fix: skip windows exe patching in ci mode to avoid wine dependency

The server release CI workflow fails on ubuntu-latest because
patch-windows-exe.ts requires Wine to run rcedit. Thread the existing
--ci flag through compileServerBinaries so Windows PE metadata patching
is skipped in CI mode with a warning log.

.gitattributes

@@ -9,4 +9,6 @@ packages/browseros/chromium_patches/**/*.py linguist-generated
 scripts/*.py linguist-generated
 # Mark build directories as generated
 build/* linguist-generated
+# Mark eval/test framework as vendored so it's excluded from language stats
+packages/browseros-agent/apps/eval/** linguist-vendored
 docs/videos/** filter=lfs diff=lfs merge=lfs -text

.github/workflows/release-server.yml

@@ -0,0 +1,147 @@
+name: Release BrowserOS Server
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release version (e.g. 0.0.80)"
+        required: true
+        type: string
+
+concurrency:
+  group: release-server
+  cancel-in-progress: false
+
+jobs:
+  release:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    environment: release-core
+    permissions:
+      contents: write
+    defaults:
+      run:
+        working-directory: packages/browseros-agent
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.6"
+
+      - name: Install dependencies
+        run: bun ci
+
+      - name: Prepare production env file
+        run: cp apps/server/.env.production.example apps/server/.env.production
+
+      - name: Validate version
+        id: version
+        env:
+          REQUESTED_VERSION: ${{ inputs.version }}
+        run: |
+          PACKAGE_VERSION=$(node -p "require('./apps/server/package.json').version")
+          echo "package_version=$PACKAGE_VERSION" >> "$GITHUB_OUTPUT"
+          echo "release_sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+          if [ "$PACKAGE_VERSION" != "$REQUESTED_VERSION" ]; then
+            echo "Requested version $REQUESTED_VERSION does not match apps/server/package.json ($PACKAGE_VERSION)"
+            exit 1
+          fi
+
+      - name: Build release artifacts
+        run: bun run build:server:ci
+
+      - name: Verify release artifacts
+        run: |
+          mapfile -t ZIP_FILES < <(find dist/prod/server -maxdepth 1 -type f -name 'browseros-server-resources-*.zip' | sort)
+
+          if [ "${#ZIP_FILES[@]}" -eq 0 ]; then
+            echo "No server release zip files were produced"
+            exit 1
+          fi
+
+          printf 'Found release artifacts:\n%s\n' "${ZIP_FILES[@]}"
+
+      - name: Generate release notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PACKAGE_VERSION: ${{ steps.version.outputs.package_version }}
+        run: |
+          SERVER_APP_PATH="packages/browseros-agent/apps/server"
+          SERVER_BUILD_DIR="packages/browseros-agent/scripts/build/server"
+          SERVER_BUILD_ENTRY="packages/browseros-agent/scripts/build/server.ts"
+          SERVER_RESOURCE_MANIFEST="packages/browseros-agent/scripts/build/config/server-prod-resources.json"
+          SERVER_WORKSPACE_PKG="packages/browseros-agent/package.json"
+          CURRENT_TAG="browseros-server-v$PACKAGE_VERSION"
+          PREV_TAG=$(git tag -l "browseros-server-v*" --sort=-v:refname | grep -v "^${CURRENT_TAG}$" | head -n 1)
+
+          if [ -z "$PREV_TAG" ]; then
+            echo "Initial release of browseros-server." > /tmp/release-notes.md
+          else
+            COMMITS=$(git log "$PREV_TAG"..HEAD --pretty=format:"%H" -- \
+              "$SERVER_APP_PATH" \
+              "$SERVER_BUILD_DIR" \
+              "$SERVER_BUILD_ENTRY" \
+              "$SERVER_RESOURCE_MANIFEST" \
+              "$SERVER_WORKSPACE_PKG")
+
+            if [ -z "$COMMITS" ]; then
+              echo "No notable changes." > /tmp/release-notes.md
+            else
+              echo "## What's Changed" > /tmp/release-notes.md
+              echo "" >> /tmp/release-notes.md
+
+              while IFS= read -r SHA; do
+                SUBJECT=$(git log -1 --pretty=format:"%s" "$SHA")
+                PR_NUM=$(gh api "/repos/${{ github.repository }}/commits/${SHA}/pulls" --jq '.[0].number // empty' 2>/dev/null)
+
+                if [ -n "$PR_NUM" ] && ! echo "$SUBJECT" | grep -qF "(#${PR_NUM})"; then
+                  echo "- ${SUBJECT} (#${PR_NUM})" >> /tmp/release-notes.md
+                else
+                  echo "- ${SUBJECT}" >> /tmp/release-notes.md
+                fi
+              done <<< "$COMMITS"
+            fi
+          fi
+        working-directory: ${{ github.workspace }}
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PACKAGE_VERSION: ${{ steps.version.outputs.package_version }}
+          RELEASE_SHA: ${{ steps.version.outputs.release_sha }}
+        run: |
+          TAG="browseros-server-v$PACKAGE_VERSION"
+          TITLE="BrowserOS Server - v$PACKAGE_VERSION"
+          mapfile -t ZIP_FILES < <(find packages/browseros-agent/dist/prod/server -maxdepth 1 -type f -name 'browseros-server-resources-*.zip' | sort)
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          if git rev-parse "$TAG" >/dev/null 2>&1; then
+            echo "Tag $TAG already exists, skipping tag creation"
+          else
+            git tag -a "$TAG" -m "browseros-server v$PACKAGE_VERSION" "$RELEASE_SHA"
+          fi
+
+          if git ls-remote --tags origin "$TAG" | grep -q "$TAG"; then
+            echo "Tag $TAG already on remote, skipping push"
+          else
+            git push origin "$TAG"
+          fi
+
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            echo "Release $TAG already exists, updating"
+            gh release edit "$TAG" --title "$TITLE" --notes-file /tmp/release-notes.md
+            gh release upload "$TAG" "${ZIP_FILES[@]}" --clobber
+          else
+            gh release create "$TAG" \
+              --title "$TITLE" \
+              --notes-file /tmp/release-notes.md \
+              "${ZIP_FILES[@]}"
+          fi
+        working-directory: ${{ github.workspace }}

