chore(sync): merge upstream v2 through v2.2.0

.gitattributes

@@ -1,5 +1,11 @@
 packages/core/migration/**/snapshot.json linguist-generated
 packages/core/src/database/migration.gen.ts linguist-generated
 packages/core/src/models-dev/snapshot.txt linguist-generated
+packages/core/src/database/schema.gen.ts linguist-generated
+packages/desktop/src/main/storage/migration.gen.ts linguist-generated
+packages/protocol/openapi.json linguist-generated
+packages/client/src/promise/generated/** linguist-generated
+packages/client/src/effect/generated/** linguist-generated
+packages/client/src/effect/api/** linguist-generated
 packages/core/src/**/*.txt text eol=lf
 packages/httpapi-codegen/test/generated/*.ts text eol=lf

.github/CODEOWNERS

@@ -1,3 +1,7 @@
 # web + desktop packages
 packages/app/      @Hona @Brendonovich
 packages/desktop/  @Hona @Brendonovich
+
+# CI and releases. Release jobs that hold secrets run only .github/workflows/release.yml and .github/release/,
+# which makes this path the release security boundary.
+/.github/ @anomalyco/releasers

.github/actions/setup-bun/action.yml

@@ -55,7 +55,10 @@ runs:
       uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ${{ steps.cache.outputs.dir }}
-        key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
+        key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ steps.cache.outputs.version }}-${{ hashFiles('bun.lock', 'patches/**') }}
+        # Each dev merge changes beta's bun.lock. Beta falls back to the newest cache for the same Bun version
+        # (Bun's cache stores every package version separately) instead of installing everything from npm.
+        restore-keys: ${{ (github.ref_name == 'beta' && format('{0}-{1}-bun-{2}-', runner.os, runner.arch, steps.cache.outputs.version)) || '' }}
 
     - name: Install setuptools for distutils compatibility
       run: python3 -m pip install setuptools || pip install setuptools || true

.github/hygiene-allowlist.txt

@@ -8,14 +8,7 @@ pii:*.stories.*
 pii:*/test/*
 pii:*/e2e/*
 pii:*fixture*
-pii:packages/app/src/home/projects/view.tsx
-pii:packages/app/src/home/sessions/controller.tsx
-pii:packages/app/src/settings/workspaces/project-options.tsx
-pii:packages/app/src/settings/workspaces/projects.tsx
-pii:packages/app/src/shell/routes/routes.tsx
 pii:packages/core/drizzle.config.ts
-pii:packages/desktop/scripts/profile-by-source.ts
-pii:packages/storybook/.storybook/mocks/gui-extensions/ssh.tsx
 pii:packages/tui/src/feature-plugins/system/storybook/session-location-missing.tsx
 pii:packages/web/src/content/docs/ar/permissions.mdx
 pii:packages/web/src/content/docs/bs/permissions.mdx
@@ -42,3 +35,14 @@ pii:services/www/src/docs/content/cli/config.mdx
 pii:services/www/src/docs/content/plugins.mdx
 # Synthetic home directory in upstream documentation examples.
 text:/home/me
+# `@/home/<segment>` module aliases. Scoped to the files that import them.
+pii:packages/app/src/home/projects/view.tsx
+pii:packages/app/src/home/sessions/controller.tsx
+pii:packages/app/src/session/session-identity-header.tsx
+pii:packages/app/src/settings/workspaces/project-options.tsx
+pii:packages/app/src/settings/workspaces/projects.tsx
+pii:packages/app/src/shell/routes/routes.tsx
+pii:packages/app/src/shell/shell.tsx
+pii:packages/app/src/shell/titlebar/inbox-model.ts
+pii:packages/app/src/shell/titlebar/recently-closed-tabs-menu.tsx
+pii:packages/stories/mocks/gui-plugins/ssh.tsx

