feat(ci): add release infrastructure with CI gates, versioning, and publishing

.github/workflows/ci.yml

@@ -0,0 +1,52 @@
+# CI quality gates — runs lint, typecheck, test, and build on every PR to main.
+# The workflow name "CI" is used as a required status check in branch protection.
+
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    name: Quality Gates
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        id: checkout
+        uses: actions/checkout@v4
+
+      - name: Set up pnpm
+        id: setup-pnpm
+        uses: pnpm/action-setup@v5
+
+      - name: Set up Node.js
+        id: setup-node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        id: install-deps
+        run: pnpm install --frozen-lockfile
+
+      - name: Run lint
+        id: lint
+        run: pnpm lint
+
+      - name: Run typecheck
+        id: typecheck
+        run: pnpm typecheck
+
+      - name: Run tests
+        id: test
+        run: pnpm test
+
+      - name: Run build
+        id: build
+        run: pnpm build

.github/workflows/release-please.yml

@@ -0,0 +1,39 @@
+# Release Please — analyzes conventional commits on main, creates/updates a release PR
+# with version bumps and changelog, then enables auto-merge so CI gates are the only barrier.
+
+name: Release Please
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    name: Release Please
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        id: checkout
+        uses: actions/checkout@v4
+
+      - name: Run Release Please
+        id: release-please
+        uses: googleapis/release-please-action@v4
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+      # Enable auto-merge so the release PR merges automatically once CI passes.
+      # GR-5: no error suppression — if auto-merge can't be enabled, this step fails the workflow.
+      - name: Enable auto-merge for release PR
+        id: auto-merge
+        if: ${{ steps.release-please.outputs.pr }}
+        run: gh pr merge --auto --squash "$PR_NUMBER"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ fromJSON(steps.release-please.outputs.pr).number }}

