fix: add junie to tarball build pipeline

[la14-1]

Summary

• Add junie entry to packer/agents.json (tier: node, @jetbrains/junie-cli)
• Add junie to packer/scripts/capture-agent.sh allowlist and path-capture case (npm-based, same as codex/kilocode)

Why

Junie was added as a fully implemented agent (manifest, agent scripts, agent-setup.ts) but the packer/tarball pipeline was never updated. The nightly agent-tarballs.yml workflow could not build a pre-built tarball for Junie, forcing all deployments to do a live npm install on first boot.

No ARM build needed — Junie installs via npm which is arch-independent. No workflow changes needed — agent-tarballs.yml reads agent names from packer/agents.json dynamically.

Test plan

• bash -n passes on modified shell script
• bun test — 1380 pass, 0 fail
• bunx @biomejs/biome check src/ — 0 errors

-- refactor/code-health

[louisgv]

Security Review

Verdict: APPROVED
Commit: a0a9508

Findings

No security issues found. Changes are safe and follow established patterns:

• junie agent config uses standard npm install pattern with explicit --prefix
• capture-agent.sh adds junie to validation allowlist (injection prevention)
• Path mapping consistent with other npm-based agents (codex, kilocode)
• All variables properly quoted
• No credential leaks, command injection, or unsafe operations

Tests

• bash -n: PASS
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (packer script, not for remote exec)
• macOS compat: OK (no bash 3.x incompatibilities)

---

-- security/pr-reviewer

[la14-1]

Summary

• Add junie entry to packer/agents.json (tier: node, @jetbrains/junie-cli)
• Add junie to packer/scripts/capture-agent.sh allowlist and path-capture case (npm-based, same as codex/kilocode)

Why

Junie was added as a fully implemented agent (manifest, agent scripts, agent-setup.ts) but the packer/tarball pipeline was never updated. The nightly agent-tarballs.yml workflow could not build a pre-built tarball for Junie, forcing all deployments to do a live npm install on first boot.

No ARM build needed — Junie installs via npm which is arch-independent. No workflow changes needed — agent-tarballs.yml reads agent names from packer/agents.json dynamically.

Test plan

• bash -n passes on modified shell script
• bun test — 1380 pass, 0 fail
• bunx @biomejs/biome check src/ — 0 errors

-- refactor/code-health

[louisgv]

Security Review

Verdict: APPROVED
Commit: a0a9508

Findings

No security issues found. Changes are safe and follow established patterns:

• junie agent config uses standard npm install pattern with explicit --prefix
• capture-agent.sh adds junie to validation allowlist (injection prevention)
• Path mapping consistent with other npm-based agents (codex, kilocode)
• All variables properly quoted
• No credential leaks, command injection, or unsafe operations

Tests

• bash -n: PASS
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (packer script, not for remote exec)
• macOS compat: OK (no bash 3.x incompatibilities)

---

-- security/pr-reviewer

[la14-1]

Summary

• Add junie entry to packer/agents.json (tier: node, @jetbrains/junie-cli)
• Add junie to packer/scripts/capture-agent.sh allowlist and path-capture case (npm-based, same as codex/kilocode)

Why

Junie was added as a fully implemented agent (manifest, agent scripts, agent-setup.ts) but the packer/tarball pipeline was never updated. The nightly agent-tarballs.yml workflow could not build a pre-built tarball for Junie, forcing all deployments to do a live npm install on first boot.

No ARM build needed — Junie installs via npm which is arch-independent. No workflow changes needed — agent-tarballs.yml reads agent names from packer/agents.json dynamically.

Test plan

• bash -n passes on modified shell script
• bun test — 1380 pass, 0 fail
• bunx @biomejs/biome check src/ — 0 errors

-- refactor/code-health

[louisgv]

Security Review

Verdict: APPROVED
Commit: a0a9508

Findings

No security issues found. Changes are safe and follow established patterns:

• junie agent config uses standard npm install pattern with explicit --prefix
• capture-agent.sh adds junie to validation allowlist (injection prevention)
• Path mapping consistent with other npm-based agents (codex, kilocode)
• All variables properly quoted
• No credential leaks, command injection, or unsafe operations

Tests

• bash -n: PASS
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (packer script, not for remote exec)
• macOS compat: OK (no bash 3.x incompatibilities)

---

-- security/pr-reviewer

[la14-1]

Summary

• Add junie entry to packer/agents.json (tier: node, @jetbrains/junie-cli)
• Add junie to packer/scripts/capture-agent.sh allowlist and path-capture case (npm-based, same as codex/kilocode)

Why

Junie was added as a fully implemented agent (manifest, agent scripts, agent-setup.ts) but the packer/tarball pipeline was never updated. The nightly agent-tarballs.yml workflow could not build a pre-built tarball for Junie, forcing all deployments to do a live npm install on first boot.

No ARM build needed — Junie installs via npm which is arch-independent. No workflow changes needed — agent-tarballs.yml reads agent names from packer/agents.json dynamically.

Test plan

• bash -n passes on modified shell script
• bun test — 1380 pass, 0 fail
• bunx @biomejs/biome check src/ — 0 errors

-- refactor/code-health

[louisgv]

Security Review

Verdict: APPROVED
Commit: a0a9508

Findings

No security issues found. Changes are safe and follow established patterns:

• junie agent config uses standard npm install pattern with explicit --prefix
• capture-agent.sh adds junie to validation allowlist (injection prevention)
• Path mapping consistent with other npm-based agents (codex, kilocode)
• All variables properly quoted
• No credential leaks, command injection, or unsafe operations

Tests

• bash -n: PASS
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (packer script, not for remote exec)
• macOS compat: OK (no bash 3.x incompatibilities)

---

-- security/pr-reviewer

[la14-1]

Summary

• Add junie entry to packer/agents.json (tier: node, @jetbrains/junie-cli)
• Add junie to packer/scripts/capture-agent.sh allowlist and path-capture case (npm-based, same as codex/kilocode)

Why

Junie was added as a fully implemented agent (manifest, agent scripts, agent-setup.ts) but the packer/tarball pipeline was never updated. The nightly agent-tarballs.yml workflow could not build a pre-built tarball for Junie, forcing all deployments to do a live npm install on first boot.

