feat(gateway): image generation offload - job-service routing, sync_id, poll progress, per-device auth

.github/workflows/release.yml

@@ -23,6 +23,15 @@ on:
         type: string
         required: false
         default: ''
+      artifact_only:
+        # Internal demo build: the SAME signed + notarized DMG, but uploaded as a run
+        # artifact (repo-scoped, auto-expiring) instead of a published Release. Skips the
+        # release-create/upload, the pro-mac.yml + latest/nightly aliases, Slack, and the
+        # whole Windows job - so nothing lands on the releases page or the update feed.
+        description: 'Build the signed+notarized DMG as a run artifact only (no Release, no Windows, no Slack)'
+        type: boolean
+        required: false
+        default: false
 
 permissions:
   contents: write
@@ -160,6 +169,17 @@ jobs:
           mkdir -p resources/bin
           cp scripts/dictation-hotkey/dictation-hotkey resources/bin/dictation-hotkey
           chmod +x resources/bin/dictation-hotkey
+      # Compile the native actions helper (EventKit) and stage it into resources/bin so
+      # extraResources bundles it at Contents/Resources/bin — the path runNativeAction
+      # resolves. Self-contained: no committed binary, built fresh against the pinned
+      # target. If it ever fails to ship, the calendar tools report "not available" and
+      # the rest of the app is unaffected, so it can't break a release.
+      - name: Build native actions helper (computer use, semantic rail)
+        run: |
+          bash scripts/build-actions-helper.sh
+          mkdir -p resources/bin
+          cp scripts/actions-helper/actions-helper resources/bin/actions-helper
+          chmod +x resources/bin/actions-helper
       # Stage the Parakeet STT runtime (sherpa-onnx CLI + ONNX model) into
       # resources/bin/parakeet. Additive: with SHERPA_ONNX_URL / PARAKEET_MODEL_URL
       # unset this is a no-op and transcription stays on whisper, so it can't break a
@@ -228,6 +248,10 @@ jobs:
           # drifted lock stops the release instead of resolving a graph nobody committed.
           npm --prefix ../shared ci
           npm --prefix ../shared/packages/sync run build
+          # @offgrid/use (the durable action engine) is consumed the same way as sync
+          # and needs the same explicit build - file-dep prepare alone does not emit
+          # its dist/ types before the typecheck runs.
+          npm --prefix ../shared/packages/use run build
           npm --prefix ../shared/packages/models run build
       - name: Install dependencies
         run: npm ci
@@ -278,7 +302,18 @@ jobs:
           APP="$(find dist -mindepth 2 -maxdepth 2 -type d -name 'Off Grid AI Desktop.app' -print -quit)"
           test -n "$APP"
           node scripts/probe-packaged-tts.mjs "$APP" --synthesize
+      # Internal demo build: hand the signed+notarized DMG back as a run artifact and stop
+      # (the publish steps below are all skipped). Repo-scoped, auto-expiring, no Release.
+      - name: Upload signed DMG as a build artifact
+        if: ${{ inputs.artifact_only }}
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4
+        with:
+          name: OffGrid-macOS-${{ needs.version.outputs.version }}
+          path: dist/OffGrid-*.dmg
+          if-no-files-found: error
+          retention-days: 14
       - name: Stage verified update assets and publish the release
+        if: ${{ !inputs.artifact_only }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.version.outputs.version }}
@@ -310,6 +345,7 @@ jobs:
             gh release edit "$TAG" --draft=false --prerelease
           fi
       - name: Migrate legacy Pro update channel (publish pro-mac.yml)
+        if: ${{ !inputs.artifact_only }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.version.outputs.version }}
@@ -335,7 +371,7 @@ jobs:
       # --clobber replaces the copy from the prior run. The versioned DMG + updater
       # feed (latest-mac.yml) are untouched, so auto-update is unaffected.
       - name: Publish stable latest.dmg alias
-        if: needs.version.outputs.channel == 'stable'
+        if: ${{ !inputs.artifact_only && needs.version.outputs.channel == 'stable' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.version.outputs.version }}
@@ -349,7 +385,7 @@ jobs:
       # /releases/latest or the stable OffGrid-latest.dmg:
       #   https://github.com/off-grid-ai/off-grid-ai-desktop/releases/download/nightly/OffGrid-nightly.dmg
       - name: Publish constant nightly.dmg link
-        if: needs.version.outputs.channel == 'beta'
+        if: ${{ !inputs.artifact_only && needs.version.outputs.channel == 'beta' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.version.outputs.version }}
@@ -367,7 +403,7 @@ jobs:
       # v$VERSION tag exist for beta too, so beta/nightly releases get their changelog on
       # the release page, not just stable.
       - name: Attach release notes
-        if: success()
+        if: ${{ !inputs.artifact_only && success() }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.version.outputs.version }}
@@ -378,7 +414,7 @@ jobs:
       # Slack outage never fails a release. Needs org/repo secret SLACK_WEBHOOK_URL (an
       # Incoming Webhook, channel-bound). No secret => the step is a logged no-op.
       - name: Announce release in Slack
-        if: success()
+        if: ${{ !inputs.artifact_only && success() }}
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
           PRODUCT: Off Grid AI Desktop
@@ -398,6 +434,8 @@ jobs:
   # (the repo's LFS binaries are macOS-only).
   build-win:
     needs: [version, build-mac]
+    # Skipped for an artifact-only demo build (macOS DMG is all the lead needs).
+    if: ${{ !inputs.artifact_only }}
     # windows-2022 = VS 2022 toolchain. windows-latest ships VS 2026, which node-gyp 11
     # can't parse, breaking native-module (better-sqlite3) compiles. Pin until it catches up.
     runs-on: windows-2022
@@ -469,6 +507,10 @@ jobs:
           # drifted lock stops the release instead of resolving a graph nobody committed.
           npm --prefix ../shared ci
           npm --prefix ../shared/packages/sync run build
+          # @offgrid/use (the durable action engine) is consumed the same way as sync
+          # and needs the same explicit build - file-dep prepare alone does not emit
+          # its dist/ types before the typecheck runs.
+          npm --prefix ../shared/packages/use run build
           npm --prefix ../shared/packages/models run build
       - name: Install dependencies
         run: npm ci