README.md

@@ -192,7 +192,7 @@ We'd love your help making BrowserOS better! See our [Contributing Guide](CONTRI
 
 BrowserOS is open source under the [AGPL-3.0 license](LICENSE).
 
-Copyright © 2025 Felafax, Inc.
+Copyright © 2026 Felafax, Inc.
 
 ## Stargazers
 

packages/browseros-agent/apps/server/tests/build.test.ts

@@ -8,11 +8,16 @@
 
 import { afterAll, describe, it } from 'bun:test'
 import assert from 'node:assert'
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 
-// Derive the build target from the current platform so the test is portable
 function getNativeTarget(): { id: string; ext: string } {
   const os =
     process.platform === 'darwin'
@@ -24,12 +29,30 @@ function getNativeTarget(): { id: string; ext: string } {
   return { id: `${os}-${cpu}`, ext: process.platform === 'win32' ? '.exe' : '' }
 }
 
-// Stub values so the build config validation passes without real secrets
-const BUILD_ENV_STUBS: Record<string, string> = {
+const REQUIRED_INLINE_ENV_KEYS = [
+  'BROWSEROS_CONFIG_URL',
+  'CODEGEN_SERVICE_URL',
+  'POSTHOG_API_KEY',
+  'SENTRY_DSN',
+] as const
+
+const R2_ENV_KEYS = [
+  'R2_ACCOUNT_ID',
+  'R2_ACCESS_KEY_ID',
+  'R2_SECRET_ACCESS_KEY',
+  'R2_BUCKET',
+] as const
+
+const PROD_SECRET_KEYS = [...REQUIRED_INLINE_ENV_KEYS, ...R2_ENV_KEYS]
+
+const INLINE_ENV_STUBS: Record<string, string> = {
   BROWSEROS_CONFIG_URL: 'https://stub.test/config',
   CODEGEN_SERVICE_URL: 'https://stub.test/codegen',
   POSTHOG_API_KEY: 'phc_test_stub',
   SENTRY_DSN: 'https://stub@sentry.test/0',
+}
+
+const R2_ENV_STUBS: Record<string, string> = {
   R2_ACCOUNT_ID: 'test',
   R2_ACCESS_KEY_ID: 'test',
   R2_SECRET_ACCESS_KEY: 'test',
@@ -39,23 +62,58 @@ const BUILD_ENV_STUBS: Record<string, string> = {
 describe('server build', () => {
   const rootDir = resolve(import.meta.dir, '../../..')
   const serverPkgPath = resolve(rootDir, 'apps/server/package.json')
+  const prodEnvPath = resolve(rootDir, 'apps/server/.env.production')
+  const prodEnvTemplatePath = resolve(
+    rootDir,
+    'apps/server/.env.production.example',
+  )
+  const originalProdEnv = existsSync(prodEnvPath)
+    ? readFileSync(prodEnvPath, 'utf-8')
+    : null
+  const prodEnvTemplate = readFileSync(prodEnvTemplatePath, 'utf-8')
   const buildScript = resolve(rootDir, 'scripts/build/server.ts')
   const target = getNativeTarget()
   const binaryPath = resolve(
     rootDir,
     `dist/prod/server/.tmp/binaries/browseros-server-${target.id}${target.ext}`,
   )
-
-  // Empty manifest so the build skips R2 resource downloads
+  const zipPath = resolve(
+    rootDir,
+    `dist/prod/server/browseros-server-resources-${target.id}.zip`,
+  )
   const tempDir = mkdtempSync(join(tmpdir(), 'browseros-build-test-'))
   const emptyManifestPath = join(tempDir, 'empty-manifest.json')
   writeFileSync(emptyManifestPath, JSON.stringify({ resources: [] }))
 
