DRAFT chore(sync): upstream v1.18.11 → 1.18.11-dev_ttk

.dockerignore

@@ -0,0 +1,12 @@
+.git
+.opencode
+.sst
+.turbo
+.wrangler
+node_modules
+**/node_modules
+**/.output
+**/dist
+**/.turbo
+**/.vite
+**/coverage

.gitattributes

@@ -0,0 +1,2 @@
+packages/core/migration/**/snapshot.jsonlinguist-generated
+packages/core/src/database/migration.gen.tslinguist-generated

.github/CODEOWNERS

@@ -1,5 +1,3 @@
 # web + desktop packages
-packages/app/ @adamdotdevin
-packages/tauri/ @adamdotdevin
-packages/desktop/src-tauri/ @brendonovich
-packages/desktop/ @adamdotdevin
+packages/app/ @Hona@Brendonovich
+packages/desktop/ @Hona@Brendonovich

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -1,5 +1,5 @@
 name: Bug report
-description: Report an issue that should be fixed
+description: Report an issue that should be fixed (avoid pasting giant AI generated summaries or your issue may be closed/ignored)
 body:
  - type: textarea
  id: description

.github/ISSUE_TEMPLATE/config.yml

@@ -2,4 +2,4 @@ blank_issues_enabled: false
 contact_links:
  - name: 💬 Discord Community
 url: https://discord.gg/opencode
-about: For quick questions or real-time discussion. Note that issues are searchable and help others with the same question.
+about: For support, troubleshooting, how-to questions, and real-time discussion.

.github/TEAM_MEMBERS

@@ -1,4 +1,5 @@
 adamdotdevin
+arvsrn
 Brendonovich
 fwang
 Hona
@@ -7,10 +8,14 @@ jayair
 jlongster
 kitlangton
 kommander
+ludvigrask
 MrMushrooooom
 nexxeln
 R44VC0RP
 rekram1-node
 thdxr
 simonklee
+Slickstef11
+usrnk1
 vimtor
+StarpTech

.github/actions/setup-bun/action.yml

@@ -8,6 +8,13 @@ inputs:
 runs:
  using: "composite"
  steps:
+ # node-gyp@latest (invoked via bunx for native install scripts) requires Node >=22;
+ # some runner images ship an older system Node on PATH
+ - name: Setup Node
+ uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+ with:
+ node-version: "24"
+
  - name: Get baseline download URL
  id: bun-url
  shell: bash
@@ -23,7 +30,7 @@ runs:
  fi
 
  - name: Setup Bun
- uses: oven-sh/setup-bun@v2
+ uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
  with:
  bun-version-file: ${{ !steps.bun-url.outputs.url && 'package.json' || '' }}
  bun-download-url: ${{ steps.bun-url.outputs.url }}
@@ -33,8 +40,9 @@ runs:
  shell: bash
  run: echo "dir=$(bun pm cache)" >> "$GITHUB_OUTPUT"
 
- - name: Cache Bun dependencies
- uses: actions/cache@v4
+ - name: Restore Bun dependencies
+ id: bun-cache
+ uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
  with:
  path: ${{ steps.cache.outputs.dir }}
  key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}
@@ -56,3 +64,10 @@ runs:
  bun install ${{ inputs.install-flags }}
  fi
  shell: bash
+
+ - name: Save Bun dependencies
+ if: steps.bun-cache.outputs.cache-hit != 'true' && github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
+ uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+ with:
+ path: ${{ steps.cache.outputs.dir }}
+ key: ${{ runner.os }}-bun-${{ hashFiles('**/bun.lock') }}

.github/actions/setup-git-committer/action.yml

@@ -19,7 +19,7 @@ runs:
  steps:
  - name: Create app token
  id: apptoken
- uses: actions/create-github-app-token@v2
+ uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
  with:
  app-id: ${{ inputs.opencode-app-id }}
  private-key: ${{ inputs.opencode-app-secret }}

.github/workflows/beta.yml

@@ -14,7 +14,7 @@ jobs:
  pull-requests: write
  steps:
  - name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
  with:
  fetch-depth: 0
 

.github/workflows/close-issues.yml

@@ -13,9 +13,9 @@ jobs:
  contents: read
  issues: write
  steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
- - uses: oven-sh/setup-bun@v2
+ - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
  with:
  bun-version: latest
 

.github/workflows/close-prs.yml

@@ -0,0 +1,50 @@
+name: close-prs
+
+on:
+ schedule:
+ - cron: "0 22 * * *" # Daily at 10:00 PM UTC
+ workflow_dispatch:
+ inputs:
+ dry-run:
+ description: "Log matching PRs without closing them"
+ type: boolean
+ default: true
+ max-close:
+ description: "Maximum matching PRs to close"
+ type: string
+ required: false
+ default: "50"
+
+jobs:
+ close:
+ runs-on: ubuntu-latest
+ timeout-minutes: 240
+ permissions:
+ contents: read
+ issues: write
+ pull-requests: write
+ steps:
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+
+ - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+ with:
+ bun-version: latest
+
+ - name: Close old PRs without enough positive reactions
+ env:
+ GITHUB_TOKEN: ${{ github.token }}
+ run: |
+ max_close="${{ inputs['max-close'] }}"
+ if [ -z "$max_close" ]; then
+ max_close="50"
+ fi
+
+ args=("--threshold" "2" "--age-months" "1" "--sleep-ms" "20000" "--max-close" "$max_close")
+
+ if [ "${{ github.event_name }}" = "schedule" ]; then
+ args+=("--execute")
+ elif [ "${{ inputs['dry-run'] }}" = "false" ]; then
+ args+=("--execute")
+ fi
+
+ bun script/github/close-prs.ts "${args[@]}"

