fix: address review feedback for PR #870

.github/workflows/publish-vm-agent-cache.yml

@@ -101,6 +101,7 @@ jobs:
       - working-directory: packages/browseros-agent
         run: bun install --frozen-lockfile
       - name: Smoke test tarball
+        timeout-minutes: 10
         working-directory: ${{ env.PKG_DIR }}
         env:
           AGENT: ${{ inputs.agent || 'openclaw' }}
@@ -111,7 +112,15 @@ jobs:
             echo "missing ${{ matrix.arch }} tarball artifact for ${AGENT}" >&2
             exit 1
           fi
-          bun run smoke:tarball -- --agent "$AGENT" --arch "${{ matrix.arch }}" --tarball "$tarball"
+          checksum="${tarball}.sha256"
+          if [ ! -f "$checksum" ]; then
+            echo "missing checksum sidecar: $checksum" >&2
+            exit 1
+          fi
+          echo "smoke-testing $tarball"
+          ls -lh "$tarball" "$checksum"
+          (cd "$(dirname "$tarball")" && sha256sum -c "$(basename "$checksum")")
+          timeout --verbose --kill-after=30s 8m bun run smoke:tarball -- --agent "$AGENT" --arch "${{ matrix.arch }}" --tarball "$tarball"
 
   publish:
     needs: [build, smoke]