feat(search): add opt-in Keenable search provider

.github/computer-use-ref

@@ -1 +1 @@
-fc92b70417cdae941ba8b104a6e7b3b5b52a07e2
+f0d26f14fa176c0bf6ca557f7cd7797f4c5ea374

.github/workflows/README.md

@@ -37,9 +37,18 @@ resolutions. Weekly Dependabot updates keep the GitHub Actions versions current.
 
 5. **Signs macOS binaries and Autohand Computer Use**. When all Apple credentials
    are configured, it uses Developer ID, notarizes the artifacts, and staples the app
-   ticket. While credentials are unavailable, alpha and stable releases use ad-hoc
-   signatures. Both modes verify each transported Actions artifact on a native Apple
-   Silicon or Intel runner before publication.
+   ticket. Every alpha and stable release requires Apple credentials. Missing
+   credentials stop publication. Transported artifacts are verified on a native
+   Apple Silicon or Intel runner before publication.
+   Developer ID signing applies `native/macos/cli.entitlements.plist` to the Bun
+   executables for JavaScript execution and native addons. The Swift Computer Use
+   host is signed separately without those runtime exceptions.
+
+   macOS build, verification, and CI jobs use `macos-26` (Apple Silicon) and
+   `macos-26-intel` (Intel). GitHub retired the macOS 14 runner image on
+   [November 2, 2026](https://github.blog/changelog/2026-10-01-github-actions-macos-14-runner-image-retirement/).
+   The Computer Use host is compiled explicitly for macOS 13, matching its bundle
+   deployment target, so the runner upgrade does not raise its minimum OS.
 
 6. **Generates release notes** from the correct previous release tag
 
@@ -59,7 +68,10 @@ resolutions. Weekly Dependabot updates keep the GitHub Actions versions current.
 
 **Triggers:**
 - Pull requests to `main`, `beta`, `alpha`
-- Push to any branch (except main, beta, alpha)
+- Push to contributor branches except main, beta, alpha, `cto/**`, and `nikita/**`
+- Manual dispatch for validation before opening a PR
+
+Managed CTO/Nikita branches use PR validation to avoid duplicate push and PR matrices. Superseded runs for the same PR or ref are cancelled.
 
 **What it does:**
 1. Type checking
@@ -72,7 +84,8 @@ resolutions. Weekly Dependabot updates keep the GitHub Actions versions current.
 
 Add the `full-proof` label to a pull request to run the complete `bun run proof`
 command on a fresh Ubuntu runner. The job uses the declared Bun version, Node.js
-24, frozen dependencies, and full Git history for terminal version assertions.
+24, frozen dependencies, ripgrep, and full Git history for terminal version assertions.
+The opt-in job uses two isolated terminal workers and a 90-minute job budget; cases inside each file remain serial and individual test deadlines are unchanged. Normal terminal runs stay serial. Only `AUTOHAND_TUISTORY_WORKERS=2` enables the bounded parallel mode; other values retain one worker.
 It reruns when the labeled pull request changes and cancels its superseded run.
 The regular sharded CI jobs remain available for faster feedback.
 
@@ -132,25 +145,20 @@ Add these secrets in GitHub Settings → Secrets → Actions:
 2. **`AHTRACES_REPO_TOKEN`** (required for release and CI builds)
    - Fine-grained read-only token for the private `autohandai/ahtraces` repository
 
-3. **macOS signing and notarization secrets** (optional while Apple enrollment is pending)
-   - `APPLICATION_CERT_BASE64`: base64-encoded Developer ID Application `.p12`
-   - `CERT_PASSWORD`: password for the signing certificate archive
-   - `DEVELOPER_NAME`: organization name in the Developer ID certificate
-   - `TEAM_ID`: Apple Developer team identifier
-   - `APPLE_ID`: Apple account used by `notarytool`
-   - `APP_SPECIFIC_PASSWORD`: app-specific password for that Apple account
-   - Configure all six secrets to sign with Developer ID and notarize macOS artifacts.
-     Partially configured signing fails in the prepare job rather than silently
-     downgrading a configured Developer ID release.
-   - Alpha and stable releases with none of these secrets use temporary ad-hoc signing. Signatures are
-     verified before upload and again after downloading the artifacts, but Apple
-     does not notarize these builds. Downloaded apps may require **Open Anyway** in
-     System Settings → Privacy & Security. See [Apple's instructions](https://support.apple.com/en-us/102445).
-   - Ad-hoc signing does not preserve the Developer ID permission identity across
-     updates. Users may need to grant Accessibility and Screen Recording access
-     to Autohand Computer Use again after an update. The CLI asks for explicit trust
-     before first-use permission setup, even with `--yes`, and checks the effective
-     OS grants before allowing desktop requests to proceed.
+3. **macOS signing and notarization secrets** (required for every release)
+   - `CSC_LINK`: base64-encoded Developer ID Application `.p12`
+   - `CSC_KEY_PASSWORD`: password for the signing certificate archive
+   - `APPLE_TEAM_ID`: Autohand's Apple Developer team identifier
+   - `APPLE_API_KEY`: raw App Store Connect API private key (`.p8`)
+   - `APPLE_API_KEY_ID`: API key identifier
+   - `APPLE_API_ISSUER`: App Store Connect issuer identifier
+   - The same credential names are used by Autohand Computer Use and Desktop.
+     The component importer derives the Developer ID identity from the P12 and
+     checks its team. No Apple ID password or upstream Cua provisioning profile
+     is required. Credentials are written only to the runner's temporary folder.
+   - Signing and notarization are mandatory for alpha and stable releases; there
+     is no ad-hoc publication fallback. The host's stapled ticket and Gatekeeper
+     acceptance are validated again after artifact transport.
 