.github/workflows/compliance-close.yml

@@ -17,7 +17,7 @@ jobs:
  if: github.repository == 'anomalyco/opencode'
  steps:
  - name: Close non-compliant issues and PRs after 2 hours
- uses: actions/github-script@v7
+ uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
  with:
  script: |
  const { data: items } = await github.rest.issues.listForRepo({
@@ -35,10 +35,48 @@ jobs:
 
  const now = Date.now();
  const twoHours = 2 * 60 * 60 * 1000;
+ const orgMemberAssociations = new Set(['OWNER', 'MEMBER']);
+ const agentLogin = 'opencode-agent[bot]';
+ const { data: file } = await github.rest.repos.getContent({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ path: '.github/TEAM_MEMBERS',
+ ref: 'dev',
+ });
+ const teamMembers = new Set(
+ Buffer.from(file.content, 'base64')
+ .toString()
+ .split('\n')
+ .map((line) => line.trim().toLowerCase())
+ .filter(Boolean)
+ );
+
+ function isExempt(item) {
+ const login = item.user?.login?.toLowerCase();
+ return (
+ login === agentLogin ||
+ orgMemberAssociations.has(item.author_association) ||
+ (login && teamMembers.has(login))
+ );
+ }
 
  for (const item of items) {
  const isPR = !!item.pull_request;
  const kind = isPR ? 'PR' : 'issue';
+ const login = item.user?.login;
+
+ if (isExempt(item)) {
+ core.info(`Skipping ${kind} #${item.number}; author ${login || 'unknown'} is exempt`);
+ try {
+ await github.rest.issues.removeLabel({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ issue_number: item.number,
+ name: 'needs:compliance',
+ });
+ } catch (e) {}
+ continue;
+ }
 
  const { data: comments } = await github.rest.issues.listComments({
  owner: context.repo.owner,

.github/workflows/containers.yml

@@ -21,18 +21,18 @@ jobs:
  REGISTRY: ghcr.io/${{ github.repository_owner }}
  TAG: "24.04"
  steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
  - uses: ./.github/actions/setup-bun
 
  - name: Set up QEMU
- uses: docker/setup-qemu-action@v3
+ uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
  - name: Set up Docker Buildx
- uses: docker/setup-buildx-action@v3
+ uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
  - name: Login to GHCR
- uses: docker/login-action@v3
+ uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
  with:
  registry: ghcr.io
  username: ${{ github.repository_owner }}

.github/workflows/deploy.yml

@@ -9,27 +9,33 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+ contents: read
+ id-token: write
+
 jobs:
  deploy:
+ if: github.repository == 'anomalyco/opencode' && (github.ref_name == 'dev' || github.ref_name == 'production')
  runs-on: ubuntu-latest
+<<<<<<< HEAD
  if: github.repository == 'anomalyco/opencode'
+=======
+ environment: ${{ github.ref_name }}
+>>>>>>> upstream/dev
  steps:
- - uses: actions/checkout@v3
+ - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
  - uses: ./.github/actions/setup-bun
 
- - uses: actions/setup-node@v4
+ - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
  with:
  node-version: "24"
 
- # Workaround for Pulumi version conflict:
- # GitHub runners have Pulumi 3.212.0+ pre-installed, which removed the -root flag
- # from pulumi-language-nodejs (see https://github.com/pulumi/pulumi/pull/21065).
- # SST 3.17.x uses Pulumi SDK 3.210.0 which still passes -root, causing a conflict.
- # Removing the system language plugin forces SST to use its bundled compatible version.
- # TODO: Remove when sst supports Pulumi >3.210.0
- - name: Fix Pulumi version conflict
- run: sudo rm -f /usr/local/bin/pulumi-language-nodejs
+ - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+ with:
+ role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
+ role-session-name: opencode-${{ github.run_id }}
+ aws-region: us-east-1
 
  - run: bun sst deploy --stage=${{ github.ref_name }}
  env:
@@ -38,7 +44,6 @@ jobs:
  PLANETSCALE_SERVICE_TOKEN: ${{ secrets.PLANETSCALE_SERVICE_TOKEN }}
  STRIPE_SECRET_KEY: ${{ github.ref_name == 'production' && secrets.STRIPE_SECRET_KEY_PROD || secrets.STRIPE_SECRET_KEY_DEV }}
  HONEYCOMB_API_KEY: ${{ secrets.HONEYCOMB_API_KEY }}
- INCIDENT_API_KEY: ${{ secrets.INCIDENT_API_KEY }}
  SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
  SENTRY_ORG: ${{ vars.SENTRY_ORG }}
  SENTRY_PROJECT: ${{ vars.WEB_SENTRY_PROJECT }}

.github/workflows/docs-locale-sync.yml

@@ -16,7 +16,7 @@ jobs:
  contents: write
  steps:
  - name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
  with:
  persist-credentials: false
  fetch-depth: 0

.github/workflows/docs-update.yml

@@ -18,7 +18,7 @@ jobs:
  pull-requests: write
  steps:
  - name: Checkout repository
- uses: actions/checkout@v4
+ uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
  with:
  fetch-depth: 0 # Fetch full history to access commits
 
@@ -43,7 +43,7 @@ jobs:
 
  - name: Run opencode
  if: steps.commits.outputs.has_commits == 'true'
- uses: sst/opencode/github@latest
+ uses: sst/opencode/github@2c14fc5586fe0b88e5c04732d2e846769cc35671 # latest
  env:
  OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
  with: