+            $tag = $env:GITHUB_REF.Replace('refs/tags/', '')
+            node ./scripts/stage-runtime.mjs --platform win32-x64 --release-tag $tag
+          } else {
+            node ./scripts/stage-runtime.mjs --platform win32-x64
+          }
 
       - name: Build app (Windows)
         env:
@@ -360,14 +334,12 @@ jobs:
           test -f dist-electron/preload/index.js
           test -f out/renderer/index.html
           test -f mcp-server/dist/index.js
-          if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
-            test -f resources/runtime/VERSION
-          fi
+          test -f resources/runtime/VERSION
 
       - name: Package (Windows)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm dist:win --publish never
+        run: pnpm pack:win --publish never
 
       - name: Validate packaged bundle (Windows)
         shell: bash
@@ -435,26 +407,18 @@ jobs:
           VERSION="${GITHUB_REF#refs/tags/v}"
           pnpm pkg set version="$VERSION"
 
-      - name: Resolve runtime asset name (Linux)
-        if: startsWith(github.ref, 'refs/tags/v')
-        id: runtime-asset
-        shell: bash
-        run: |
-          echo "asset_name=$(node ./scripts/runtime-lock.mjs asset-name linux-x64)" >> "$GITHUB_OUTPUT"
-
       - name: Stage bundled runtime (Linux)
-        if: startsWith(github.ref, 'refs/tags/v')
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: bash
         run: |
           set -euo pipefail
-          TAG="${GITHUB_REF#refs/tags/}"
-          rm -rf .runtime-download resources/runtime
-          mkdir -p .runtime-download resources/runtime
-          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --pattern "${{ steps.runtime-asset.outputs.asset_name }}" --dir .runtime-download
-          tar -xzf ".runtime-download/${{ steps.runtime-asset.outputs.asset_name }}" -C .runtime-download
-          cp -R .runtime-download/runtime/. resources/runtime/
+          if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
+            TAG="${GITHUB_REF#refs/tags/}"
+            node ./scripts/stage-runtime.mjs --platform linux-x64 --release-tag "$TAG"
+          else
+            node ./scripts/stage-runtime.mjs --platform linux-x64
+          fi
 
       - name: Build app (Linux)
         env:
@@ -471,14 +435,12 @@ jobs:
           test -f dist-electron/preload/index.js
           test -f out/renderer/index.html
           test -f mcp-server/dist/index.js
-          if [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
-            test -f resources/runtime/VERSION
-          fi
+          test -f resources/runtime/VERSION
 
       - name: Package (Linux)
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm dist:linux --publish never
+        run: pnpm pack:linux --publish never
 
       - name: Validate packaged bundle (Linux)
         run: node ./scripts/electron-builder/verifyBundle.cjs "release/linux-unpacked" linux x64

.gitignore

@@ -58,6 +58,10 @@ remotion/*
 .board-task-log-freshness/
 
 .serena/
+.playwright-mcp/
 
 # Local release operator notes
 /ORCHESTRATOR_RELEASE_RUNBOOK.local.md
+
+# Local reference captures
+/agent-teams-reference-fix-*.png