.github/workflows/windows-build.yml

@@ -20,6 +20,15 @@ on:
         type: string
         required: false
         default: ''
+      shared_ref:
+        # off-grid-ai/shared carries @offgrid/models|sync|use. This core branch depends
+        # on shared feature work that is NOT on shared main, and the auto match below is
+        # by BRANCH NAME - which differs across repos here - so it would fall back to main
+        # and miss effectId/undo/computer_task. Pin it on dispatch (e.g. feat/use-approval-tiers).
+        description: 'off-grid-ai/shared ref for @offgrid/* (empty = match this branch name, else shared main)'
+        type: string
+        required: false
+        default: ''
 
 permissions:
   contents: read
@@ -75,9 +84,63 @@ jobs:
         with:
           python-version: '3.12'
 
+      # `@offgrid/sync` and `@offgrid/use` are file: dependencies on the shared
+      # monorepo, so it must sit BESIDE this checkout before `npm ci` runs -
+      # mirrors release.yml's build-win. The branch ref decides the shared ref:
+      # a build from an integration branch takes the shared branch of the same
+      # name when one exists, else shared main.
+      - name: Checkout shared at the matching ref
+        id: shared_branch
+        continue-on-error: true
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/shared
+          token: ${{ secrets.CI_CROSS_REPO_TOKEN }}
+          ref: ${{ inputs.shared_ref || github.ref_name }}
+          path: _shared
+          persist-credentials: false
+      - name: Fall back to shared main
+        if: ${{ steps.shared_branch.outcome != 'success' }}
+        continue-on-error: true
+        uses: actions/checkout@v4
+        with:
+          repository: off-grid-ai/shared
+          token: ${{ secrets.CI_CROSS_REPO_TOKEN }}
+          path: _shared
+          persist-credentials: false
+      - name: Put shared beside this checkout
+        shell: bash
+        run: |
+          if [ ! -d _shared ]; then
+            echo "::error::off-grid-ai/shared was not checked out - @offgrid/sync and @offgrid/use cannot resolve. Check CI_CROSS_REPO_TOKEN."
+            exit 1
+          fi
+          rm -rf ../shared
+          mv _shared ../shared
+          npm --prefix ../shared ci
+          npm --prefix ../shared/packages/models run build
+          npm --prefix ../shared/packages/sync run build
+          npm --prefix ../shared/packages/use run build
+
       - name: Install dependencies
         run: npm ci
 
+      - name: Verify the computer-use input addon (nut.js) shipped for Windows
+        shell: pwsh
+        run: |
+          # The vision computer-use rail drives the cursor/keyboard through
+          # @nut-tree-fork/nut-js, whose Windows binding is the prebuilt (N-API)
+          # libnut-win32 addon - an OPTIONAL dependency. If npm skips it or the
+          # prebuild fails to land, the rail loads null and refuses every task
+          # silently. Fail the build loudly instead, the same way
+          # fetch-win-binaries.ps1 fails on a missing llama-server.exe.
+          $addon = "node_modules/@nut-tree-fork/libnut-win32/build/Release/libnut.node"
+          if (-not (Test-Path $addon)) {
+            Write-Error "Missing $addon - the Windows computer-use rail would refuse every task. Confirm @nut-tree-fork/libnut-win32 installed (optional dep)."
+            exit 1
+          }
+          Write-Host "OK: computer-use addon present ($((Get-Item $addon).Length) bytes)"
+
       - name: Fetch Windows native binaries (llama/whisper/sd/ffmpeg)
         shell: pwsh
         env:

.gitignore

@@ -55,6 +55,7 @@ test-results/
 # Marketing material (dev.to drafts, emails, assets) — publishing, not app code
 /marketing/
 scripts/dictation-hotkey/dictation-hotkey
+scripts/actions-helper/actions-helper
 
 # Local demo profile — synthetic-data run target for `npm run demo` (never real userData)
 .demo-profile/