deps: bump actions/download-artifact from 7 to 8

.gitattributes

@@ -0,0 +1 @@
+*.sh text eol=lf

.github/dependabot.yml

@@ -0,0 +1,35 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:00"
+      timezone: Asia/Shanghai
+    open-pull-requests-limit: 10
+    labels:
+      - dependencies
+      - go
+    commit-message:
+      prefix: deps
+    groups:
+      golang-x:
+        patterns:
+          - "golang.org/x/*"
+      chainreactors:
+        patterns:
+          - "github.com/chainreactors/*"
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:30"
+      timezone: Asia/Shanghai
+    labels:
+      - dependencies
+      - github-actions
+    commit-message:
+      prefix: deps

.github/workflows/ci.yml

@@ -17,30 +17,244 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build:
+  # ── Fast gates (independent, no deps) ──────────────────────────
+
+  lint:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9.2.1
+        with:
+          version: v2.12.2
+          args: --timeout=5m
+
+  tidy:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Check go mod tidy
+        run: |
+          cp go.mod go.mod.orig
+          cp go.sum go.sum.orig
+          go mod tidy
+          if ! diff -q go.mod go.mod.orig >/dev/null 2>&1; then
+            echo "::error::go.mod is not tidy. Run 'go mod tidy' and commit the result."
+            diff go.mod.orig go.mod || true
+            exit 1
+          fi
+          if ! diff -q go.sum go.sum.orig >/dev/null 2>&1; then
+            echo "::error::go.sum is not tidy. Run 'go mod tidy' and commit the result."
+            diff go.sum.orig go.sum | head -30 || true
+            exit 1
+          fi
+
+  # ── Unit tests (depends on tidy) ──────────────────────────────
+
+  test:
+    runs-on: ubuntu-22.04
+    needs: tidy
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Generate embedded resources
+        run: go generate ./core/resources/...
+
+      - name: Run unit tests with coverage
+        run: |
+          go test -race -count=1 -timeout 5m \
+            -coverprofile=coverage.out \
+            -covermode=atomic \
+            ./...
+
+      - name: Display coverage summary
+        if: always()
+        run: |
+          if [ -f coverage.out ]; then
+            echo "### Total coverage"
+            go tool cover -func=coverage.out | tail -1
+            echo ""
+            echo "### Per-package coverage (top 20)"
+            go tool cover -func=coverage.out | grep -E '^[a-z]' | sort -t$'\t' -k3 -rn | head -20
+          fi
+
+      - name: Upload coverage artifact
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-report
+          path: coverage.out
+          retention-days: 14
+
+  # ── Proxy & TMux tool tests (depends on tidy) ─────────────────
+
+  tool-tests:
+    runs-on: ubuntu-22.04
+    needs: tidy
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run proxy tool tests
+        run: |
+          go test -race -count=1 -timeout 5m -v \
+            ./pkg/tools/proxy/
+
+      - name: Run tmux command tests
+        run: |
+          go test -race -count=1 -timeout 5m -v \
+            -run 'Tmux|BashProxy' \
+            ./pkg/commands/
+
+      - name: Run PTY interactive session tests
+        run: |
+          go test -race -count=1 -timeout 5m -v \
+            -run 'MultiRound|SendCtrlC' \
+            ./pkg/agent/tmux/
+
+      - name: Run agent tmux integration tests
+        run: |
+          go test -race -count=1 -timeout 5m -v \
+            -run 'AgentTmux' \
+            ./pkg/agent/
+
+  # ── Generated templates tests (depends on tidy) ───────────────
+
+  generated-test:
     runs-on: ubuntu-22.04
+    needs: tidy
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           submodules: recursive
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache: true
 
-      - name: Install upx
-        run: sudo apt install upx -y
-        continue-on-error: true
+      - name: Run go generate for templates
+        run: go generate ./core/resources/...
 
-      - name: Compile release targets
-        uses: goreleaser/goreleaser-action@v6
+      - name: Run resources tests
+        run: |
+          go test -race -count=1 -timeout 5m \
+            ./core/resources/...
+
+  # ── E2E tests (depends on test) ───────────────────────────────
+
+  e2e:
+    runs-on: ubuntu-22.04
+    needs: test
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
         with:
-          distribution: goreleaser
-          version: '~> v2'
-          args: build --snapshot --clean
-        env:
-          GOPATH: "/home/runner/go"
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run e2e tests
+        run: |
+          go test -race -count=1 -timeout 10m \
+            -tags e2e \
+            -v \
+            ./pkg/e2e/
+
+  # ── Build (depends on test, 3 parallel profiles) ──────────────
+
+  build:
+    runs-on: ubuntu-22.04
+    needs: test
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - id: standard
+            main: ./cmd/aiscan
+            tags: "forceposix emptytemplates noembed osusergo netgo"
+            generate: true
+          - id: full
+            main: ./cmd/aiscan
+            tags: "forceposix emptytemplates noembed osusergo netgo full sqlite"
+            generate: true
+          - id: agent
+            main: ./cmd/agent
+            tags: "forceposix emptytemplates noembed osusergo netgo"
+            generate: false
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Generate embedded resources
+        if: matrix.generate
+        run: go generate ./core/resources
+
+      - name: Build all platforms (${{ matrix.id }})
+        run: |
+          for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64; do
+            IFS='/' read -r goos goarch <<< "$target"
+            echo "  compile ${goos}/${goarch}"
+            CGO_ENABLED=0 GOOS="$goos" GOARCH="$goarch" \
+              go build -trimpath -tags "${{ matrix.tags }}" -ldflags "-s -w" \
+              -buildvcs=false -o "dist/${{ matrix.id }}_${goos}_${goarch}" ${{ matrix.main }}
+          done
+          ls -lh dist/