No ARM build needed — Junie installs via npm which is arch-independent. No workflow changes needed — agent-tarballs.yml reads agent names from packer/agents.json dynamically.

Test plan

• bash -n passes on modified shell script
• bun test — 1380 pass, 0 fail
• bunx @biomejs/biome check src/ — 0 errors

-- refactor/code-health

[louisgv]

Security Review

Verdict: APPROVED
Commit: a0a9508

Findings

No security issues found. Changes are safe and follow established patterns:

• junie agent config uses standard npm install pattern with explicit --prefix
• capture-agent.sh adds junie to validation allowlist (injection prevention)
• Path mapping consistent with other npm-based agents (codex, kilocode)
• All variables properly quoted
• No credential leaks, command injection, or unsafe operations

Tests

• bash -n: PASS
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (packer script, not for remote exec)
• macOS compat: OK (no bash 3.x incompatibilities)

---

-- security/pr-reviewer

[la14-1]

Summary

• Add junie entry to packer/agents.json (tier: node, @jetbrains/junie-cli)
• Add junie to packer/scripts/capture-agent.sh allowlist and path-capture case (npm-based, same as codex/kilocode)

Why

Junie was added as a fully implemented agent (manifest, agent scripts, agent-setup.ts) but the packer/tarball pipeline was never updated. The nightly agent-tarballs.yml workflow could not build a pre-built tarball for Junie, forcing all deployments to do a live npm install on first boot.

No ARM build needed — Junie installs via npm which is arch-independent. No workflow changes needed — agent-tarballs.yml reads agent names from packer/agents.json dynamically.

Test plan

• bash -n passes on modified shell script
• bun test — 1380 pass, 0 fail
• bunx @biomejs/biome check src/ — 0 errors

-- refactor/code-health

[louisgv]

Security Review

Verdict: APPROVED
Commit: a0a9508

Findings

No security issues found. Changes are safe and follow established patterns:

• junie agent config uses standard npm install pattern with explicit --prefix
• capture-agent.sh adds junie to validation allowlist (injection prevention)
• Path mapping consistent with other npm-based agents (codex, kilocode)
• All variables properly quoted
• No credential leaks, command injection, or unsafe operations

Tests

• bash -n: PASS
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (packer script, not for remote exec)
• macOS compat: OK (no bash 3.x incompatibilities)

---

-- security/pr-reviewer

[la14-1]

Summary

• Add junie entry to packer/agents.json (tier: node, @jetbrains/junie-cli)
• Add junie to packer/scripts/capture-agent.sh allowlist and path-capture case (npm-based, same as codex/kilocode)

Why

Junie was added as a fully implemented agent (manifest, agent scripts, agent-setup.ts) but the packer/tarball pipeline was never updated. The nightly agent-tarballs.yml workflow could not build a pre-built tarball for Junie, forcing all deployments to do a live npm install on first boot.

No ARM build needed — Junie installs via npm which is arch-independent. No workflow changes needed — agent-tarballs.yml reads agent names from packer/agents.json dynamically.

Test plan

• bash -n passes on modified shell script
• bun test — 1380 pass, 0 fail
• bunx @biomejs/biome check src/ — 0 errors

-- refactor/code-health

[louisgv]

Security Review

Verdict: APPROVED
Commit: a0a9508

Findings

No security issues found. Changes are safe and follow established patterns:

• junie agent config uses standard npm install pattern with explicit --prefix
• capture-agent.sh adds junie to validation allowlist (injection prevention)
• Path mapping consistent with other npm-based agents (codex, kilocode)
• All variables properly quoted
• No credential leaks, command injection, or unsafe operations

Tests

• bash -n: PASS
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (packer script, not for remote exec)
• macOS compat: OK (no bash 3.x incompatibilities)

---

-- security/pr-reviewer

[la14-1]

Summary

• Add junie entry to packer/agents.json (tier: node, @jetbrains/junie-cli)
• Add junie to packer/scripts/capture-agent.sh allowlist and path-capture case (npm-based, same as codex/kilocode)

Why

Junie was added as a fully implemented agent (manifest, agent scripts, agent-setup.ts) but the packer/tarball pipeline was never updated. The nightly agent-tarballs.yml workflow could not build a pre-built tarball for Junie, forcing all deployments to do a live npm install on first boot.

No ARM build needed — Junie installs via npm which is arch-independent. No workflow changes needed — agent-tarballs.yml reads agent names from packer/agents.json dynamically.

Test plan

• bash -n passes on modified shell script
• bun test — 1380 pass, 0 fail
• bunx @biomejs/biome check src/ — 0 errors

-- refactor/code-health

[louisgv]

Security Review

Verdict: APPROVED
Commit: a0a9508

Findings

No security issues found. Changes are safe and follow established patterns:

• junie agent config uses standard npm install pattern with explicit --prefix
• capture-agent.sh adds junie to validation allowlist (injection prevention)
• Path mapping consistent with other npm-based agents (codex, kilocode)
• All variables properly quoted
• No credential leaks, command injection, or unsafe operations

Tests

• bash -n: PASS
• bun test: PASS (1380 tests, 0 failures)
• curl|bash: N/A (packer script, not for remote exec)
• macOS compat: OK (no bash 3.x incompatibilities)

---

-- security/pr-reviewer