.github/nix-hashes/publish.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# publish.sh <hashes.json>: run from a checkout of dev. Puts <hashes.json> on bot/nix-hashes as one commit on top of dev,
+# opens or updates the pull request into dev, dispatches its required checks and enables auto-merge. Closes the pull
+# request instead when dev already has these hashes. Uses git, gh and jq only; never runs repository code.
+set -euo pipefail
+
+here=$(cd "$(dirname "$0")" && pwd)
+new=$(realpath "$1")
+branch=bot/nix-hashes
+file=nix/hashes.json
+title="chore: update nix node_modules hashes"
+: "${GH_REPO:?}" "${GITHUB_SHA:?}"
+git=(git -c core.hooksPath=/dev/null -c user.name='github-actions[bot]' -c user.email='41898282+github-actions[bot]@users.noreply.github.com')
+
+bash "$here/validate.sh" "$new"
+
+"${git[@]}" fetch --no-tags --depth=1 origin "+refs/heads/dev:refs/remotes/origin/dev" "$GITHUB_SHA"
+
+# A newer push that changed the inputs has its own run, which publishes hashes for it. Mirrors on.push.paths.
+if ! git diff --quiet "$GITHUB_SHA" origin/dev -- bun.lock package.json ':(glob)packages/*/package.json' \
+  ':(glob)services/*/package.json' flake.lock nix/node_modules.nix nix/scripts patches; then
+  echo "::notice::dev changed the hash inputs since $GITHUB_SHA; leaving it to the newer run"
+  exit 0
+fi
+
+# Only a same-repository pull request is the bot's; a fork can use the same branch name.
+find_pr() {
+  gh pr list --repo "$GH_REPO" --base dev --head "$branch" --state open --json number,isCrossRepository \
+    --jq 'map(select(.isCrossRepository | not)) | .[0].number // empty'
+}
+pr=$(find_pr)
+
+"${git[@]}" checkout -B "$branch" origin/dev
+if cmp -s "$new" "$file"; then
+  echo "dev already has these hashes"
+  if [ -n "$pr" ]; then
+    gh pr close "$pr" --repo "$GH_REPO" --delete-branch --comment "dev already has these hashes."
+  fi
+  exit 0
+fi
+
+cp "$new" "$file"
+bash "$here/validate.sh" "$file"
+"${git[@]}" add -- "$file"
+"${git[@]}" commit --no-verify -m "$title"
+[ "$(git diff --name-only origin/dev HEAD)" = "$file" ] || {
+  echo "::error::the commit changes more than $file" >&2
+  exit 1
+}
+"${git[@]}" push --no-verify --force origin "HEAD:refs/heads/$branch"
+
+if [ -z "$pr" ]; then
+  gh pr create --repo "$GH_REPO" --base dev --head "$branch" --title "$title" \
+    --body "Updates \`$file\` to the node_modules hashes computed for $GITHUB_SHA by bot-nix-hashes. check-bot-scope keeps this branch to that file."
+  pr=$(find_pr)
+fi
+
+# Pushes and pull requests made with GITHUB_TOKEN start no workflows; dispatches do. These produce the checks dev
+# requires on the new head.
+for workflow in check.yml check-test.yml check-bot-scope.yml; do
+  gh workflow run "$workflow" --repo "$GH_REPO" --ref "$branch"
+done
+
+gh pr merge "$pr" --repo "$GH_REPO" --auto --squash
+echo "### Nix hashes" >> "${GITHUB_STEP_SUMMARY:-/dev/null}"
+echo "Updated pull request #$pr" >> "${GITHUB_STEP_SUMMARY:-/dev/null}"

