remo-cli 4.3.5__tar.gz → 4.4.0__tar.gz

remo_cli-4.4.0/.claude/skills/release/SKILL.md

@@ -0,0 +1,265 @@
+---
+name: release
+description: Cut a remo release — drive the release-please stable release PR, or build/validate/publish a pre-release (RC) — with a mandatory local "test before PyPI" gate and explicit approval before anything is tagged, merged, or published.
+argument-hint: "[stable | rc [X.Y.ZrcN]] — omit to be asked"
+metadata:
+  author: remo
+---
+
+# Release
+
+Operationalizes remo's two-lane release process (see
+[CONTRIBUTING.md](../../../CONTRIBUTING.md) → Release Process). Pairs with the
+release-please integration.
+
+**Non-negotiable safety rules — apply in every mode:**
+
+- **Publishing to PyPI is irreversible.** A version, once uploaded, can never be
+  replaced. Run the local build + smoke gate (Step V below) before anything that
+  reaches PyPI — a stable release PR merge, or RC outcome **D**.
+- **A `v*` tag publishes to PyPI. An `rc-*` tag does not.** `release.yml`
+  triggers on `tags: v*`; the GitHub-pre-release path (RC outcome **B**) tags
+  `rc-<version>` and never uploads. Check which namespace you are in before
+  pushing anything.
+- **Never** `git push` a tag, `git push` a version-bump commit, or `gh pr merge`
+  a release PR **without explicit user approval in the current turn.** Approval
+  from an earlier task does not carry over. Dispatching `dev-build.yml` is not in
+  this class — it neither commits nor uploads — but say what it will tag.
+- Work only from a **clean working tree** on an **up-to-date `main`**. If the
+  tree is dirty or `main` is behind `origin/main`, stop and surface it. A dirty
+  file the operator owns and you did not touch is theirs: report it, never
+  revert it.
+- Prefer testing **without** publishing. "Publish a pre-release" in this repo
+  means outcome **B** (GitHub) unless the user says PyPI. Never infer PyPI from
+  the word "publish".
+
+## Step 0 — Determine the mode
+
+From the argument, or by asking the user:
+
+- **`stable`** — drive the release-please release PR to a published stable release.
+- **`rc`** — build/validate a pre-release, optionally publishing it.
+
+Then run `git fetch origin` and verify `git status` is clean and `main` is
+up to date (`git rev-parse HEAD` == `git rev-parse origin/main`).
+
+---
+
+## Stable lane (release-please owns the version + tag)
+
+1. `git checkout main && git pull --ff-only`.
+2. Find the open release PR (release-please titles it `chore(main): release X.Y.Z`
+   and pushes it to a `release-please--…` branch). Match on either signal —
+   do **not** pass the title to `--search`, whose parser silently drops
+   `chore(main):` and returns zero results even when the PR exists:
+   ```bash
+   gh pr list --state open --limit 100 --json number,title,headRefName,url --jq \
+     '.[] | select((.headRefName | startswith("release-please--"))
+                   or (.title | startswith("chore(main): release")))
+      | "\(.number)\t\(.title)\t\(.url)"'
+   ```
+   If none exists, tell the user release-please has not opened one (no
+   releasable `feat:`/`fix:` commits since the last release) and **stop**.
+   Before concluding that, sanity-check with a bare `gh pr list --state open`:
+   a filter bug and a genuinely absent PR look identical from here, and
+   wrongly reporting "no release PR" strands a real one.
+3. Show the proposed bump + changelog for review. `gh pr diff` takes no
+   pathspec (`gh pr diff <n> -- <files>` fails with "accepts at most 1 arg"),
+   so select the files from the API instead:
+   ```bash
+   gh api repos/{owner}/{repo}/pulls/<number>/files --paginate --jq \
+     '.[] | select(.filename == "pyproject.toml" or .filename == "CHANGELOG.md")
+      | "=== \(.filename) ===\n\(.patch)"'
+   ```
+   Read the `⚠ BREAKING CHANGES` block carefully — it is what drives a major
+   bump, and a spurious entry there is the usual cause of an unintended one.
+4. **Run the validation gate (Step V) on the PR's head branch** so you build the
+   exact version that will publish.
