chore(sync): port upstream 0.5.7 into the public distribution

[weekbin]

Change

Ports the upstream source update through 0.5.7 into this public distribution, and keeps the branch current with main.

The merge base with upstream is 944e874 — the previous sync point — so this applies the full 0.5.3–0.5.7 delta: 27 upstream commits, 209 files against main. Root and TUI source versions move 0.5.2 → 0.5.7.

main advanced by nine webui-parity changes (#55–#63) while this pull request was open, which left the branch conflicted. main is merged in with main treated as the baseline: packages/webui/** is byte-identical to main, no file present in main is missing here, and the conflict there — docs/tui-capabilities.md, where the sync and the webui slash-command work each appended independent sections after the capability matrix — is resolved as a union keeping main's section verbatim.

0.5.5

Behavior matching the upstream 0.5.5 review:

• Managed foreground Bash caps larger requests at a one-hour deadline; the 60-second foreground yield preserves the running process and its original deadline. Explicit background tasks keep a one-hour runtime watchdog, and explicit command timeouts stay separate.
• Automatic context compaction reserves output space before reaching the context limit, scales checkpoint output with the model window, advances reasoning-only output exhaustion to a smaller candidate, and gives provider errors one bounded logical retry. Automatic failures retain the original history; valid manual checkpoints are committed even when a local estimate rejects them.
• Update downloads reuse the TUI's proxy and loopback-bypass policy and load their network dependency lazily. Existing installation ownership and registry selection are unchanged.
• Memory-tool results carry a 16 KiB model-facing limit with a head/tail preview and guidance for reading more. Storage and upload behavior are unchanged.
• Additions: plugin mentions in the editor, starred models in the catalog, terminal titles (tui.terminalTitle), background-task settlement and stop handling, and skill-directory symlink handling.

0.5.6 and 0.5.7

• Token speed over generation time (fix: measure token speed over model generation time MiniMax-AI/minimax-code#373) replaces the wall-clock span with a generation-time window, so the reported rate reflects model generation rather than the whole turn. Decode-timing and content-timing tests cover the event bridge and session content path.
• M3.1 Flash Preview in the fallback catalog (feat(config): add M3.1 Flash Preview to the fallback catalog MiniMax-AI/minimax-code#375) adds a static bundled-catalog descriptor with capability, context-window and thinking metadata. It introduces no endpoint, no credential and no new network dependency, and the existing catalog tests still gate it.
• Two version bumps to 0.5.6 and 0.5.7.

Excluded, pending separate review

• The upstream ESLint stack — .eslintrc.cjs, its six devDependencies (eslint, @typescript-eslint/{parser,eslint-plugin}, eslint-config-airbnb-base, eslint-config-prettier, eslint-plugin-{import,prettier}), the lint:tui verification step, and its CONTRIBUTING.md section. This distribution has no lint gate, so the merged verify.mjs step would reference a script that does not exist and fail every run. The stack is roughly 130 additional packages: a dependency decision, not a source sync. CONTRIBUTING.md now states that the distribution ships no ESLint stack or lint gate. None of the 0.5.6/0.5.7 commits touch the lint surface, so the exclusion holds across both steps.

release/extraction.json sourceRevision deliberately stays at 9b9885e. Advancing it would incorrectly mark the remaining runtime ownership migrations, service integrations and source-tree moves as synchronized; those still need their own public dependency and privacy review.

Conflict resolutions

File	Resolution
package.json	Took the upstream version and kept every public webui:* script plus the public test:release-tools entry. Dropped the lint / lint:tui scripts and the six ESLint devDependencies.
pnpm-lock.yaml	Kept the public lockfile and reconciled it with pnpm install. The only change is the @mavis/shared workspace link that system-reminder gained — 3 added lines, no registry package change. The 0.5.6/0.5.7 step needs none.
release/dependency-licenses.json	Kept the public version: the declared dependency set is unchanged. No diff against main.
test/source-sync.test.mjs	Kept the public version; the upstream side only added a TUI-lint test that cannot run without the excluded stack. No diff against main.
test/vitest-suites.json	Union at both steps. All 20 upstream-only entries exist in this tree and join the capability group (170 → 185 → 190). No main entry removed, no duplicates, each group stays sorted.
docs/tui-capabilities.md	Union. main's slash-command parity section is preserved byte-for-byte; the sections added by the sync follow it.
release/public-source.json	Regenerated with node scripts/source-inventory.mjs --write (4702 paths).
tsconfig.standalone.json	Regenerated with pnpm gen:tsconfig for the new ./plugin-mention and ./memory-limits export subpaths; 128 paths recorded. The 0.5.6/0.5.7 step adds no export.

No packages/webui/** file is modified by the sync, and the LOCAL_CHANGES / MINIMAX_CHANGES bookkeeping kept every previously recorded change ID while adding the new ones (L041–L043).

Publication review

• No generated IDL, no internal host, and no credential appears in the delta. The only API-key-shaped additions are synthetic fixtures (synthetic-discovery-key, synthetic-draft-key, selected-provider-key).
• Evaluation capture, workspace snapshot/archive/upload and semantic-index activation remain excluded; the new compaction code adds no telemetry call, and the existing telemetry-consent and privacy suites still pass.
• The one new root-adjacent file, docs/source-sync-0.5.5.md, is upstream's own already-public review note; it is included as the record of the 0.5.5 selection and documents the unchanged sourceRevision baseline.
• The new checkpoint prompt keeps its localization contract: content in the conversation's primary language, with literal untranslated English section headings.