.github/nix-hashes/validate.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# validate.sh <file>: fails unless <file> has exactly the shape of nix/hashes.json, so the hashes bot can only ever publish
+# three SRI hashes. Used by bot-nix-hashes.yml before it commits and by check-bot-scope.yml on the bot's pull request.
+# Adding a system to the flake means adding it to SYSTEMS here.
+set -euo pipefail
+
+file=${1:?usage: validate.sh <file>}
+SYSTEMS='["aarch64-darwin","aarch64-linux","x86_64-linux"]'
+
+fail() {
+  echo "::error::$file: $*" >&2
+  exit 1
+}
+
+if [ ! -f "$file" ] || [ -L "$file" ]; then fail "not a regular file"; fi
+[ "$(wc -c < "$file")" -lt 4096 ] || fail "4096 bytes or larger"
+jq -se 'length == 1' "$file" > /dev/null 2>&1 || fail "not a single JSON value"
+jq -e --argjson systems "$SYSTEMS" '
+  type == "object"
+  and keys == ["nodeModules"]
+  and (.nodeModules | type == "object")
+  and (.nodeModules | keys == $systems)
+  and (.nodeModules | all(.[]; type == "string" and test("\\Asha256-[A-Za-z0-9+/]{43}=\\z")))
+' "$file" > /dev/null || fail "expected {\"nodeModules\": {<$SYSTEMS>: \"sha256-<44 base64 chars>\"}}"
+# The canonical form rules out duplicate keys and anything else jq would drop on parse.
+jq . "$file" | cmp -s - "$file" || fail "not formatted as jq . prints it"
+echo "$file: valid"

.github/pull_request_template.md

@@ -17,6 +17,13 @@ Please provide a description of the issue, the changes you made to fix it, and w
 
 ### How did you verify your code works?
 
+### Visual
+
+_Optional, for user-facing changes: a small looping animated SVG (240×72) of the change, shown in the desktop app's "What's new in beta". Replace the block below or delete this section._
+
+```svg
+```
+
 ### Screenshots / recordings
 
 _If this is a UI change, please include a screenshot or recording._

.github/release/download/action.yml

@@ -0,0 +1,21 @@
+name: Download release artifacts
+description: Downloads artifacts into $RUNNER_TEMP/in/<name> and verifies each against its SHA256SUMS.
+inputs:
+  pattern:
+    description: Artifact name pattern
+    required: true
+  digests:
+    description: Space-separated name=digest pairs for artifacts made by sign jobs, from their job outputs
+    required: false
+    default: ""
+runs:
+  using: composite
+  steps:
+    - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      with:
+        pattern: ${{ inputs.pattern }}
+        path: ${{ runner.temp }}/in
+    - shell: bash
+      run: bash "${GITHUB_ACTION_PATH//\\//}/../verify-artifacts.sh" "$RUNNER_TEMP/in"
+      env:
+        OPENCODE_DIGESTS: ${{ inputs.digests }}

