openab-agent: multi-vendor OAuth ADR + cross-process auth.json locking (codex + MCP)

.github/workflows/ci-openab-agent.yml

@@ -24,18 +24,40 @@ jobs:
       - uses: Swatinem/rust-cache@v2
         with:
           workspaces: openab-agent
+      # openab-agent is a standalone crate, not a member of the parent openab
+      # workspace (members = crates/openab-core, openab-gateway) and not excluded,
+      # so cargo run from this directory errors "believes it's in a workspace when
+      # it's not". Declare an empty workspace, mirroring Dockerfile.unified, so
+      # every cargo step below resolves it as its own root.
+      - run: printf '\n[workspace]\n' >> Cargo.toml
       - run: cargo fmt --check
       - run: cargo clippy -- -D warnings
       - run: cargo test
       - run: cargo test -- --ignored
         env:
           ANTHROPIC_API_KEY: "fake-key-for-ci"
+      # Build in its own step so a build failure is distinct from a smoke failure
+      # and the timed run below races only the binary, not a concurrent compile.
+      - name: Build release binary
+        run: cargo build --release
       - name: ACP smoke test
         run: |
-          cargo build --release
-          # Test: initialize returns valid ACP response
-          RESP=$(echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}' | timeout 5 ./target/release/openab-agent 2>/dev/null | head -1)
+          set +e
+          echo '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}' \
+            | timeout 30 ./target/release/openab-agent > /tmp/acp_out.txt 2> /tmp/acp_err.txt
+          code=$?
+          set -e
+          echo "exit code: $code"
+          echo "--- stdout ---"; cat /tmp/acp_out.txt
+          echo "--- stderr ---"; cat /tmp/acp_err.txt
+          # Enforce the captured exit code: a hang killed by `timeout` returns 124,
+          # a crash returns non-zero — either must fail the step, not slip through.
+          if [ "$code" -ne 0 ]; then
+            echo "FAIL: agent exited $code (124 = timed out / hung)"; exit "$code"
+          fi
+          RESP=$(head -1 /tmp/acp_out.txt)
           echo "Response: $RESP"
-          echo "$RESP" | grep -q '"agentInfo"' || (echo "FAIL: no agentInfo in response" && exit 1)
-          echo "$RESP" | grep -q '"openab-agent"' || (echo "FAIL: wrong agent name" && exit 1)
+          # `{ ...; }` (not a subshell) so `exit` fails the whole step, not just the group.
+          echo "$RESP" | grep -q '"agentInfo"' || { echo "FAIL: no agentInfo in response"; exit 1; }
+          echo "$RESP" | grep -q '"openab-agent"' || { echo "FAIL: wrong agent name"; exit 1; }
           echo "✅ ACP initialize OK"