Merge branch 'dev' into feat/canceled-prompts-in-history

Author: ariane-emory

.github/VOUCHED.td

@@ -8,7 +8,9 @@
 #   - Denounce with minus prefix: -username or -platform:username.
 #   - Optional details after a space following the handle.
 adamdotdevin
+-agusbasari29 AI PR slop
 ariane-emory
+edemaine
 -florianleibert
 fwang
 iamdavidhill

.github/actions/setup-bun/action.yml

@@ -1,5 +1,10 @@
 name: "Setup Bun"
 description: "Setup Bun with caching and install dependencies"
+inputs:
+  cross-compile:
+    description: "Pre-cache canary cross-compile binaries for all targets"
+    required: false
+    default: "false"
 runs:
   using: "composite"
   steps:
@@ -11,10 +16,72 @@ runs:
         restore-keys: |
           ${{ runner.os }}-bun-
 
+    - name: Get baseline download URL
+      id: bun-url
+      shell: bash
+      run: |
+        if [ "$RUNNER_ARCH" = "X64" ]; then
+          case "$RUNNER_OS" in
+            macOS)   OS=darwin ;;
+            Linux)   OS=linux ;;
+            Windows) OS=windows ;;
+          esac
+          echo "url=https://github.com/oven-sh/bun/releases/download/canary/bun-${OS}-x64-baseline.zip" >> "$GITHUB_OUTPUT"
+        fi
+
     - name: Setup Bun
       uses: oven-sh/setup-bun@v2
       with:
-        bun-version-file: package.json
+        bun-version-file: ${{ !steps.bun-url.outputs.url && 'package.json' || '' }}
+        bun-download-url: ${{ steps.bun-url.outputs.url }}
+
+    - name: Pre-cache canary cross-compile binaries
+      if: inputs.cross-compile == 'true'
+      shell: bash
+      run: |
+        BUN_VERSION=$(bun --revision)
+        if echo "$BUN_VERSION" | grep -q "canary"; then
+          SEMVER=$(echo "$BUN_VERSION" | sed 's/^\([0-9]*\.[0-9]*\.[0-9]*\).*/\1/')
+          echo "Bun version: $BUN_VERSION (semver: $SEMVER)"
+          CACHE_DIR="$HOME/.bun/install/cache"
+          mkdir -p "$CACHE_DIR"
+          TMP_DIR=$(mktemp -d)
+          for TARGET in linux-aarch64 linux-x64 linux-x64-baseline linux-aarch64-musl linux-x64-musl linux-x64-musl-baseline darwin-aarch64 darwin-x64 windows-x64 windows-x64-baseline; do
+            DEST="$CACHE_DIR/bun-${TARGET}-v${SEMVER}"
+            if [ -f "$DEST" ]; then
+              echo "Already cached: $DEST"
+              continue
+            fi
+            URL="https://github.com/oven-sh/bun/releases/download/canary/bun-${TARGET}.zip"
+            echo "Downloading $TARGET from $URL"
+            if curl -sfL -o "$TMP_DIR/bun.zip" "$URL"; then
+              unzip -qo "$TMP_DIR/bun.zip" -d "$TMP_DIR"
+              if echo "$TARGET" | grep -q "windows"; then
+                BIN_NAME="bun.exe"
+              else
+                BIN_NAME="bun"
+              fi
+              mv "$TMP_DIR/bun-${TARGET}/$BIN_NAME" "$DEST"
+              chmod +x "$DEST"
+              rm -rf "$TMP_DIR/bun-${TARGET}" "$TMP_DIR/bun.zip"
+              echo "Cached: $DEST"
+              # baseline bun resolves "bun-darwin-x64" to the baseline cache key
+              # so copy the modern binary there too
+              if [ "$TARGET" = "darwin-x64" ]; then
+                BASELINE_DEST="$CACHE_DIR/bun-darwin-x64-baseline-v${SEMVER}"
+                if [ ! -f "$BASELINE_DEST" ]; then
+                  cp "$DEST" "$BASELINE_DEST"
+                  echo "Cached (baseline alias): $BASELINE_DEST"
+                fi
+              fi
+            else
+              echo "Skipped: $TARGET (not available)"
+            fi
+          done
+          rm -rf "$TMP_DIR"
+        else
+          echo "Not a canary build ($BUN_VERSION), skipping pre-cache"
+        fi
 
     - name: Install dependencies
       run: bun install

.github/workflows/beta.yml

@@ -27,7 +27,11 @@ jobs:
           opencode-app-id: ${{ vars.OPENCODE_APP_ID }}
           opencode-app-secret: ${{ secrets.OPENCODE_APP_SECRET }}
 
+      - name: Install OpenCode
+        run: bun i -g opencode-ai
+
       - name: Sync beta branch
         env:
           GH_TOKEN: ${{ steps.setup-git-committer.outputs.token }}
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
         run: bun script/beta.ts