.github/release/lib.sh

@@ -0,0 +1,110 @@
+# shellcheck shell=bash
+# Shared helpers for the release scripts. Sourced, never executed.
+#
+# These scripts run in sign and publish jobs that hold secrets. They must never execute repository code
+# or artifact contents: artifacts are data, and every value that names a destination comes from the
+# environment the workflow sets (OPENCODE_VERSION, OPENCODE_CHANNEL, OPENCODE_DRY_RUN, ...).
+
+set -euo pipefail
+
+# shellcheck disable=SC2034 # used by the scripts that source this file
+release_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+
+die() {
+  echo "::error::$*" >&2
+  exit 1
+}
+
+dry_run() {
+  [ "${OPENCODE_DRY_RUN:-false}" = true ]
+}
+
+sha256() {
+  if command -v sha256sum > /dev/null; then sha256sum "$@"; else shasum -a 256 "$@"; fi
+}
+
+# Windows runners pass D:\a\_temp style paths; Git Bash tools want /d/a/_temp.
+posix() {
+  if command -v cygpath > /dev/null; then cygpath -u "$1"; else printf '%s' "$1"; fi
+}
+
+size() {
+  wc -c < "$1" | tr -d ' '
+}
+
+# Uploads files to opencode.ai/files/bin/<version>/ and prints the update-server file map.
+upload_files() {
+  local credentials=false
+  for file in "$@"; do
+    test -s "$file" || die "Missing release file: $file"
+    local name type
+    name=$(basename "$file")
+    case "$name" in
+      *.tar.gz) type=application/gzip ;;
+      *.zip) type=application/zip ;;
+      *) type=application/octet-stream ;;
+    esac
+    if dry_run; then
+      echo "dry-run upload: bin/$OPENCODE_VERSION/$name" >&2
+    else
+      if [ "$credentials" = false ]; then
+        r2_credentials
+        credentials=true
+      fi
+      aws s3 cp "$file" "s3://opencode-production-files/bin/$OPENCODE_VERSION/$name" --only-show-errors \
+        --endpoint-url "https://$CLOUDFLARE_ACCOUNT_ID.r2.cloudflarestorage.com" \
+        --content-type "$type" --content-disposition "attachment; filename=\"$name\"" \
+        --cache-control "public, max-age=31536000, immutable" >&2
+    fi
+    jq -n --arg name "$name" --arg url "https://opencode.ai/files/bin/$OPENCODE_VERSION/$name" \
+      --arg sha256 "$(sha256 "$file" | cut -c1-64)" --argjson size "$(size "$file")" \
+      '{($name): {url: $url, sha256: $sha256, size: $size}}'
+  done | jq -s 'add'
+}
+
+# R2 accepts the API token ID as the access key and SHA-256(token) as the secret.
+r2_credentials() {
+  local id
+  id=$(curl -fsS -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
+    "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/tokens/verify" | jq -er .result.id)
+  export AWS_ACCESS_KEY_ID="$id"
+  AWS_SECRET_ACCESS_KEY=$(printf '%s' "$CLOUDFLARE_API_TOKEN" | sha256 | cut -c1-64)
+  export AWS_SECRET_ACCESS_KEY
+  export AWS_DEFAULT_REGION=auto AWS_REQUEST_CHECKSUM_CALCULATION=when_required AWS_RESPONSE_CHECKSUM_VALIDATION=when_required
+}
+
+# Registers one artifact with the update server: publish_update <name> <distribution> <metadata json>.
+publish_update() {
+  local body status token attempt
+  body=$(jq -n --arg channel "$OPENCODE_CHANNEL" --arg version "$OPENCODE_VERSION" --arg name "$1" --arg distribution "$2" \
+    --argjson metadata "$3" '{channel: $channel, name: $name, distribution: $distribution, version: $version, metadata: $metadata}')
+  echo "$body" | jq .
+  if dry_run; then return; fi
+  token=$(curl -fsS -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+    "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=https://update.opencode.ai" | jq -er .value)
+  for attempt in 1 2 3; do
+    status=$(curl -sS -o "$RUNNER_TEMP/update-response" -w '%{http_code}' -X POST https://opencode.ai/update/api/publish \
+      -H "Authorization: Bearer $token" -H "Content-Type: application/json" --data "$body")
+    if [ "$status" -lt 300 ]; then return; fi
+    cat "$RUNNER_TEMP/update-response"
+    # D1 can commit the upsert and still time out. Replaying the same artifact is safe.
+    if [ "$status" -lt 500 ] || [ "$attempt" = 3 ]; then die "Update server returned $status"; fi
+    sleep "$attempt"
+  done
+}
+
+# Clones a repository, lets a render script fill it, then commits and pushes any change:
+# push_git <clone url> <commit message> <render script> [args...]. Dry runs render into an empty directory.
+push_git() {
+  local url=$1 message=$2 dir
+  shift 2
+  dir=$(mktemp -d)
+  if ! dry_run; then git clone -q "$url" "$dir"; fi
+  "$@" "$dir"
+  if dry_run; then return; fi
+  git -C "$dir" add -A
+  if git -C "$dir" diff --cached --quiet; then return; fi
+  git -C "$dir" -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
+    commit -q -m "$message"
+  git -C "$dir" push -q origin HEAD:master
+}