Source tracking

Upstream history is carried in by merge commit, never rebase or cherry-pick, so the ported commits stay individually visible and the gap to upstream stays measurable.

Point	Revision
Previous sync point (already in main)	944e874
0.5.5 selection	0f6ad52
Current upstream head	2aed5ca (v0.5.6 tag at 836580e+)

The 27 upstream commits this pull request brings into main, in order:

b2f146a  fix(tui): keep interrupted footer hidden during edit resubmission (#332)
ffbfff6  fix(tui): restore chat viewport after autocomplete shrinks (#331)
76262af  fix(tui): restore chat after transient layout shrink (#333)
47d1424  fix(skills): discover linked workspace skill directories (#337)
782f64d  fix(tui): reset rewound todos and preserve local commands during edits (#336)
67afb61  feat(tui): select plugins with durable identity mentions (#334)
a914a30  chore(tui): restore source ESLint rules and verification gate (#341)
61c4c31  feat: improve local Bash execution contracts
2afb1ae  test: reuse existing suites for Bash regressions
2943a87  fix: bound background Bash receipt purpose
ba92d63  fix(goal): keep unbound tool rejections recoverable
18e7278  fix: validate Windows managed updates through the package entry (#351)
6bd59b5  chore: release MiniMax Code 0.5.3 (#352)
0dbdc0b  fix(tui): preserve detached scrolling across layout changes (#350)
45d9680  test(tui): cover permission picker table restoration (#353)
f4e2285  feat(tui): add model favorites to the /model picker (#342)
76deb1c  perf: reduce repeated work in long sessions (#314)
135584a  chore: bump version to 0.5.4 (#354)
8b55164  feat(tui): improve session titles and terminal notifications (#355)
4198174  fix: remove forced branching from bash guidance (#358)
258adde  feat: sync reviewed 0.5.5 runtime improvements (#367)
a30a898  docs: publish feedback and private security contact channels (#360)
0f6ad52  fix(tui): distinguish Bash recaps and import models during onboarding (#369)
51ac3b2  fix: measure token speed over model generation time (#373)
836580e  chore: bump version to 0.5.6 (#374)
0b7403c  feat(config): add M3.1 Flash Preview to the fallback catalog (#375)
2aed5ca  chore: bump version to 0.5.7 (#377)

Re-check the tracking state at any time:

git fetch upstream
git log --oneline origin/main..upstream/main   # upstream commits not yet in main
git log --oneline 944e874..upstream/main      # the tracked range for this port

This pull request must be merged with a merge commit, not squashed. The repository allows all three strategies, but a squash would collapse these 27 upstream commits and the three sync merges into one commit and erase the tracking above. The previous sync (PR #19) was merged with a merge commit, which is why 944e874 is still an ancestor of main.

One upstream commit is tracked but deliberately not taken: a914a30 chore(tui): restore source ESLint rules and verification gate (#341). It appears in this history for completeness, but its content is excluded here — see "Excluded, pending separate review".

Validation

Run on revision a6da443, profile full, linux/x64, Node v24.19.0, against a clean tracked working tree. pnpm verify is the same gate list, in the same order, as CI.

PASS (17)

check:source (4702 files) · check:tsconfig (128 exports) · export source preview · test:release-tools (69 passed, 1 Windows-only skip) · typecheck · webui:typecheck · build · check:standalone · check:webui-bundle · test:artifact · test:capabilities (190 files, 4935 passed, 18 skipped) · test:status-contract · test:smoke · test:byok · test:webui · test:webapp · test:policy

SKIP (3) — test:windows and test:sandbox are not applicable on linux/x64; test:release-package requires an npm release archive.

Each sync step was verified on its own commit on a clean tree: 13f52a8 for the 0.5.5 selection, e2f5c3e for the main merge, a6da443 for the 0.5.6/0.5.7 extension. CI on 13f52a8 was green across ubuntu, macos and windows (16 checks passed, 5 skipped, 0 failed).

• Performance: basic only. perf:full was not run.
• NOT RUN, platform limitations and live-service boundaries:
  • macOS and Windows were not exercised locally; their gates are selected by platform rather than skipped silently, and the Windows-only test:release-tools case is reported skipped rather than passed.
  • Offline suites are not evidence of live-service ingestion, model quality, or Windows/macOS runtime acceptance. Real-model and platform acceptance remain separate.
  • The full pnpm verify matrix in CI remains the authoritative check for this PR.

Publication and contribution checks

• I have permission to contribute these changes under the existing licenses applicable to the changed files/packages; imported material and its provenance are identified and existing notices are preserved.
• No credentials, account data, real user content, internal source history or private review material is included.
• Added/removed source files were reviewed before regenerating release/public-source.json; new tests are declared in test/vitest-suites.json where applicable.
• Shared English/Chinese documentation and capability/verification records are updated where applicable. Mock/offline results are not described as live-service acceptance.

Maintainer handoff

Publication scope or license changes (if any): none. The dependency set is unchanged — the only manifest change is a workspace: link, and no license inventory entry was added, removed or relicensed.

Shared-source port: complete for the 0.5.3–0.5.7 selection. The ESLint stack is the one upstream item held back and needs its own decision; sourceRevision intentionally stays at 9b9885e.