+  function buildEnv(
+    extraEnv: Record<string, string>,
+    omitKeys: readonly string[] = [],
+  ): NodeJS.ProcessEnv {
+    const env: NodeJS.ProcessEnv = {
+      ...process.env,
+      ...extraEnv,
+    }
+    for (const key of omitKeys) {
+      delete env[key]
+    }
+    return env
+  }
+
+  function resetProdEnvToTemplate(): void {
+    writeFileSync(prodEnvPath, prodEnvTemplate)
+  }
+
   afterAll(() => {
     rmSync(tempDir, { recursive: true, force: true })
+    if (originalProdEnv === null) {
+      rmSync(prodEnvPath, { force: true })
+      return
+    }
+    writeFileSync(prodEnvPath, originalProdEnv)
   })
 
   it('compiles and --version outputs correct version', async () => {
+    resetProdEnvToTemplate()
     const pkg = await Bun.file(serverPkgPath).json()
     const expectedVersion: string = pkg.version
 
@@ -71,7 +129,7 @@ describe('server build', () => {
         cwd: rootDir,
         stdout: 'pipe',
         stderr: 'pipe',
-        env: { ...process.env, ...BUILD_ENV_STUBS },
+        env: buildEnv({ ...INLINE_ENV_STUBS, ...R2_ENV_STUBS }),
       },
     )
     const buildExit = await build.exited
@@ -97,4 +155,48 @@ describe('server build', () => {
     )
     assert.strictEqual(versionOutput.trim(), expectedVersion)
   }, 300_000)
+
+  it('keeps compile-only on the strict production validation path', async () => {
+    resetProdEnvToTemplate()
+
+    const build = Bun.spawn(
+      ['bun', buildScript, `--target=${target.id}`, '--compile-only'],
+      {
+        cwd: rootDir,
+        stdout: 'pipe',
+        stderr: 'pipe',
+        env: buildEnv({}, PROD_SECRET_KEYS),
+      },
+    )
+    const buildExit = await build.exited
+    const stderr = await new Response(build.stderr).text()
+
+    assert.notStrictEqual(buildExit, 0, 'Compile-only build should fail')
+    assert.match(stderr, /Production build requires variables:/)
+    assert.match(stderr, /CODEGEN_SERVICE_URL/)
+    assert.match(stderr, /POSTHOG_API_KEY/)
+    assert.match(stderr, /SENTRY_DSN/)
+  }, 300_000)
+
+  it('archives CI builds without R2 config or production env secrets', async () => {
+    resetProdEnvToTemplate()
+    rmSync(zipPath, { force: true })
+
+    const build = Bun.spawn(
+      ['bun', buildScript, `--target=${target.id}`, '--ci'],
+      {
+        cwd: rootDir,
+        stdout: 'pipe',
+        stderr: 'pipe',
+        env: buildEnv({}, PROD_SECRET_KEYS),
+      },
+    )
+    const buildExit = await build.exited
+    if (buildExit !== 0) {
+      const stderr = await new Response(build.stderr).text()
+      assert.fail(`CI build failed (exit ${buildExit}):\n${stderr}`)
+    }
+
+    assert.ok(existsSync(zipPath), `Expected archive at ${zipPath}`)
+  }, 300_000)
 })

packages/browseros-agent/package.json

@@ -19,7 +19,7 @@
     "start:agent": "bun run --filter @browseros/agent dev",
     "build": "bun run build:server && bun run build:agent",
     "build:server": "FORCE_COLOR=1 bun scripts/build/server.ts --target=all",
-    "build:server:ci": "FORCE_COLOR=1 bun scripts/build/server.ts --target=all --compile-only",
+    "build:server:ci": "FORCE_COLOR=1 bun scripts/build/server.ts --target=all --ci",
     "build:server:test": "FORCE_COLOR=1 bun scripts/build/server.ts --target=darwin-arm64 --no-upload",
     "upload:cli-installers": "bun scripts/build/cli.ts",
     "start:server:test": "bun run build:server:test && set -a && . apps/server/.env.development && set +a && dist/prod/server/.tmp/binaries/browseros-server-darwin-arm64",

packages/browseros-agent/scripts/build/server/archive.ts

@@ -37,29 +37,39 @@ export async function archiveAndUploadArtifacts(
   r2: R2Config,
   upload: boolean,
 ): Promise<UploadResult[]> {
-  const results: UploadResult[] = []
+  const results = await archiveArtifacts(artifacts)
+  if (!upload) {
+    return results
+  }
 