.github/workflows/release-publish.yml

@@ -0,0 +1,126 @@
+# Release Publish — triggers after Release Please completes, rebuilds from clean state,
+# packages the extension zip, and uploads the artifact to the GitHub Release created by Release Please.
+#
+# Guardrails enforced:
+#   GR-1: Only proceeds if triggering workflow succeeded
+#   GR-2: Checks out ref:main explicitly (not default workflow_run context)
+#   GR-3: Early-exit if no release was created (idempotent Release Please re-run)
+#   GR-4: Explicit minimal permissions
+
+name: Release Publish
+
+on:
+  workflow_run:
+    workflows: ["Release Please"]
+    types: [completed]
+
+permissions:
+  contents: write
+
+jobs:
+  publish:
+    name: Build and Publish Release
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release-please.outputs['apps/extension--release_created'] }}
+      tag_name: ${{ steps.release-please.outputs['apps/extension--tag_name'] }}
+      version: ${{ steps.release-please.outputs['apps/extension--version'] }}
+    # GR-1: only run if the triggering workflow succeeded
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+
+    steps:
+      # GR-2: checkout ref:main explicitly — workflow_run default context is the PR head, not the merge commit
+      - name: Checkout repository
+        id: checkout
+        uses: actions/checkout@v4
+        with:
+          ref: main
+
+      # Re-run Release Please (idempotent) to access component-keyed outputs.
+      # workflow_run cannot access the triggering workflow's step outputs.
+      - name: Run Release Please
+        id: release-please
+        uses: googleapis/release-please-action@v4
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+      # GR-3: skip all remaining steps if no release was created
+      - name: Set up pnpm
+        id: setup-pnpm
+        if: ${{ steps.release-please.outputs['apps/extension--release_created'] }}
+        uses: pnpm/action-setup@v5
+
+      - name: Set up Node.js
+        id: setup-node
+        if: ${{ steps.release-please.outputs['apps/extension--release_created'] }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        id: install-deps
+        if: ${{ steps.release-please.outputs['apps/extension--release_created'] }}
+        run: pnpm install --frozen-lockfile
+
+      - name: Run build
+        id: build
+        if: ${{ steps.release-please.outputs['apps/extension--release_created'] }}
+        run: pnpm --filter @vxrtx/extension build
+
+      - name: Validate version alignment
+        id: validate-versions
+        if: ${{ steps.release-please.outputs['apps/extension--release_created'] }}
+        run: |
+          node -e "
+            const pkg = require('./apps/extension/package.json');
+            const manifest = require('./apps/extension/public/manifest.json');
+            if (pkg.version !== manifest.version) {
+              console.log('::error::Version mismatch: package.json=' + pkg.version + ' manifest.json=' + manifest.version);
+              process.exit(1);
+            }
+            console.log('Versions aligned: ' + pkg.version);
+          "
+
+      - name: Package extension zip
+        id: package-zip
+        if: ${{ steps.release-please.outputs['apps/extension--release_created'] }}
+        run: pnpm --filter @vxrtx/extension package:zip
+
+      # Release Please already creates the GitHub Release with changelog notes.
+      # We just upload the zip artifact to the existing release.
+      - name: Upload release artifact
+        id: upload-artifact
+        if: ${{ steps.release-please.outputs['apps/extension--release_created'] }}
+        run: gh release upload "$TAG_NAME" apps/extension/vxrtx-extension-*.zip --clobber
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ steps.release-please.outputs['apps/extension--tag_name'] }}
+
+  # Phase 2: Chrome Web Store draft upload.
+  # Runs as a separate job so CWS failures don't affect the GitHub Release.
+  # Skipped entirely until CWS_EXTENSION_ID is configured as a repository variable.
+  cws-upload:
+    name: Upload to Chrome Web Store
+    runs-on: ubuntu-latest
+    needs: publish
+    if: ${{ needs.publish.outputs.release_created == 'true' && vars.CWS_EXTENSION_ID != '' }}
+
+    steps:
+      - name: Download release artifact
+        id: download-artifact
+        run: gh release download "$TAG_NAME" --pattern "vxrtx-extension-*.zip" --dir .
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          TAG_NAME: ${{ needs.publish.outputs.tag_name }}
+
+      - name: Upload draft to Chrome Web Store
+        id: cws-upload
+        run: npx chrome-webstore-upload-cli@3.5.0 upload --source vxrtx-extension-*.zip --auto-publish false
+        env:
+          EXTENSION_ID: ${{ vars.CWS_EXTENSION_ID }}
+          CLIENT_ID: ${{ secrets.CWS_CLIENT_ID }}
+          CLIENT_SECRET: ${{ secrets.CWS_CLIENT_SECRET }}
+          REFRESH_TOKEN: ${{ secrets.CWS_REFRESH_TOKEN }}

.gitignore

@@ -3,6 +3,7 @@ dist/
 .turbo/
 *.local
 .DS_Store
+docs/
 
 # Environment variables
 .env

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  "apps/extension": "0.1.0"
+}

apps/extension/.gitignore

@@ -0,0 +1 @@
+*.zip

apps/extension/package.json

@@ -10,7 +10,9 @@
     "preview": "vite preview",
     "test": "vitest run",
     "test:watch": "vitest",
-    "lint": "eslint src/"
+    "lint": "biome check src/",
+    "typecheck": "tsc --noEmit",
+    "package:zip": "[ -d dist ] && [ \"$(ls -A dist)\" ] && rm -f vxrtx-extension-*.zip && cd dist && zip -r ../vxrtx-extension-$npm_package_version.zip . || { echo '::error::dist/ is missing or empty — run build first'; exit 1; }"
   },
   "dependencies": {
     "react": "^19.2.4",
@@ -24,7 +26,6 @@
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "autoprefixer": "^10.4.27",
-    "eslint": "^10.1.0",
     "postcss": "^8.5.8",
     "tailwindcss": "^4.2.2",
     "typescript": "^6.0.2",

apps/extension/src/ai/parser.ts

@@ -1,17 +1,27 @@
 import { z } from "zod";
-import type { TabOrganizationAIResult } from "./types";
 import type { TabGroupColor } from "@/shared/types";
+import type { TabOrganizationAIResult } from "./types";
 