+5. **Only on explicit approval**, merge it (release-please then tags `vX.Y.Z`,
+   which triggers `release.yml` to publish to PyPI + GHCR):
+   ```bash
+   gh pr merge <number> --squash
+   ```
+   Before merging, confirm the `RELEASE_PLEASE_TOKEN` secret is set — without it
+   the tag will not trigger the publish. If it's missing, warn the user and let
+   them decide.
+6. Return to `main`, `git pull --ff-only`, report the new tag, and offer to watch
+   the release CI. `gh run watch` needs an explicit run id outside a TTY:
+   ```bash
+   gh run watch "$(gh run list --workflow=release.yml --limit 1 \
+                     --json databaseId --jq '.[0].databaseId')"
+   ```
+
+---
+
+## RC lane (manual — release-please stays out)
+
+**Two tag namespaces, and confusing them is the one unrecoverable mistake here:**
+
+| Tag | Created by | Publishes to |
+|-----|-----------|--------------|
+| `rc-X.Y.ZrcN` | `dev-build.yml` (`prerelease=true`) | **GitHub pre-release only** |
+| `vX.Y.Z*` | release-please, or a hand-pushed tag | **PyPI + GHCR** (`release.yml`) |
+
+`release.yml` triggers on `tags: v*`. A `v`-prefixed RC tag therefore uploads to
+PyPI, which is irreversible; `dev-build.yml` refuses to create one for exactly
+that reason. Outcome B below is what "publish a pre-release so we can install it
+by version" means in this repo — **not** a `v` tag.
+
+1. `git checkout main && git pull --ff-only`.
+2. Determine the RC version `X.Y.ZrcN` (PEP 440 form, **no separator**):
+   - `X.Y.Z` is the next target version (feat → minor, fix → patch over the last
+     stable tag).
+   - `N` increments from the last RC for the same `X.Y.Z`. The tags are
+     `rc`-prefixed, so: `git tag --list "rc-X.Y.Zrc*"`, else `1`.
+   - Confirm the chosen version with the user.
+3. Ask which outcome they want, then follow only that one. **A** is the default;
+   **B** is what to reach for when someone wants to install the RC by version on
+   another machine.
+
+### A — Local validation only (nothing tagged, nothing published)
+
+Bump `pyproject.toml` `[project].version` to `X.Y.ZrcN` and run `uv lock` so the
+lockfile agrees (`tests/unit/test_lockfile_version.py` gates that pair). First
+confirm neither file already carries edits — the revert below discards whatever
+is in them, and a full test run separates the two moments:
+
+```bash
+git diff --quiet -- pyproject.toml uv.lock \
+  || { echo "pyproject.toml/uv.lock already modified — STOP"; }
+```
+
+Run the validation gate (**Step V**), then hand off `dist/*.whl` or the Tier 1
+one-liner
+(`uv tool install --force "git+https://github.com/get2knowio/remo.git@<branch>"`).
+
+Then revert. Look before discarding — never `git restore` these paths blind:
+
+```bash
+git diff -- pyproject.toml uv.lock   # MUST show only the X.Y.ZrcN bump
+git restore --source=HEAD --worktree -- pyproject.toml uv.lock
+```
+
+If that diff contains anything else, stop and surface it: something edited these
+files during the run, and discarding it destroys unrecoverable work.
+
+### B — GitHub pre-release, installable by version (no PyPI)
+
+The usual way to get an RC onto other machines. `dev-build.yml` stamps the
+version in CI, so **no local bump is needed** and nothing is committed. The
+`prerelease` job attaches the *same* wheel the build job produced — it does not
+rebuild — to a GitHub pre-release tagged `rc-X.Y.ZrcN`.
+
+```bash
+gh workflow run dev-build.yml --ref main -f version=X.Y.ZrcN -f prerelease=true
+# This also publishes ghcr.io/get2knowio/remo-web:X.Y.ZrcN (never `latest`) for
+# Compose-based deployments — `image` defaults to true, so an RC is a complete
+# artifact rather than a wheel with no image behind it. Add -f image=false for a
+# CLI-only RC, which skips the emulated arm64 build.
+
+# `gh run watch` needs an explicit run id outside a TTY. Give the dispatch a
+# couple of seconds to register before listing.