-  for (const artifact of artifacts) {
-    const zipPath = zipPathForArtifact(artifact)
-    await zipArtifactRoot(artifact.rootDir, zipPath)
-
-    if (!upload) {
-      results.push({ targetId: artifact.target.id, zipPath })
-      continue
-    }
-
-    const fileName = basename(zipPath)
+  const uploadedResults: UploadResult[] = []
+  for (const result of results) {
+    const fileName = basename(result.zipPath)
     const latestR2Key = joinObjectKey(r2.uploadPrefix, 'latest', fileName)
     const versionR2Key = joinObjectKey(r2.uploadPrefix, version, fileName)
-    await uploadFileToObject(client, r2, latestR2Key, zipPath)
-    await uploadFileToObject(client, r2, versionR2Key, zipPath)
-    results.push({
-      targetId: artifact.target.id,
-      zipPath,
+    await uploadFileToObject(client, r2, latestR2Key, result.zipPath)
+    await uploadFileToObject(client, r2, versionR2Key, result.zipPath)
+    uploadedResults.push({
+      targetId: result.targetId,
+      zipPath: result.zipPath,
       latestR2Key,
       versionR2Key,
     })
   }
 
+  return uploadedResults
+}
+
+export async function archiveArtifacts(
+  artifacts: StagedArtifact[],
+): Promise<UploadResult[]> {
+  const results: UploadResult[] = []
+
+  for (const artifact of artifacts) {
+    const zipPath = zipPathForArtifact(artifact)
+    await zipArtifactRoot(artifact.rootDir, zipPath)
+    results.push({ targetId: artifact.target.id, zipPath })
+  }
+
   return results
 }

packages/browseros-agent/scripts/build/server/cli.ts

@@ -23,7 +23,11 @@ export function parseBuildArgs(argv: string[]): BuildArgs {
     .option('--no-upload', 'Skip zip upload to R2')
     .option(
       '--compile-only',
-      'Compile binaries only (skip R2 staging and upload)',
+      'Compile binaries only (skip artifact packaging, R2 staging, and upload)',
+    )
+    .option(
+      '--ci',
+      'Build local release zip artifacts for CI without R2 and without requiring production env secrets',
     )
   program.parse(argv, { from: 'user' })
   const options = program.opts<{
@@ -31,14 +35,23 @@ export function parseBuildArgs(argv: string[]): BuildArgs {
     manifest: string
     upload: boolean
     compileOnly: boolean
+    ci: boolean
   }>()
 
   const compileOnly = options.compileOnly ?? false
+  const ci = options.ci ?? false
+  if (ci && compileOnly) {
+    throw new Error('--ci cannot be combined with --compile-only')
+  }
+  if (ci && options.upload) {
+    throw new Error('--ci cannot be combined with --upload')
+  }
 
   return {
     targets: resolveTargets(options.target),
     manifestPath: options.manifest,
-    upload: compileOnly ? false : (options.upload ?? true),
+    upload: ci || compileOnly ? false : (options.upload ?? true),
     compileOnly,
+    ci,
   }
 }

packages/browseros-agent/scripts/build/server/compile.ts

@@ -1,6 +1,7 @@
 import { mkdirSync, rmSync } from 'node:fs'
 import { join } from 'node:path'
 
+import { log } from '../log'
 import { wasmBinaryPlugin } from '../plugins/wasm-binary'
 import { runCommand } from './command'
 import type { BuildTarget, CompiledServerBinary } from './types'
@@ -52,6 +53,7 @@ async function bundleServer(
 async function compileTarget(
   target: BuildTarget,
   env: NodeJS.ProcessEnv,
+  ci: boolean,
 ): Promise<string> {
   const binaryPath = compiledBinaryPath(target)
   const args = [
@@ -66,11 +68,15 @@ async function compileTarget(
   await runCommand('bun', args, env)
 
   if (target.os === 'windows') {
-    await runCommand(
-      'bun',
-      ['scripts/patch-windows-exe.ts', binaryPath],
-      process.env,
-    )
+    if (ci) {
+      log.warn('Skipping Windows exe metadata patching in CI mode')
+    } else {
+      await runCommand(
+        'bun',
+        ['scripts/patch-windows-exe.ts', binaryPath],
+        process.env,
+      )
+    }
   }
 
   return binaryPath
@@ -81,14 +87,16 @@ export async function compileServerBinaries(
   envVars: Record<string, string>,
   processEnv: NodeJS.ProcessEnv,
   version: string,
+  options?: { ci?: boolean },
 ): Promise<CompiledServerBinary[]> {
+  const ci = options?.ci ?? false
   rmSync(TMP_ROOT, { recursive: true, force: true })
   mkdirSync(BINARIES_DIR, { recursive: true })
   await bundleServer(envVars, version)
 