README.md

@@ -300,9 +300,13 @@ pnpm dist:mac:arm64  # macOS Apple Silicon (.dmg)
 pnpm dist:mac:x64    # macOS Intel (.dmg)
 pnpm dist:win        # Windows (.exe)
 pnpm dist:linux      # Linux (AppImage/.deb/.rpm/.pacman)
-pnpm dist            # macOS + Windows + Linux
+pnpm dist            # Current platform
 ```
 
+Distribution scripts run the production build and stage the bundled multimodel runtime from
+`runtime.lock.json` before packaging. Use `pnpm clean:runtime` to remove staged runtime files after
+local packaging.
+
 ### Scripts
 
 | Command | Description |

agent-teams-controller/src/internal/atomicFile.js

@@ -0,0 +1,90 @@
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+const RENAME_MAX_ATTEMPTS = 8;
+const RENAME_RETRY_BASE_DELAY_MS = 40;
+const RENAME_RETRY_MAX_DELAY_MS = 250;
+const RENAME_RETRY_JITTER_MS = 25;
+const RETRYABLE_RENAME_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+function getRenameRetryDelayMs(attempt) {
+  const backoff = Math.min(RENAME_RETRY_BASE_DELAY_MS * attempt, RENAME_RETRY_MAX_DELAY_MS);
+  return backoff + Math.floor(Math.random() * (RENAME_RETRY_JITTER_MS + 1));
+}
+
+function fsyncFileBestEffort(filePath) {
+  let fd = null;
+  try {
+    fd = fs.openSync(filePath, 'r+');
+    fs.fsyncSync(fd);
+  } catch {
+    // Best effort only. Some filesystems do not support fsync for these files.
+  } finally {
+    if (fd !== null) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+        // Best effort only.
+      }
+    }
+  }
+}
+
+function renameWithRetrySync(tempPath, filePath) {
+  for (let attempt = 1; attempt <= RENAME_MAX_ATTEMPTS; attempt += 1) {
+    try {
+      fs.renameSync(tempPath, filePath);
+      return;
+    } catch (error) {
+      if (error && error.code === 'EXDEV') {
+        fs.copyFileSync(tempPath, filePath);
+        try {
+          fs.rmSync(tempPath, { force: true });
+        } catch {
+          // Best effort cleanup after cross-device fallback.
+        }
+        return;
+      }
+
+      if (error && RETRYABLE_RENAME_CODES.has(error.code) && attempt < RENAME_MAX_ATTEMPTS) {
+        sleepSync(getRenameRetryDelayMs(attempt));
+        continue;
+      }
+
+      throw error;
+    }
+  }
+}
+
+function atomicWriteFileSync(filePath, data, options) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const tempPath = path.join(path.dirname(filePath), `.tmp.${crypto.randomUUID()}`);
+
+  try {
+    fs.writeFileSync(tempPath, data, options);
+    fsyncFileBestEffort(tempPath);
+    renameWithRetrySync(tempPath, filePath);
+  } catch (error) {
+    try {
+      fs.rmSync(tempPath, { force: true });
+    } catch {
+      // Cleanup is best effort. Preserve the original write error.
+    }
+    throw error;
+  }
+}
+
+function writeJsonFileSync(filePath, value, options = {}) {
+  const suffix = options.trailingNewline === true ? '\n' : '';
+  atomicWriteFileSync(filePath, `${JSON.stringify(value, null, 2)}${suffix}`, 'utf8');
+}
+
+module.exports = {
+  atomicWriteFileSync,
+  writeJsonFileSync,
+};

agent-teams-controller/src/internal/crossTeam.js

@@ -1,6 +1,7 @@
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const { writeJsonFileSync } = require('./atomicFile.js');
 const { createControllerContext } = require('./context.js');
 const { withFileLockSync } = require('./fileLock.js');
 const messageStore = require('./messageStore.js');
@@ -25,10 +26,7 @@ function readJson(filePath, fallbackValue) {
 }
 
 function writeJson(filePath, value) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  fs.writeFileSync(tempPath, JSON.stringify(value, null, 2));
-  fs.renameSync(tempPath, filePath);
+  writeJsonFileSync(filePath, value);
 }
 
 function normalizeMetaMembers(rawMembers) {

agent-teams-controller/src/internal/kanbanStore.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
-const path = require('path');
 const taskStore = require('./taskStore.js');
+const { writeJsonFileSync } = require('./atomicFile.js');
 
 function nowIso() {
   return new Date().toISOString();
@@ -15,10 +15,7 @@ function readJson(filePath, fallbackValue) {
 }
 
 function writeJson(filePath, value) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  fs.writeFileSync(tempPath, JSON.stringify(value, null, 2));
-  fs.renameSync(tempPath, filePath);
+  writeJsonFileSync(filePath, value);
 }
 
 function getDefaultState(teamName) {

agent-teams-controller/src/internal/messageStore.js

@@ -1,15 +1,12 @@
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
+const { writeJsonFileSync } = require('./atomicFile.js');
 
 function nowIso() {
   return new Date().toISOString();
 }
 
-function ensureDir(dirPath) {
-  fs.mkdirSync(dirPath, { recursive: true });
-}
-
 function readJson(filePath, fallbackValue) {
   try {
     return JSON.parse(fs.readFileSync(filePath, 'utf8'));
@@ -19,10 +16,7 @@ function readJson(filePath, fallbackValue) {
 }
 
 function writeJson(filePath, value) {
-  ensureDir(path.dirname(filePath));
-  const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  fs.writeFileSync(tempPath, JSON.stringify(value, null, 2));
-  fs.renameSync(tempPath, filePath);
+  writeJsonFileSync(filePath, value);
 }
 
 function getInboxPath(paths, memberName) {

agent-teams-controller/src/internal/processStore.js

@@ -1,7 +1,7 @@
 const fs = require('fs');
-const path = require('path');
 const crypto = require('crypto');
 
+const { writeJsonFileSync } = require('./atomicFile.js');
 const runtimeHelpers = require('./runtimeHelpers.js');
 
 function nowIso() {
@@ -17,10 +17,7 @@ function readJson(filePath, fallbackValue) {
 }
 
 function writeJson(filePath, value) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  const tempPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
-  fs.writeFileSync(tempPath, JSON.stringify(value, null, 2));
-  fs.renameSync(tempPath, filePath);
+  writeJsonFileSync(filePath, value);
 }
 
 function readProcesses(paths) {