+RUN_ID="$(gh run list --workflow=dev-build.yml --limit 1 \
+            --json databaseId --jq '.[0].databaseId')"
+gh run watch "$RUN_ID"
+```
+
+Then **validate the published artifact**, which is stronger than a pre-build
+local check because it is the wheel testers will actually fetch. Use a throwaway
+venv so the operator's own install is untouched:
+
+```bash
+URL="https://github.com/get2knowio/remo/releases/download/rc-X.Y.ZrcN/remo_cli-X.Y.ZrcN-py3-none-any.whl"
+uv venv /tmp/remo-rc && uv pip install --python /tmp/remo-rc/bin/python "remo-cli @ $URL"
+/tmp/remo-rc/bin/remo --version    # MUST print X.Y.ZrcN
+/tmp/remo-rc/bin/remo --help
+```
+
+Confirm with `gh release view rc-X.Y.ZrcN` that it is marked pre-release, and
+report that PyPI is unchanged. Testers install it with no `gh` auth:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/get2knowio/remo/main/install.sh \
+  | bash -s -- --prerelease X.Y.ZrcN
+# or directly:
+uv tool install --force "remo-cli @ <URL above>"
+```
+
+A GitHub pre-release is deletable and the version re-cuttable, so this outcome is
+recoverable — unlike D.
+
+### C — Dev build artifact (no version reserved, no tag)
+
+For cross-machine testing when no version should be claimed at all. Omit
+`version` and the workflow stamps `X.Y.Z.devN+g<sha>`; that PEP 440 **local
+segment** is what PyPI rejects outright, making publication structurally
+impossible. Note this applies only to the auto version — an explicit
+`-f version=X.Y.ZrcN` is stamped **verbatim with no local segment**, precisely so
+it stays promotable.
+
+```bash
+gh workflow run dev-build.yml            # auto dev version
+RUN_ID="$(gh run list --workflow=dev-build.yml --limit 1 \
+            --json databaseId --jq '.[0].databaseId')"
+gh run watch "$RUN_ID"
+gh run download "$RUN_ID" -n remo-wheel -D ./dl   # needs gh auth on that machine
+uv tool install --force ./dl/remo_cli-*.whl
+```
+
+### D — Publish the RC to PyPI (exceptional; explicit approval required)
+
+Constitution IX permits this, but as **the exception**: "taken only when the
+tester cannot install off-index." Outcome B needs no `gh` auth and no index, so
+that condition is now rarely met — before proposing D, state why B will not work
+for this tester. Never take D merely because the word "publish" was used.
+
+Requires **Step V** on the bumped tree first (this is irreversible), then:
+
+```bash
+git commit -am "chore(release): X.Y.ZrcN"
+git tag vX.Y.ZrcN          # a v* tag: this is what triggers release.yml
+git push origin main vX.Y.ZrcN
+```
+
+`release.yml` marks it a prerelease off the tag suffix, publishes to PyPI + GHCR,
+and never moves `latest`. Offer to watch CI. Warn the operator that this reserves
+`X.Y.ZrcN` on PyPI permanently.
+
+---
+
+## Step V — Validation gate (test the exact wheel before PyPI)
+
+**Required for anything that reaches PyPI:** the stable lane, and RC outcome
+**D**. Also used by RC outcome **A**, whose whole purpose it is.
+
+Outcomes **B** and **C** build in clean CI rather than locally, so Step V does
+not apply as written — their equivalent is the post-publish check in **B**, which
+validates the artifact testers will actually fetch. If a full local run was
+already green on the same commit, say so rather than repeating it; do not claim
+Step V ran when CI did.
+
+Run this on whatever ref will be released (the release-please PR head for stable,
+or the bumped working tree for an RC). The published version comes from
+`pyproject.toml` via `uv build`, so this builds the identical artifact:
+
+```bash
+uv run pytest -q                    # full suite must pass
+uv build                            # -> dist/remo_cli-<version>-py3-none-any.whl
+VENV="$(mktemp -d)/venv"
+uv venv "$VENV"
+uv pip install --python "$VENV/bin/python" ./dist/remo_cli-<version>-py3-none-any.whl
+"$VENV/bin/remo" --version          # MUST equal <version>
+"$VENV/bin/remo" --help             # sanity-check the CLI loads
+```
+
+Report the results. If tests fail, the wheel version doesn't match, or the CLI
+doesn't load, **stop** and surface it — do not proceed to tag/merge/publish.