   const compiled: CompiledServerBinary[] = []
   for (const target of targets) {
-    const binaryPath = await compileTarget(target, processEnv)
+    const binaryPath = await compileTarget(target, processEnv, ci)
     compiled.push({ target, binaryPath })
   }
 

packages/browseros-agent/scripts/build/server/config.ts

@@ -76,6 +76,7 @@ function validateProductionEnv(envVars: Record<string, string>): void {
 
 export interface LoadBuildConfigOptions {
   compileOnly?: boolean
+  ci?: boolean
 }
 
 export function loadBuildConfig(
@@ -84,7 +85,9 @@ export function loadBuildConfig(
 ): BuildConfig {
   const fileEnv = loadProdEnv(rootDir)
   const envVars = buildInlineEnv(fileEnv)
-  validateProductionEnv(envVars)
+  if (!options.ci) {
+    validateProductionEnv(envVars)
+  }
 
   const processEnv: NodeJS.ProcessEnv = {
     PATH: process.env.PATH ?? '',
@@ -92,7 +95,7 @@ export function loadBuildConfig(
     ...process.env,
   }
 
-  if (options.compileOnly) {
+  if (options.compileOnly || options.ci) {
     return { version: readServerVersion(rootDir), envVars, processEnv }
   }
 

packages/browseros-agent/scripts/build/server/orchestrator.ts

@@ -2,13 +2,20 @@ import { existsSync } from 'node:fs'
 import { resolve } from 'node:path'
 
 import { log } from '../log'
-import { archiveAndUploadArtifacts } from './archive'
+import { archiveAndUploadArtifacts, archiveArtifacts } from './archive'
 import { parseBuildArgs } from './cli'
 import { compileServerBinaries, getDistProdRoot } from './compile'
 import { loadBuildConfig } from './config'
 import { getTargetRules, loadManifest } from './manifest'
 import { createR2Client } from './r2'
-import { stageTargetArtifact } from './stage'
+import { stageCompiledArtifact, stageTargetArtifact } from './stage'
+
+function buildModeLabel(argv: { compileOnly: boolean; ci: boolean }): string {
+  if (argv.ci) {
+    return 'ci'
+  }
+  return argv.compileOnly ? 'compile-only' : 'full'
+}
 
 export async function runProdResourceBuild(argv: string[]): Promise<void> {
   const rootDir = resolve(import.meta.dir, '../../..')
@@ -18,19 +25,45 @@ export async function runProdResourceBuild(argv: string[]): Promise<void> {
 
   const buildConfig = loadBuildConfig(rootDir, {
     compileOnly: args.compileOnly,
+    ci: args.ci,
   })
 
   log.header(`Building BrowserOS server artifacts v${buildConfig.version}`)
   log.info(`Targets: ${args.targets.map((target) => target.id).join(', ')}`)
-  log.info(`Mode: ${args.compileOnly ? 'compile-only' : 'full'}`)
+  log.info(`Mode: ${buildModeLabel(args)}`)
 
   const compiled = await compileServerBinaries(
     args.targets,
     buildConfig.envVars,
     buildConfig.processEnv,
     buildConfig.version,
+    { ci: args.ci },
   )
 
+  if (args.ci) {
+    const distRoot = getDistProdRoot()
+    const localArtifacts = []
+
+    for (const binary of compiled) {
+      log.step(`Packaging ${binary.target.name}`)
+      const staged = await stageCompiledArtifact(
+        distRoot,
+        binary.binaryPath,
+        binary.target,
+        buildConfig.version,
+      )
+      localArtifacts.push(staged)
+      log.success(`Packaged ${binary.target.id}`)
+    }
+
+    const archiveResults = await archiveArtifacts(localArtifacts)
+    log.done('CI build completed')
+    for (const result of archiveResults) {
+      log.info(`${result.targetId}: ${result.zipPath}`)
+    }
+    return
+  }
+
   if (args.compileOnly) {
     log.done('Compile-only build completed')
     for (const binary of compiled) {

packages/browseros-agent/scripts/build/server/stage.ts

@@ -32,6 +32,36 @@ async function copyServerBinary(
   }
 }
 
+async function createArtifactRoot(
+  distRoot: string,
+  compiledBinaryPath: string,
+  target: BuildTarget,
+): Promise<string> {
+  const rootDir = artifactRoot(distRoot, target)
+  await rm(rootDir, { recursive: true, force: true })
+  await mkdir(rootDir, { recursive: true })
+  await copyServerBinary(
+    compiledBinaryPath,
+    serverDestinationPath(rootDir, target),
+    target,
+  )
+  return rootDir
+}
+
+async function finalizeArtifact(
+  rootDir: string,
+  target: BuildTarget,
+  version: string,
+): Promise<StagedArtifact> {
+  const metadataPath = await writeArtifactMetadata(rootDir, target, version)
+  return {
+    target,
+    rootDir,
+    resourcesDir: join(rootDir, 'resources'),
+    metadataPath,
+  }
+}
+
 function resolveDestination(rootDir: string, destination: string): string {
   const outputPath = join(rootDir, destination)
   const relativePath = relative(rootDir, outputPath)
@@ -67,25 +97,21 @@ export async function stageTargetArtifact(
   r2: R2Config,
   version: string,
 ): Promise<StagedArtifact> {
-  const rootDir = artifactRoot(distRoot, target)
-  await rm(rootDir, { recursive: true, force: true })
-  await mkdir(rootDir, { recursive: true })
-
-  await copyServerBinary(
-    compiledBinaryPath,
-    serverDestinationPath(rootDir, target),
-    target,
-  )
+  const rootDir = await createArtifactRoot(distRoot, compiledBinaryPath, target)
 
