==> Install dependencies
$ bun install --frozen-lockfile
bun install v1.3.14 (0d9b296a)

+ @playwright/test@1.60.0
+ @types/bun@1.3.14
+ @types/k6@2.0.0
+ drizzle-kit@0.31.10
+ cpu-features@0.0.10
+ @anthropic-ai/sdk@0.96.0
+ @neondatabase/serverless@1.1.0
+ @simplewebauthn/server@13.3.0
+ drizzle-orm@0.45.2
+ highlight.js@11.11.1
+ hono@4.12.18
+ marked@18.0.3
+ postgres@3.4.9
+ sanitize-html@2.17.5
+ ssh2@1.17.0
+ typescript@5.9.3

86 packages installed [2.24s]

[exit 0 in 2248ms]

==> Typecheck
$ bash scripts/ci-typecheck.sh

[exit 0 in 41285ms]

==> Test (CI-safe suite)
$ bash scripts/ci-tests.sh
--- design audit ---
FILE                                                LITERALS  BANNED  SAMPLES
----------------------------------------------------------------------------------------------------
src/views/agent-workspace.tsx                       76        0       
src/routes/admin-server-targets.tsx                 53        0       
src/views/distribution.tsx                          47        0       
src/routes/pulls.tsx                                42        0       
src/routes/ai-archaeology.tsx                       40        0       
src/routes/claude-web.tsx                           35        0       
src/views/production-layers.tsx                     34        0       
src/views/layout.tsx                                33        0       
src/views/daily-brief.tsx                           33        0       
src/views/trust-report.tsx                          33        0       
src/routes/admin.tsx                                29        0       
src/routes/admin-integrations.tsx                   28        0       
src/views/org-memory.tsx                            28        0       
src/routes/admin-deploys-page.tsx                   27        0       
src/routes/share.tsx                                26        0       

[design-audit] 172 file(s) with literal colors · 0 banned-family literal(s)
[design-audit] no banned-family colors. Literal debt above burns down per file.
running 404 test files (20 excluded as credential-dependent)
--- failures ---
src/__tests__/ci-workspace-sweep.test.ts:
(fail) orphaned checkouts are removed, live ones are not > a checkout exactly at the limit is kept, not deleted [0.82ms]
--
src/__tests__/synthetic-journeys.test.ts:
(fail) journey:explore-data — 200 is not enough > red when /explore renders a shell with zero repo links [54.88ms]
--
src/lib/selfcheck/authz.test.ts:
(fail) orphaned checkouts are removed, live ones are not > a checkout exactly at the limit is kept, not deleted [0.82ms]
(fail) journey:explore-data — 200 is not enough > red when /explore renders a shell with zero repo links [54.88ms]
--- why (assertion + stack preceding each failure) ---
(pass) the Pages response > sets nosniff, because the publisher picks the extension [0.19ms]
(pass) the Pages response > applies to binary responses too, not only text [0.27ms]
(pass) what content types Pages will serve > html renders, which is the point and the risk [0.19ms]
(pass) what content types Pages will serve > svg is served as an image, and renders as a document when navigated to [0.11ms]
(pass) what content types Pages will serve > an unknown extension is not guessed at [0.09ms]
(pass) the raw blob route, which got this right already > serves every file as an attachment, whatever its extension [0.33ms]

src/__tests__/ci-workspace-sweep.test.ts:
[workflow-runner] swept 1 orphaned checkout(s) from /tmp/sweep-test-z7XtiD
(pass) orphaned checkouts are removed, live ones are not > a checkout older than the age limit is deleted [1.41ms]
(pass) orphaned checkouts are removed, live ones are not > a recent checkout is left completely alone [2.72ms]
[workflow-runner] swept 1 orphaned checkout(s) from /tmp/sweep-test-JuNZks
62 |   });
63 | 
64 |   test("a checkout exactly at the limit is kept, not deleted", async () => {
65 |     // Boundary in the safe direction.
66 |     makeWorkspace("gluecron-run-EDGE01", WORKSPACE_MAX_AGE_MS);
67 |     expect(await sweepStaleWorkspaces(Date.now(), root)).toBe(0);
                                                              ^
error: expect(received).toBe(expected)

Expected: 0
Received: 1

      at <anonymous> (/ci-work/gluecron-run-otfnRY/checkout/src/__tests__/ci-workspace-sweep.test.ts:67:58)
(fail) orphaned checkouts are removed, live ones are not > a checkout exactly at the limit is kept, not deleted [0.82ms]
--
(pass) which constraint fired > username is asked case-folded, email exactly [0.18ms]
(pass) which constraint fired > username is checked first, so a doubly-taken pair reports the name [0.11ms]
(pass) which constraint fired > returns null when neither is found, and callers do not treat that as success [0.22ms]
(pass) which constraint fired > the JSON path answers 409, not 500 [0.20ms]
(pass) the setup endpoint really upserts now > uses DoUpdate, because the row it returns owns the repository [0.19ms]
(pass) the setup endpoint really upserts now > does not overwrite the email of an account that already exists [0.13ms]

src/__tests__/synthetic-journeys.test.ts:
(pass) journey:login-form — the rejection is the pass > green when a wrong password is properly rejected (200, no session cookie) [54.27ms]
(pass) journey:login-form — the rejection is the pass > red when the login handler 500s [50.81ms]
(pass) journey:login-form — the rejection is the pass > red — CRITICAL — if a wrong password ever sets a session cookie [52.05ms]
(pass) journey:explore-data — 200 is not enough > green when /explore actually lists repositories [51.31ms]
75 |     const r = await journey("journey:explore-data", (url) =>
76 |       url.endsWith("/explore")
77 |         ? new Response("<html><body><h1>Explore</h1></body></html>", { status: 200 })
78 |         : new Response("ok", { status: 200 })
79 |     );
80 |     expect(r.status).toBe("red");
                          ^
error: expect(received).toBe(expected)