+
+## Done when
+
+- The requested lane completed through the point the user approved (RC outcome
+  A/B/C/D, or stable PR merged).
+- No tag was pushed, commit was pushed, or PR merged without explicit approval.
+- The outcome was reported clearly, naming **which index was touched**: for
+  outcomes A–C, that PyPI is unchanged; for D or a stable release, the version
+  now permanently reserved there.

remo_cli-4.4.0/.github/actions/publish-web-image/action.yml

@@ -0,0 +1,99 @@
+name: Publish the remo-web image
+description: >
+  Build and push ghcr.io/<owner>/remo-web for one version, multi-arch
+  (linux/amd64 + linux/arm64). The single image-publishing path, shared by
+  release.yml (stable, from a v* tag) and rc-image.yml (pre-release, from an
+  rc-* tag).
+
+# Why this exists: the five docker/* steps below were duplicated verbatim in
+# release.yml and rc-image.yml, including their pinned SHAs. Dependabot proposes
+# a bump per file, so PR #212 had to raise the same three pins in both — and a
+# bump that landed in one file only would leave the two paths building with
+# different tooling, with nothing to catch it. Same failure class as the
+# codeql-action mismatch that tests/unit/test_workflow_action_pins.py was
+# written for.
+#
+# What is deliberately NOT here: resolving the version, checking out a ref, and
+# stamping pyproject.toml. Those differ by channel for real reasons — a stable
+# version is already committed by release-please, whereas a pre-release version
+# exists only as a workflow input — so each caller keeps its own.
+
+inputs:
+  tag-spec:
+    description: >
+      The `tags:` value for docker/metadata-action. Callers pass their own
+      because the channels tag differently on purpose: stable gets
+      {{version}} + {{major}}.{{minor}} + conditionally `latest`, while a
+      pre-release gets its exact version and nothing else.
+    required: true
+  github-token:
+    description: >
+      Token for the GHCR login. Passed in because a composite action cannot
+      read `secrets.*` itself.
+    required: true
+  context:
+    description: >
+      Build context directory. Defaults to the workspace root, which is what
+      release.yml wants. rc-image.yml passes a subdirectory, because a local
+      `uses: ./…` action is read from the checked-out WORKING TREE — so that
+      workflow has to keep its own tree at the root (to find this action) and
+      check the target rc-* tag out beside it. Without that, backfilling an
+      image for a tag cut before this action existed would fail with "action
+      not found".
+    required: false
+    default: "."
+  dockerfile:
+    description: Path to the Dockerfile, relative to the workspace root.
+    required: false
+    default: docker/Dockerfile
+
+outputs:
+  digest:
+    description: The pushed manifest's digest, for pinning by digest.
+    value: ${{ steps.build.outputs.digest }}
+  tags:
+    description: The fully-resolved tags that were pushed, newline-separated.
+    value: ${{ steps.meta.outputs.tags }}
+
+runs:
+  using: composite
+  steps:
+    # Needed for the linux/arm64 half of the manifest: GitHub's runners are
+    # amd64, so arm64 is cross-built under emulation. This is what dominates
+    # the job's runtime, hence the 60-minute timeout at both call sites.
+    - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
+
+    - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+
+    - name: Log in to GHCR
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ inputs.github-token }}
+
+    - name: Derive image tags and labels
+      id: meta
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
+      with:
+        images: ghcr.io/${{ github.repository_owner }}/remo-web
+        # Hardcoded, not an input: this disables the action's automatic `latest`
+        # for BOTH channels. Stable re-adds it through an explicit raw tag in its
+        # tag-spec; a pre-release has no way to reach `latest` at all, which is
+        # what makes publishing an RC image safe by default (dev-build.yml's
+        # `image` input). Making it configurable would make that reachable.
+        flavor: latest=false
+        tags: ${{ inputs.tag-spec }}
+
+    - name: Build and push (amd64 + arm64)
+      id: build
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7
+      with:
+        context: ${{ inputs.context }}
+        file: ${{ inputs.dockerfile }}
+        platforms: linux/amd64,linux/arm64
+        push: true
+        tags: ${{ steps.meta.outputs.tags }}
+        # Includes org.opencontainers.image.source, which is what links the
+        # published GHCR package back to this repository.