   for (const rule of rules) {
     await stageRule(rootDir, rule, target, client, r2)
   }
 
-  const metadataPath = await writeArtifactMetadata(rootDir, target, version)
-  return {
-    target,
-    rootDir,
-    resourcesDir: join(rootDir, 'resources'),
-    metadataPath,
-  }
+  return finalizeArtifact(rootDir, target, version)
+}
+
+export async function stageCompiledArtifact(
+  distRoot: string,
+  compiledBinaryPath: string,
+  target: BuildTarget,
+  version: string,
+): Promise<StagedArtifact> {
+  const rootDir = await createArtifactRoot(distRoot, compiledBinaryPath, target)
+  return finalizeArtifact(rootDir, target, version)
 }

packages/browseros-agent/scripts/build/server/types.ts

@@ -22,6 +22,7 @@ export interface BuildArgs {
   manifestPath: string
   upload: boolean
   compileOnly: boolean
+  ci: boolean
 }
 
 export interface R2Config {

packages/browseros/chromium_patches/chrome/browser/devtools/protocol/browser_handler.cc

@@ -1,8 +1,13 @@
 diff --git a/chrome/browser/devtools/protocol/browser_handler.cc b/chrome/browser/devtools/protocol/browser_handler.cc
-index 30bd52d09c3fc..33c7d6d8455fc 100644
+index 30bd52d09c3fc..dd9ef4e3b7cbb 100644
 --- a/chrome/browser/devtools/protocol/browser_handler.cc
 +++ b/chrome/browser/devtools/protocol/browser_handler.cc
-@@ -8,19 +8,32 @@
+@@ -4,23 +4,37 @@
+ 
+ #include "chrome/browser/devtools/protocol/browser_handler.h"
+ 
++#include <algorithm>
+ #include <set>
  #include <vector>
  
  #include "base/functional/bind.h"
@@ -35,7 +40,7 @@ index 30bd52d09c3fc..33c7d6d8455fc 100644
  #include "content/public/browser/browser_task_traits.h"
  #include "content/public/browser/browser_thread.h"
  #include "content/public/browser/devtools_agent_host.h"
-@@ -30,10 +43,21 @@
+@@ -30,10 +44,21 @@
  #include "ui/gfx/image/image.h"
  #include "ui/gfx/image/image_png_rep.h"
  
@@ -57,7 +62,7 @@ index 30bd52d09c3fc..33c7d6d8455fc 100644
  BrowserWindow* GetBrowserWindow(int window_id) {
    BrowserWindow* result = nullptr;
    ForEachCurrentBrowserWindowInterfaceOrderedByActivation(
-@@ -72,17 +96,411 @@ std::unique_ptr<protocol::Browser::Bounds> GetBrowserWindowBounds(
+@@ -72,17 +97,419 @@ std::unique_ptr<protocol::Browser::Bounds> GetBrowserWindowBounds(
        .Build();
  }
  
@@ -437,6 +442,14 @@ index 30bd52d09c3fc..33c7d6d8455fc 100644
 +    out_indices->push_back(found_index);
 +  }
 +
++  if (!(*out_bwi)->GetTabStripModel()->SupportsTabGroups()) {
++    return Response::ServerError("Tab grouping not supported for this window");
++  }
++
++  std::ranges::sort(*out_indices);
++  out_indices->erase(std::ranges::unique(*out_indices).begin(),
++                     out_indices->end());
++
 +  return Response::Success();
 +}
 +
@@ -471,7 +484,7 @@ index 30bd52d09c3fc..33c7d6d8455fc 100644
  
  Response BrowserHandler::GetWindowForTarget(
      std::optional<std::string> target_id,
-@@ -120,6 +538,65 @@ Response BrowserHandler::GetWindowForTarget(
+@@ -120,6 +547,65 @@ Response BrowserHandler::GetWindowForTarget(
    return Response::Success();
  }
  