 4. **`MODEL_CATALOG_PR_TOKEN`** (optional for model catalog pull requests)
    - Fine-grained token with repository Contents, Issues, and Pull requests read/write access

.github/workflows/ci.yml

@@ -11,6 +11,14 @@ on:
       - main
       - alpha
       - beta
+      - 'cto/**'
+      - 'nikita/**'
+      - 'repair/**'
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   ahtraces-component:
@@ -74,6 +82,8 @@ jobs:
         shard: [1, 2, 3]
     steps:
       - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
 
       - name: Setup Node.js
         uses: actions/setup-node@v7
@@ -88,7 +98,7 @@ jobs:
 
       - name: Install build tools (Ubuntu)
         if: runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y build-essential python3 make g++
+        run: sudo apt-get update && sudo apt-get install -y build-essential python3 make g++ ripgrep tmux
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
@@ -124,14 +134,17 @@ jobs:
           bun-version-file: package.json
 
       - name: Install build tools (Ubuntu)
-        run: sudo apt-get update && sudo apt-get install -y build-essential python3 make g++
+        run: sudo apt-get update && sudo apt-get install -y build-essential python3 make g++ ripgrep tmux
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
       - name: Build CLI for terminal tests
         run: bun run build
 
+      - name: Prepare pinned Zit for tmux isolation tests
+        run: node --input-type=module -e "import { installZit } from './scripts/install-zit.mjs'; await installZit({ force:true });"
+
       - name: Run built terminal tests
         run: bun run test:tuistory -- --shard=${{ matrix.shard }}/4
 
@@ -140,7 +153,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [macos-latest, ubuntu-latest, windows-latest]
+        os: [macos-26, ubuntu-latest, windows-latest]
     steps:
       - uses: actions/checkout@v7
 
@@ -157,7 +170,7 @@ jobs:
 
       - name: Install build tools (Ubuntu)
         if: runner.os == 'Linux'
-        run: sudo apt-get update && sudo apt-get install -y build-essential python3 make g++
+        run: sudo apt-get update && sudo apt-get install -y build-essential python3 make g++ ripgrep tmux
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/full-proof.yml

@@ -16,7 +16,9 @@ jobs:
   proof:
     if: contains(github.event.pull_request.labels.*.name, 'full-proof')
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 90
+    env:
+      AUTOHAND_TUISTORY_WORKERS: '2'
     steps:
       - uses: actions/checkout@v7
         with:
@@ -32,13 +34,16 @@ jobs:
           bun-version-file: package.json
 
       - name: Install native build tools
-        run: sudo apt-get update && sudo apt-get install -y build-essential python3 make g++
+        run: sudo apt-get update && sudo apt-get install -y build-essential python3 make g++ ripgrep tmux
 
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
       - name: Prepare built CLI fixtures
         run: bun run build
 
+      - name: Prepare pinned Zit for tmux isolation tests
+        run: node --input-type=module -e "import { installZit } from './scripts/install-zit.mjs'; await installZit({ force:true });"
+
       - name: Run complete proof
         run: bun run proof

.github/workflows/installer-release-compatibility.yml

@@ -18,10 +18,12 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest]
+        os: [ubuntu-latest, macos-26]
         channel: [stable, alpha]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v7
       - name: Install the independently published binary in a clean HOME
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: python3 src/testing/scenarios/released-installer-smoke.py --channel '${{ matrix.channel }}'