+        labels: ${{ steps.meta.outputs.labels }}

remo_cli-4.4.0/.github/dependabot.yml

@@ -0,0 +1,90 @@
+version: 2
+updates:
+  # Python dependencies (pyproject.toml + uv.lock)
+  #
+  # Must be "uv", not "pip": this repo resolves from the committed uv.lock, and
+  # the pip ecosystem does not update that file — it would bump pyproject.toml
+  # and leave the lock (the thing CI and the Docker build actually install
+  # from) untouched.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    # Let a new release settle before we bump to it, so we don't chase
+    # immediately-yanked or regression releases.
+    cooldown:
+      default-days: 7
+    groups:
+      # One PR per week with all minor/patch production deps bumped together.
+      production-minor-patch:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+      # One PR per week with all minor/patch dev-only deps bumped together.
+      dev-minor-patch:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"
+    # Major bumps still get individual PRs so they can be reviewed carefully.
+
+  # GitHub Actions workflow versions
+  - package-ecosystem: "github-actions"
+    # "/" covers .github/workflows/ and a ROOT-level action.yml — and nothing
+    # else. Composite actions under .github/actions/** fall outside it whatever
+    # the directory value, so each needs its own entry or its pinned `uses:`
+    # SHAs are never bumped again. Moving the docker/* steps into
+    # publish-web-image without this would have silently frozen five pins,
+    # which is worse than the duplication it removed.
+    # tests/unit/test_dependabot_config.py::test_every_composite_action_is_covered
+    # fails if a new composite action is added without a line here.
+    directories:
+      - "/"
+      - "/.github/actions/publish-web-image"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        update-types:
+          - "minor"
+          - "patch"
+
+  # Docker base images. Two Dockerfiles ship images:
+  #   /Dockerfile        — the CLI image (python:3.13-slim)
+  #   /docker/Dockerfile — the remo-web service (node:24-slim, python:3.11-slim)
+  # Nothing watched these before, so a base image could sit on an unpatched
+  # tag indefinitely — the CVEs that matter for a container usually arrive via
+  # the base image, not via the app's own dependencies.
+  - package-ecosystem: "docker"
+    directories:
+      - "/"
+      - "/docker"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    groups:
+      docker-images:
+        update-types:
+          - "minor"
+          - "patch"
+    ignore:
+      # Dependabot picks the highest published tag and has no concept of
+      # Node's release lines. Left alone it proposed node:20-slim ->
+      # node:25-slim (#156): 25 is an odd-numbered "Current" release that
+      # never becomes LTS and went EOL on 2026-06-01, so that bump would have
+      # swapped one unpatched base image for another — the exact failure this
+      # ecosystem entry exists to prevent. Node majors are picked by hand
+      # instead, on the LTS cadence (even-numbered, each October). Minor and
+      # patch bumps, which carry the base-image CVE fixes, keep flowing.
+      - dependency-name: "node"
+        update-types: ["version-update:semver-major"]

remo_cli-4.4.0/.github/workflows/ci.yml

@@ -0,0 +1,197 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true  # Superseded by a newer commit on the same ref — nothing external is touched.
+
+jobs:
+  test:
+    name: Tests (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
+      - name: Set up Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync --all-extras --python ${{ matrix.python-version }}
+
+      - name: Run tests
+        run: uv run --python ${{ matrix.python-version }} pytest --tb=short -q
+
+  docker-image:
+    name: Docker image (amd64 + arm64)
+    runs-on: ubuntu-latest
+    # This job is the only thing that actually builds docker/Dockerfile. The
+    # tests/image/ checks that run in the `test` job above are structural --
+    # they grep the Dockerfile for the right strings -- so without this a
+    # genuinely broken image (failed npm ci, moved asset path, bad arch
+    # branch) ships green. Multi-minute by nature: an emulated arm64 build
+    # runs npm ci and pip install under QEMU.
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      # Registers binfmt handlers so the arm64 half of tests/image/ can build
+      # under emulation on an amd64 runner. The arch-selection branch
+      # (FR-027/FR-042) has no other way to be exercised here.
