feat(studio): add Harness Sidecar optimization and release flow

.github/workflows/harness-sidecar-release-gate.yaml

@@ -0,0 +1,82 @@
+name: Harness Sidecar Release Gate
+
+on:
+  workflow_call:
+  push:
+    paths:
+      - '.github/workflows/harness-sidecar-release-gate.yaml'
+      - 'frontend/**'
+      - 'tests/cli/test_generated_agent_harness_sidecar.py'
+      - 'tests/cli/test_generated_agent_backend_codegen_extended.py'
+      - 'tests/cli/test_studio_rbac.py'
+      - 'tests/extensions/harness/**'
+      - 'tests/integrations/agentkit/test_app.py'
+      - 'veadk/cli/generated_agent_codegen.py'
+      - 'veadk/cli/cli_frontend.py'
+      - 'veadk/extensions/harness/**'
+      - 'veadk/integrations/agentkit/app.py'
+      - 'pyproject.toml'
+  pull_request:
+    paths:
+      - '.github/workflows/harness-sidecar-release-gate.yaml'
+      - 'frontend/**'
+      - 'tests/cli/test_generated_agent_harness_sidecar.py'
+      - 'tests/cli/test_generated_agent_backend_codegen_extended.py'
+      - 'tests/cli/test_studio_rbac.py'
+      - 'tests/extensions/harness/**'
+      - 'tests/integrations/agentkit/test_app.py'
+      - 'veadk/cli/generated_agent_codegen.py'
+      - 'veadk/cli/cli_frontend.py'
+      - 'veadk/extensions/harness/**'
+      - 'veadk/integrations/agentkit/app.py'
+      - 'pyproject.toml'
+
+permissions:
+  contents: read
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22.17.0
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install Python test dependencies
+        run: python -m pip install -e '.[dev]'
+
+      - name: Enforce public Python Sidecar coverage above 90 percent
+        run: |
+          python -m pytest -q \
+            tests/extensions/harness/test_studio_sidecar.py \
+            tests/extensions/harness/test_sidecar_public_api.py \
+            tests/extensions/harness/test_extension.py \
+            tests/cli/test_generated_agent_harness_sidecar.py \
+            tests/integrations/agentkit/test_app.py \
+            tests/cli/test_studio_rbac.py::test_sidecar_deployment_uses_agentkit_cli_structured_release \
+            tests/cli/test_generated_agent_backend_codegen_extended.py::test_generated_agent_sidecar_debug_uses_runtime_apig_and_active_plan \
+            --cov=. --cov-branch --cov-report= --cov-fail-under=0
+          python -m coverage report \
+            --include='*/veadk/extensions/harness/sidecar.py' \
+            --fail-under=91 --show-missing
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: npm ci --ignore-scripts
+
+      - name: Enforce public Studio Sidecar coverage above 90 percent
+        working-directory: frontend
+        run: npm run test:harness-sidecar-coverage
+
+      - name: Verify frontend Sidecar integration
+        working-directory: frontend
+        run: npm test

.github/workflows/publish-studio-release.yaml

@@ -39,10 +39,17 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
+  harness-sidecar-release-gate:
+    if: >-
+      github.repository == 'volcengine/veadk-python' &&
+      (github.event_name == 'pull_request' || github.ref == 'refs/heads/main')
+    uses: ./.github/workflows/harness-sidecar-release-gate.yaml
+
   verify:
     if: >-
       github.repository == 'volcengine/veadk-python' &&
       (github.event_name == 'pull_request' || github.ref == 'refs/heads/main')
+    needs: harness-sidecar-release-gate
     runs-on: ubuntu-latest
     timeout-minutes: 45
 

.github/workflows/publish-tag-to-pypi.yaml

@@ -5,7 +5,11 @@ on:
   workflow_dispatch:
 
 jobs:
+  harness-sidecar-release-gate:
+    uses: ./.github/workflows/harness-sidecar-release-gate.yaml
+
   build:
+    needs: harness-sidecar-release-gate
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.github/workflows/push-preview-image-to-vecr.yaml

@@ -24,7 +24,12 @@ on:
   workflow_dispatch:
 
 jobs:
+  harness-sidecar-release-gate:
+    if: github.repository == 'volcengine/veadk-python'
+    uses: ./.github/workflows/harness-sidecar-release-gate.yaml
+
   build-and-push:
+    needs: harness-sidecar-release-gate
     runs-on: ubuntu-latest
 
     # To avoid forked repo execute this workflow
@@ -64,4 +69,4 @@ jobs:
             --push \
             --cache-from=type=gha \
             --cache-to=type=gha,mode=max \
-            .
+            .

.github/workflows/push-stable-image-to-vecr.yaml

@@ -22,7 +22,12 @@ on:
   workflow_dispatch:
 
 jobs:
+  harness-sidecar-release-gate:
+    if: github.repository == 'volcengine/veadk-python'
+    uses: ./.github/workflows/harness-sidecar-release-gate.yaml
+
   build-and-push:
+    needs: harness-sidecar-release-gate
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -67,4 +72,4 @@ jobs:
             --push \
             --cache-from=type=gha \
             --cache-to=type=gha,mode=max \
-            .
+            .

.gitignore

@@ -45,6 +45,7 @@ htmlcov/
 .cache
 nosetests.xml
 coverage.xml
+coverage/
 *.cover
 *.py,cover
 .hypothesis/

frontend/README.md

@@ -104,7 +104,12 @@ server that `veadk frontend` launches — no separate backend.
 - **Custom-agent workbench**: configure an agent with a rich Markdown
   system-prompt editor (including heading and list shortcuts), then debug with
   expandable, copyable runner error details, per-result Trace inspection, and
-  review. In-progress drafts are stored only in the current browser and scoped
+  review. Test configurations expose Harness Sidecar as `优化场景`: `自定义`
+  appears first and starts with no components, while `运维场景` applies the
+  `ops` component combination. Component checkboxes remain editable, an empty
+  selection keeps Sidecar disabled, and the UI explains the operations
+  scenario's automatic SQL read-only protection. In-progress drafts are stored only in the
+  current browser and scoped
   to the signed-in user. MCP tokens are converted to Runtime environment
   variables: generated source retains only the `${ENV_NAME}` reference, while
   YAML and browser drafts preserve the corresponding environment value.