Expected: "red"
Received: "green"

      at <anonymous> (/ci-work/gluecron-run-otfnRY/checkout/src/__tests__/synthetic-journeys.test.ts:80:22)
(fail) journey:explore-data — 200 is not enough > red when /explore renders a shell with zero repo links [54.88ms]
--
(skip) executeSlashCommand — /test (DB-backed) > falls back gracefully when no test workflow is configured
(skip) personal-semantic — DB-backed > refuses to return rows when the opt-in flag is OFF
(skip) personal-semantic — DB-backed > search returns results across multiple owned repos
(skip) personal-semantic — DB-backed > search EXCLUDES repos the user has no access to
(skip) personal-semantic — DB-backed > cross-user content leak prevention — User A's results never contain User B's repo data
(skip) personal-semantic — DB-backed > setPersonalSemanticEnabled flips the flag and isPersonalSemanticEnabled reads it
(skip) findTrackedDocs — drift detection > treats first-time observations as fresh, second-time differing hashes as stale
(skip) proposeDocUpdate > opens a PR with the refreshed markdown when Claude returns a patch
(skip) recordAiCost — DB-backed > inserts a row that summarizeCostsForUser can find
(skip) recordAiCost — DB-backed > never throws on bad input — swallows DB errors
(skip) runSpecToPr — end-to-end with fake Claude > opens a PR, tags it, and rewrites the spec status to building
(skip) runSpecToPr — end-to-end with fake Claude > refuses a spec whose status is not 'ready'
(skip) API v2 — git plumbing write endpoints (DB-backed) > POST /git/blobs round-trips utf-8 and base64 content
(skip) branch-previews — DB pipeline > enqueue creates a building row with a computed preview URL
(skip) branch-previews — DB pipeline > re-pushing the same branch DEDUPES — same id, new SHA, status='building'
(skip) branch-previews — DB pipeline > markPreviewReady flips status to 'ready' with completed_at
(skip) branch-previews — DB pipeline > markPreviewFailed records error_message + truncates
(skip) branch-previews — DB pipeline > expireOldPreviews transitions ready rows past expires_at to 'expired'
(skip) branch-previews — DB pipeline > expireOldPreviews leaves fresh rows alone
(skip) branch-previews — DB pipeline > listPreviewsForRepo orders by build_started_at descending
(skip) install-token — successful mint > mints a glc_ PAT + writes auth.install_token.created audit row
(skip) install-token — successful mint > defaults name + scope when body is empty


2 tests failed:
(fail) orphaned checkouts are removed, live ones are not > a checkout exactly at the limit is kept, not deleted [0.82ms]
(fail) journey:explore-data — 200 is not enough > red when /explore renders a shell with zero repo links [54.88ms]
--- summary ---
(skip) recordAiCost — DB-backed > inserts a row that summarizeCostsForUser can find
(skip) recordAiCost — DB-backed > never throws on bad input — swallows DB errors
(skip) runSpecToPr — end-to-end with fake Claude > opens a PR, tags it, and rewrites the spec status to building
(skip) runSpecToPr — end-to-end with fake Claude > refuses a spec whose status is not 'ready'
(skip) API v2 — git plumbing write endpoints (DB-backed) > POST /git/blobs round-trips utf-8 and base64 content
(skip) branch-previews — DB pipeline > enqueue creates a building row with a computed preview URL
(skip) branch-previews — DB pipeline > re-pushing the same branch DEDUPES — same id, new SHA, status='building'
(skip) branch-previews — DB pipeline > markPreviewReady flips status to 'ready' with completed_at
(skip) branch-previews — DB pipeline > markPreviewFailed records error_message + truncates
(skip) branch-previews — DB pipeline > expireOldPreviews transitions ready rows past expires_at to 'expired'
(skip) branch-previews — DB pipeline > expireOldPreviews leaves fresh rows alone
(skip) branch-previews — DB pipeline > listPreviewsForRepo orders by build_started_at descending
(skip) install-token — successful mint > mints a glc_ PAT + writes auth.install_token.created audit row
(skip) install-token — successful mint > defaults name + scope when body is empty


2 tests failed:
(fail) orphaned checkouts are removed, live ones are not > a checkout exactly at the limit is kept, not deleted [0.82ms]
(fail) journey:explore-data — 200 is not enough > red when /explore renders a shell with zero repo links [54.88ms]

 5161 pass
 155 skip
 2 fail
 14352 expect() calls
Ran 5318 tests across 403 files. [33.95s]

[exit 1 in 34239ms]