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
+
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
+      - name: Install dependencies
+        run: uv sync --all-extras
+
+      # REMO_RUN_IMAGE_TESTS=1 opts into tier 2 of tests/image/: real
+      # `docker buildx build` for amd64 + arm64, then runs the built image
+      # under compose.example.yml's hardening flags and asserts non-root UID,
+      # a genuinely read-only rootfs, an arch-correct session-manager-plugin,
+      # and that /api/v1/ready gates on missing mounts. The tests skip
+      # honestly (not fail) if emulation turns out to be unusable.
+      - name: Build and verify the remo-web image
+        env:
+          REMO_RUN_IMAGE_TESTS: "1"
+        run: uv run pytest tests/image/ -v --tb=short
+
+  wheel-install:
+    name: Wheel install smoke test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
+      - name: Build wheel
+        run: uv build --wheel
+
+      - name: Install wheel into a fresh venv (non-editable)
+        run: |
+          uv venv /tmp/remo-wheel-test
+          uv pip install --python /tmp/remo-wheel-test/bin/python dist/*.whl
+
+      - name: Verify ansible dir is found and contains playbooks
+        run: |
+          /tmp/remo-wheel-test/bin/python - <<'EOF'
+          from remo_cli.core.config import get_ansible_dir
+          d = get_ansible_dir()
+          print(f"ansible_dir: {d}")
+          assert (d / "incus_configure.yml").is_file(), f"incus_configure.yml not found in {d}"
+          assert (d / "requirements.yml").is_file(), f"requirements.yml not found in {d}"
+          assert not (d / "__init__.py").exists(), f"ansible_dir looks like a Python package: {d}"
+          print("OK: ansible playbooks found in installed wheel")
+          EOF
+
+  fish-completion:
+    name: Fish completion (real shell)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
+      - name: Install fish
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq fish
+
+      # The activation script shells out to `remo` by name, so it has to be a
+      # real binary on PATH — `uv run remo` would never be found by fish.
+      - name: Install remo onto PATH
+        run: |
+          uv sync
+          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"
+
+      # Asserting on the text of the generated script is not enough: the bug
+      # this guards against (a2542e9) produced a script that read fine and
+      # emitted a screenful of errors the moment fish executed it.
+      - name: Run completions in a real fish shell
+        run: ./tests/integration/fish_completion.sh
+
+  lint:
+    name: Lint & Types
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
+      - name: Install dependencies
+        run: uv sync --all-extras
+
+      - name: Ruff check
+        run: uv run ruff check src/remo_cli
+
+      # mypy analyses against python_version = "3.11" from [tool.mypy], so the
+      # result is independent of whichever interpreter uv resolves here. The
+      # `web` extra must be installed (it is, via --all-extras) or every
+      # src/remo_cli/web/ module degrades to Any and the gate goes blind.
+      - name: Mypy check
+        run: uv run mypy src/remo_cli
+
+  frontend:
+    name: Frontend (typecheck + unit + build)
+    runs-on: ubuntu-latest
+    # Fast, backend-free coverage of the SPA: tsc typecheck, the Vitest
+    # unit/component suite (frontend/src/**/*.test.ts), the browser geometry
+    # suite (frontend/tests/geometry), and a production build.
+    #
+    # The geometry suite runs here because it is self-contained: it serves a
+    # fixture page with Vite and answers the terminal API/WebSocket from inside
+    # the spec. It covers what jsdom structurally cannot — jsdom has no layout
+    # engine, so every element measures 0x0 and any assertion about the terminal
+    # grid fitting its box passes vacuously there.
+    #
+    # The Playwright e2e suite (frontend/tests/e2e) is still NOT run here — it needs
+    # a live `remo web serve` backend (REMO_E2E_BASE_URL); see playwright.config.ts.
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run lint
+
+      - name: Check generated types are fresh
+        run: npm run check:types-fresh
+
+      - name: Unit tests
+        run: npm run test
+
+      # Chromium only — the geometry suite runs the same specs twice against it
+      # (WebGL and DOM renderers) and needs no other browser.
+      - name: Install Chromium for the geometry suite
+        run: npx playwright install --with-deps chromium
+
+      - name: Browser geometry tests
+        run: npm run test:geometry
+
+      - name: Build
+        run: npm run build