@@ -537,7 +550,7 @@ index 30bd52d09c3fc..33c7d6d8455fc 100644
  Response BrowserHandler::GetWindowBounds(
      int window_id,
      std::unique_ptr<protocol::Browser::Bounds>* out_bounds) {
-@@ -297,3 +774,910 @@ protocol::Response BrowserHandler::AddPrivacySandboxEnrollmentOverride(
+@@ -297,3 +783,909 @@ protocol::Response BrowserHandler::AddPrivacySandboxEnrollmentOverride(
        net::SchemefulSite(url_to_add));
    return Response::Success();
  }
@@ -1447,4 +1460,3 @@ index 30bd52d09c3fc..33c7d6d8455fc 100644
 +bool BrowserHandler::IsHiddenWindow(int window_id) const {
 +  return hidden_window_ids_.contains(window_id);
 +}
-+

packages/browseros/chromium_patches/chrome/browser/devtools/protocol/devtools_protocol_browsertest.cc

@@ -0,0 +1,123 @@
+diff --git a/chrome/browser/devtools/protocol/devtools_protocol_browsertest.cc b/chrome/browser/devtools/protocol/devtools_protocol_browsertest.cc
+index e57b0883b725f..58bfa8d8f5412 100644
+--- a/chrome/browser/devtools/protocol/devtools_protocol_browsertest.cc
++++ b/chrome/browser/devtools/protocol/devtools_protocol_browsertest.cc
+@@ -20,6 +20,7 @@
+ #include "base/test/test_switches.h"
+ #include "base/test/values_test_util.h"
+ #include "base/threading/thread_restrictions.h"
++#include "base/time/time.h"
+ #include "base/values.h"
+ #include "build/build_config.h"
+ #include "chrome/browser/apps/app_service/app_service_proxy.h"
+@@ -30,6 +31,7 @@
+ #include "chrome/browser/data_saver/data_saver.h"
+ #include "chrome/browser/devtools/devtools_window.h"
+ #include "chrome/browser/devtools/protocol/devtools_protocol_test_support.h"
++#include "chrome/browser/history/history_service_factory.h"
+ #include "chrome/browser/preloading/preloading_prefs.h"
+ #include "chrome/browser/privacy_sandbox/privacy_sandbox_attestations/privacy_sandbox_attestations_mixin.h"
+ #include "chrome/browser/profiles/profile.h"
+@@ -43,6 +45,8 @@
+ #include "components/content_settings/core/browser/cookie_settings.h"
+ #include "components/content_settings/core/common/pref_names.h"
+ #include "components/custom_handlers/protocol_handler_registry.h"
++#include "components/history/core/browser/history_service.h"
++#include "components/history/core/test/history_service_test_util.h"
+ #include "components/infobars/content/content_infobar_manager.h"
+ #include "components/infobars/core/infobar.h"
+ #include "components/infobars/core/infobar_delegate.h"
+@@ -2202,6 +2206,93 @@ IN_PROC_BROWSER_TEST_F(DevToolsProtocolTest,
+   SendCommandSync("Target.getTargets");
+   EXPECT_EQ(2u, result()->FindList("targetInfos")->size());
+ }
++
++IN_PROC_BROWSER_TEST_F(DevToolsProtocolTest,
++                       CreateTabGroupAcceptsUnsortedTabIds) {
++  AttachToBrowserTarget();
++
++  ASSERT_EQ(1, browser()->tab_strip_model()->count());
++
++  base::DictValue params;
++  params.Set("url", "about:blank");
++  params.Set("background", true);
++  ASSERT_TRUE(SendCommandSync("Browser.createTab", params.Clone()));
++  ASSERT_TRUE(SendCommandSync("Browser.createTab", std::move(params)));
++
++  const base::DictValue* tabs_result = SendCommandSync("Browser.getTabs");
++  ASSERT_TRUE(tabs_result);
++  const base::ListValue* tabs = tabs_result->FindList("tabs");
++  ASSERT_TRUE(tabs);
++  ASSERT_EQ(3u, tabs->size());
++
++  std::vector<int> tab_ids;
++  tab_ids.reserve(tabs->size());
++  for (const auto& tab : *tabs) {
++    tab_ids.push_back(*tab.GetDict().FindInt("tabId"));
++  }
++
++  base::ListValue unsorted_tab_ids;
++  unsorted_tab_ids.Append(tab_ids[2]);
++  unsorted_tab_ids.Append(tab_ids[0]);
++
++  base::DictValue create_group_params;
++  create_group_params.Set("tabIds", std::move(unsorted_tab_ids));
++  create_group_params.Set("title", "Unsorted");
++
++  const base::DictValue* create_group_result =
++      SendCommandSync("Browser.createTabGroup", std::move(create_group_params));
++  ASSERT_TRUE(create_group_result);
++  ASSERT_FALSE(error());
++
++  const base::DictValue* group = create_group_result->FindDict("group");
++  ASSERT_TRUE(group);
++  const base::ListValue* grouped_tab_ids = group->FindList("tabIds");
++  ASSERT_TRUE(grouped_tab_ids);
++  ASSERT_EQ(2u, grouped_tab_ids->size());
++  EXPECT_EQ(tab_ids[0], *grouped_tab_ids->front().GetIfInt());
++  EXPECT_EQ(tab_ids[2], *grouped_tab_ids->back().GetIfInt());
++  EXPECT_EQ("Unsorted", *group->FindString("title"));
++}
++
++IN_PROC_BROWSER_TEST_F(DevToolsProtocolTest, HistorySearchUsesVisitTime) {
++  AttachToBrowserTarget();
++
++  history::HistoryService* history_service =
++      HistoryServiceFactory::GetForProfile(browser()->profile(),
++                                           ServiceAccessType::EXPLICIT_ACCESS);
++  ui_test_utils::WaitForHistoryToLoad(history_service);
++
++  const GURL url("https://history-timestamp-test.example/path");
++  const base::Time older_visit = base::Time::Now() - base::Days(2);
++  const base::Time newer_visit = base::Time::Now() - base::Hours(1);
++
++  history_service->AddPage(url, older_visit, history::SOURCE_BROWSED);
++  history_service->AddPage(url, newer_visit, history::SOURCE_BROWSED);
++  history::BlockUntilHistoryProcessesPendingRequests(history_service);
++
++  base::DictValue search_params;
++  search_params.Set("query", "");
++  search_params.Set(
++      "startTime",
++      (older_visit - base::Minutes(1)).InMillisecondsFSinceUnixEpoch());
++  search_params.Set(
++      "endTime",
++      (newer_visit - base::Minutes(1)).InMillisecondsFSinceUnixEpoch());
++
++  const base::DictValue* search_result =
++      SendCommandSync("History.search", std::move(search_params));
++  ASSERT_TRUE(search_result);
++  ASSERT_FALSE(error());
++
++  const base::ListValue* entries = search_result->FindList("entries");
++  ASSERT_TRUE(entries);
++  ASSERT_EQ(1u, entries->size());
++
++  const base::DictValue& entry = entries->front().GetDict();
++  EXPECT_EQ(url.spec(), *entry.FindString("url"));
++  EXPECT_EQ(older_visit.InMillisecondsFSinceUnixEpoch(),
++            *entry.FindDouble("lastVisitTime"));
++}
+ #endif  // !BUILDFLAG(IS_ANDROID)
+ 
+ #if !BUILDFLAG(IS_ANDROID)