.github/workflows/compliance-close.yml

@@ -65,6 +65,15 @@ jobs:
                 body: closeMessage,
               });
 
+              try {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: item.number,
+                  name: 'needs:compliance',
+                });
+              } catch (e) {}
+
               if (isPR) {
                 await github.rest.pulls.update({
                   owner: context.repo.owner,

.github/workflows/docs-locale-sync.yml

@@ -12,13 +12,14 @@ jobs:
     if: github.actor != 'opencode-agent[bot]'
     runs-on: blacksmith-4vcpu-ubuntu-2404
     permissions:
-      id-token: write
       contents: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
+          persist-credentials: false
           fetch-depth: 0
+          ref: ${{ github.ref_name }}
 
       - name: Setup Bun
         uses: ./.github/actions/setup-bun
@@ -51,9 +52,54 @@ jobs:
         uses: sst/opencode/github@latest
         env:
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          GITHUB_TOKEN: ${{ steps.committer.outputs.token }}
+          OPENCODE_CONFIG_CONTENT: |
+            {
+              "permission": {
+                "*": "deny",
+                "read": {
+                  "*": "deny",
+                  "packages/web/src/content/docs": "allow",
+                  "packages/web/src/content/docs/*": "allow",
+                  "packages/web/src/content/docs/*.mdx": "allow",
+                  "packages/web/src/content/docs/*/*.mdx": "allow",
+                  ".opencode": "allow",
+                  ".opencode/agent": "allow",
+                  ".opencode/glossary": "allow",
+                  ".opencode/agent/translator.md": "allow",
+                  ".opencode/glossary/*.md": "allow"
+                },
+                "edit": {
+                  "*": "deny",
+                  "packages/web/src/content/docs/*/*.mdx": "allow"
+                },
+                "glob": {
+                  "*": "deny",
+                  "packages/web/src/content/docs*": "allow",
+                  ".opencode/glossary*": "allow"
+                },
+                "task": {
+                  "*": "deny",
+                  "translator": "allow"
+                }
+              },
+              "agent": {
+                "translator": {
+                  "permission": {
+                    "*": "deny",
+                    "read": {
+                      "*": "deny",
+                      ".opencode/agent/translator.md": "allow",
+                      ".opencode/glossary/*.md": "allow"
+                    }
+                  }
+                }
+              }
+            }
         with:
-          model: opencode/gpt-5.2
+          model: opencode/gpt-5.3-codex
           agent: docs
+          use_github_token: true
           prompt: |
             Update localized docs to match the latest English docs changes.
 
@@ -67,10 +113,11 @@ jobs:
             2. You MUST use the Task tool for translation work and launch subagents with subagent_type `translator` (defined in .opencode/agent/translator.md).
             3. Do not translate directly in the primary agent. Use translator subagent output as the source for locale text updates.
             4. Run translator subagent Task calls in parallel whenever file/locale translation work is independent.
-            5. Preserve frontmatter keys, internal links, code blocks, and existing locale-specific metadata unless the English change requires an update.
-            6. Keep locale docs structure aligned with their corresponding English pages.
-            7. Do not modify English source docs in packages/web/src/content/docs/*.mdx.
-            8. If no locale updates are needed, make no changes.
+            5. Use only the minimum tools needed for this task (read/glob, file edits, and translator Task). Do not use shell, web, search, or GitHub tools for translation work.
+            6. Preserve frontmatter keys, internal links, code blocks, and existing locale-specific metadata unless the English change requires an update.
+            7. Keep locale docs structure aligned with their corresponding English pages.
+            8. Do not modify English source docs in packages/web/src/content/docs/*.mdx.
+            9. If no locale updates are needed, make no changes.
 
       - name: Commit and push locale docs updates
         if: steps.changes.outputs.has_changes == 'true'

.github/workflows/pr-standards.yml

@@ -108,11 +108,11 @@ jobs:
 
             await removeLabel('needs:title');
 
-            // Step 2: Check for linked issue (skip for docs/refactor PRs)
-            const skipIssueCheck = /^(docs|refactor)\s*(\([a-zA-Z0-9-]+\))?\s*:/.test(title);
+            // Step 2: Check for linked issue (skip for docs/refactor/feat PRs)
+            const skipIssueCheck = /^(docs|refactor|feat)\s*(\([a-zA-Z0-9-]+\))?\s*:/.test(title);
             if (skipIssueCheck) {
               await removeLabel('needs:issue');
-              console.log('Skipping issue check for docs/refactor PR');
+              console.log('Skipping issue check for docs/refactor/feat PR');
               return;
             }
             const query = `
@@ -189,7 +189,7 @@ jobs:
 
             const body = pr.body || '';
             const title = pr.title;
-            const isDocsOrRefactor = /^(docs|refactor)\s*(\([a-zA-Z0-9-]+\))?\s*:/.test(title);
+            const isDocsRefactorOrFeat = /^(docs|refactor|feat)\s*(\([a-zA-Z0-9-]+\))?\s*:/.test(title);
 
             const issues = [];
 