 const TAB_GROUP_COLORS: TabGroupColor[] = [
-  "grey", "blue", "red", "yellow", "green", "pink", "purple", "cyan", "orange",
+  "grey",
+  "blue",
+  "red",
+  "yellow",
+  "green",
+  "pink",
+  "purple",
+  "cyan",
+  "orange",
 ];
 
 const TabGroupSuggestionSchema = z.object({
-  name: z.string(),
-  color: z.string().transform((c) =>
-    TAB_GROUP_COLORS.includes(c as TabGroupColor) ? c as TabGroupColor : "grey"
-  ),
-  tabIds: z.array(z.number()),
+  name: z.string().trim().min(1, "Group name must not be empty"),
+  color: z
+    .string()
+    .transform((c) =>
+      TAB_GROUP_COLORS.includes(c as TabGroupColor) ? (c as TabGroupColor) : "grey",
+    ),
+  tabIds: z.array(z.number()).min(1, "Group must contain at least one tab"),
 });
 
 const TabOrganizationSchema = z.object({
@@ -22,8 +32,16 @@ const TabOrganizationSchema = z.object({
 });
 
 const BookmarkFolderSchema = z.object({
-  name: z.string(),
-  bookmarkIds: z.array(z.string()),
+  name: z
+    .string()
+    .trim()
+    .min(1, "Folder name must not be empty")
+    .refine(
+      (n) => !n.startsWith("/") && !n.endsWith("/") && !n.includes("//"),
+      "Folder name must not have leading/trailing or double slashes",
+    )
+    .refine((n) => n.split("/").length <= 3, "Folder nesting must not exceed 3 levels"),
+  bookmarkIds: z.array(z.string()).min(1, "Folder must contain at least one bookmark"),
 });
 
 const BookmarkOrganizationSchema = z.object({
@@ -43,6 +61,55 @@ const BookmarkLocationSchema = z.object({
   suggestions: z.array(LocationSuggestionSchema),
 });
 
+class JsonExtractionError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "JsonExtractionError";
+  }
+}
+
+function isRetryableParseError(err: unknown): boolean {
+  return (
+    err instanceof SyntaxError || err instanceof z.ZodError || err instanceof JsonExtractionError
+  );
+}
+
+/**
+ * Retry wrapper: attempts parse, on failure retries the LLM call with error context.
+ * Max 1 retry (2 total attempts). Only retries on parse/validation failures — API and runtime errors propagate immediately.
+ */
+export async function withRetry<T>(
+  completeFn: (errorContext?: string) => Promise<string>,
+  parseFn: (raw: string) => T,
+  onStatus?: (message: string) => void,
+): Promise<T> {
+  // First attempt: let API errors propagate, only catch retryable parse/validation failures
+  onStatus?.("Waiting for AI response...");
+  const raw = await completeFn();
+  onStatus?.("Processing AI response...");
+  try {
+    return parseFn(raw);
+  } catch (parseErr) {
+    if (!isRetryableParseError(parseErr)) {
+      throw parseErr;
+    }
+    // Parse failed — retry with error context
+    onStatus?.("Response invalid, retrying...");
+    const errMsg = (parseErr instanceof Error ? parseErr.message : String(parseErr)).slice(0, 500);
+    const errorContext = `Your previous response failed validation: ${errMsg}. Return ONLY valid JSON matching the schema exactly.`;
+    const retryRaw = await completeFn(errorContext);
+    onStatus?.("Processing retry response...");
+    try {
+      return parseFn(retryRaw);
+    } catch (secondErr) {
+      throw new Error(
+        `AI response could not be parsed after 2 attempts. Last error: ${secondErr instanceof Error ? secondErr.message : String(secondErr)}`,
+        { cause: secondErr },
+      );
+    }
+  }
+}
+
 export function parseTabOrganization(raw: string): TabOrganizationAIResult {
   const json = extractJson(raw);
   const parsed = TabOrganizationSchema.parse(json);
@@ -77,6 +144,6 @@ function extractJson(text: string): unknown {
       return JSON.parse(text.slice(firstBrace, lastBrace + 1));
     }
 
-    throw new Error("No valid JSON found in AI response");
+    throw new JsonExtractionError("No valid JSON found in AI response");
   }
 }