packages/browseros/chromium_patches/chrome/browser/devtools/protocol/history_handler.cc

@@ -1,6 +1,6 @@
 diff --git a/chrome/browser/devtools/protocol/history_handler.cc b/chrome/browser/devtools/protocol/history_handler.cc
 new file mode 100644
-index 0000000000000..689f6e900a968
+index 0000000000000..4087a679a527f
 --- /dev/null
 +++ b/chrome/browser/devtools/protocol/history_handler.cc
 @@ -0,0 +1,188 @@
@@ -36,7 +36,7 @@ index 0000000000000..689f6e900a968
 +      .SetId(base::NumberToString(result.id()))
 +      .SetUrl(result.url().spec())
 +      .SetTitle(base::UTF16ToUTF8(result.title()))
-+      .SetLastVisitTime(result.last_visit().InMillisecondsFSinceUnixEpoch())
++      .SetLastVisitTime(result.visit_time().InMillisecondsFSinceUnixEpoch())
 +      .SetVisitCount(result.visit_count())
 +      .SetTypedCount(result.typed_count())
 +      .Build();

packages/browseros/chromium_patches/chrome/install_static/chromium_install_modes.h

@@ -1,8 +1,17 @@
 diff --git a/chrome/install_static/chromium_install_modes.h b/chrome/install_static/chromium_install_modes.h
-index 0cf937413e08a..a61c438a77379 100644
+index ee62888f89705..7ec72d302bc4b 100644
 --- a/chrome/install_static/chromium_install_modes.h
 +++ b/chrome/install_static/chromium_install_modes.h
-@@ -33,48 +33,49 @@ inline constexpr auto kInstallModes = std::to_array<InstallConstants>({
+@@ -21,7 +21,7 @@ inline constexpr wchar_t kCompanyPathName[] = L"";
+ 
+ // The brand-specific product name to be included as a component of the install
+ // and user data directory paths.
+-inline constexpr wchar_t kProductPathName[] = L"Chromium";
++inline constexpr wchar_t kProductPathName[] = L"BrowserOS";
+ 
+ // The brand-specific safe browsing client name.
+ inline constexpr char kSafeBrowsingName[] = "chromium";
+@@ -44,48 +44,49 @@ inline constexpr auto kInstallModes = std::to_array<InstallConstants>({
              L"",  // Empty install_suffix for the primary install mode.
          .logo_suffix = L"",  // No logo suffix for the primary install mode.
          .app_guid =