@@ -225,8 +225,8 @@ jobs:
               }
             }
 
-            // Check: issue reference (skip for docs/refactor)
-            if (!isDocsOrRefactor && hasIssueSection) {
+            // Check: issue reference (skip for docs/refactor/feat)
+            if (!isDocsRefactorOrFeat && hasIssueSection) {
               const issueMatch = body.match(/### Issue for this PR\s*\n([\s\S]*?)(?=###|$)/);
               const issueContent = issueMatch ? issueMatch[1].trim() : '';
               const hasIssueRef = /(closes|fixes|resolves)\s+#\d+/i.test(issueContent) || /#\d+/.test(issueContent);

.github/workflows/publish.yml

@@ -77,6 +77,8 @@ jobs:
           fetch-tags: true
 
       - uses: ./.github/actions/setup-bun
+        with:
+          cross-compile: "true"
 
       - name: Setup git committer
         id: committer
@@ -88,7 +90,7 @@ jobs:
       - name: Build
         id: build
         run: |
-          ./packages/opencode/script/build.ts
+          ./packages/opencode/script/build.ts --all
         env:
           OPENCODE_VERSION: ${{ needs.version.outputs.version }}
           OPENCODE_RELEASE: ${{ needs.version.outputs.release }}

.github/workflows/sign-cli.yml

@@ -20,10 +20,12 @@ jobs:
           fetch-tags: true
 
       - uses: ./.github/actions/setup-bun
+        with:
+          cross-compile: "true"
 
       - name: Build
         run: |
-          ./packages/opencode/script/build.ts
+          ./packages/opencode/script/build.ts --all
 
       - name: Upload unsigned Windows CLI
         id: upload_unsigned_windows_cli

.github/workflows/test.yml

@@ -8,8 +8,16 @@ on:
   workflow_dispatch:
 jobs:
   unit:
-    name: unit (linux)
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    name: unit (${{ matrix.settings.name }})
+    strategy:
+      fail-fast: false
+      matrix:
+        settings:
+          - name: linux
+            host: blacksmith-4vcpu-ubuntu-2404
+          - name: windows
+            host: blacksmith-4vcpu-windows-2025
+    runs-on: ${{ matrix.settings.host }}
     defaults:
       run:
         shell: bash

.github/workflows/vouch-check-issue.yml

@@ -42,15 +42,17 @@ jobs:
               throw error;
             }
 
-            // Parse the .td file for denounced users
+            // Parse the .td file for vouched and denounced users
+            const vouched = new Set();
             const denounced = new Map();
             for (const line of content.split('\n')) {
               const trimmed = line.trim();
               if (!trimmed || trimmed.startsWith('#')) continue;
-              if (!trimmed.startsWith('-')) continue;
 
-              const rest = trimmed.slice(1).trim();
+              const isDenounced = trimmed.startsWith('-');
+              const rest = isDenounced ? trimmed.slice(1).trim() : trimmed;
               if (!rest) continue;
+
               const spaceIdx = rest.indexOf(' ');
               const handle = spaceIdx === -1 ? rest : rest.slice(0, spaceIdx);
               const reason = spaceIdx === -1 ? null : rest.slice(spaceIdx + 1).trim();
@@ -65,32 +67,50 @@ jobs:
               const username = colonIdx === -1 ? handle : handle.slice(colonIdx + 1);
               if (!username) continue;
 
-              denounced.set(username.toLowerCase(), reason);
+              if (isDenounced) {
+                denounced.set(username.toLowerCase(), reason);
+                continue;
+              }
+
+              vouched.add(username.toLowerCase());
             }
 
             // Check if the author is denounced
             const reason = denounced.get(author.toLowerCase());
-            if (reason === undefined) {
-              core.info(`User ${author} is not denounced. Allowing issue.`);
+            if (reason !== undefined) {
+              // Author is denounced — close the issue
+              const body = 'This issue has been automatically closed.';
+
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issueNumber,
+                body,
+              });
+
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issueNumber,
+                state: 'closed',
+                state_reason: 'not_planned',
+              });
+
+              core.info(`Closed issue #${issueNumber} from denounced user ${author}`);
               return;
             }
 
-            // Author is denounced — close the issue
-            const body = 'This issue has been automatically closed.';
-
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: issueNumber,
-              body,
-            });
+            // Author is positively vouched — add label
+            if (!vouched.has(author.toLowerCase())) {
+              core.info(`User ${author} is not denounced or vouched. Allowing issue.`);
+              return;
+            }
 
-            await github.rest.issues.update({
+            await github.rest.issues.addLabels({
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: issueNumber,
-              state: 'closed',
-              state_reason: 'not_planned',
+              labels: ['Vouched'],
             });
 
-            core.info(`Closed issue #${issueNumber} from denounced user ${author}`);
+            core.info(`Added vouched label to issue #${issueNumber} from ${author}`);