chore: sync upstream opencode and keep only the macOS release workflow

.gitattributes

@@ -1,2 +1,11 @@
 packages/core/migration/**/snapshot.json linguist-generated
 packages/core/src/database/migration.gen.ts linguist-generated
+packages/core/src/models-dev/snapshot.txt linguist-generated
+packages/core/src/database/schema.gen.ts linguist-generated
+packages/desktop/src/main/storage/migration.gen.ts linguist-generated
+packages/protocol/openapi.json linguist-generated
+packages/client/src/promise/generated/** linguist-generated
+packages/client/src/effect/generated/** linguist-generated
+packages/client/src/effect/api/** linguist-generated
+packages/core/src/**/*.txt text eol=lf
+packages/httpapi-codegen/test/generated/*.ts text eol=lf

.github/CODEOWNERS

@@ -1,3 +1,11 @@
 # web + desktop packages
 packages/app/      @Hona @Brendonovich
 packages/desktop/  @Hona @Brendonovich
+
+# GUI plugin SDK
+# changes here must be meticulous - pls chat first :)
+packages/plugin/src/gui/  @Hona
+
+# CI and releases. Release jobs that hold secrets run only .github/workflows/release.yml and .github/release/,
+# which makes this path the release security boundary.
+/.github/ @anomalyco/releasers

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -41,9 +41,9 @@ body:
   - type: textarea
     id: screenshot-or-link
     attributes:
-      label: Screenshot and/or share link
-      description: Run `/share` to get a share link, or attach a screenshot
-      placeholder: Paste link or drag and drop screenshot here
+      label: Screenshot
+      description: Attach a screenshot or recording
+      placeholder: Drag and drop screenshot here
     validations:
       required: false
 

.github/RELEASING.md

@@ -1,20 +1,19 @@
 # MobileCode releases
 
-MobileCode publishes unsigned Apple-silicon macOS builds from `release-macos.yml`. The workflow creates a GitHub release with the DMG, ZIP, and `latest-mac.yml`, and also retains those files as workflow-run artifacts.
+MobileCode publishes unsigned Apple-silicon macOS builds from `release-macos.yml`, the only workflow in this repository. It runs the desktop and device-preview tests, builds the bundled CLI and the desktop app, attaches the DMG to a GitHub release, and also keeps it as a workflow-run artifact.
 
 ## One-time GitHub setup
 
 1. In **Settings → Actions → General**, enable GitHub Actions and allow actions created by GitHub and verified creators.
-2. In the **Actions** tab, disable inherited OpenCode workflows that MobileCode does not use. Leave **Release macOS** enabled. Workflow enabled/disabled state is stored by GitHub, so this avoids changing upstream workflow files and keeps upstream merges straightforward.
-3. In **Settings → Actions → General → Workflow permissions**, select **Read and write permissions**. The release workflow also declares its narrower `contents: write` permission.
+2. In **Settings → Actions → General → Workflow permissions**, select **Read and write permissions**. The release workflow also declares its narrower `contents: write` permission.
 
 No Apple secrets are required while builds are unsigned. macOS auto-update is intentionally disabled for unsigned builds because Squirrel.Mac requires code signing. Users download each release manually and must approve the app on first launch.
 
 ## Create a release
 
-Open **Actions → Release macOS → Run workflow**, choose `dev`, and choose whether to publish immediately. The workflow reads the version from `packages/opencode/package.json` and creates the matching tag. For example, OpenCode version `1.18.29` produces `v1.18.29`. If an unpublished tag or draft release already exists for that version, a manual run safely moves the tag to the selected commit. Published release tags remain immutable.
+Open **Actions → Release macOS → Run workflow**, choose `dev`, and choose whether to publish immediately. The workflow reads the version from `packages/desktop/package.json` and creates the matching tag. For example, version `2.2.5` produces `v2.2.5`. If an unpublished tag or draft release already exists for that version, a manual run safely moves the tag to the selected commit. Published release tags remain immutable.
 
-Pushing a `v*` tag is also supported and creates a draft release for review, but the tag version must match `packages/opencode/package.json`.
+Pushing a `v*` tag is also supported and creates a draft release for review, but the tag version must match `packages/desktop/package.json`.
 
 ## Sync from OpenCode
 
@@ -26,7 +25,9 @@ git checkout dev
 git merge upstream/dev
 ```
 
-Keep upstream's internal `@opencode-ai/*` workspace package names, `OPENCODE_*` environment variables, server protocol, and CLI terminology. They are implementation contracts, not installed-app identity, and retaining them minimizes merge conflicts. MobileCode-specific identity is limited to packaging metadata, application data directories, URL protocol, assets, and release configuration.
+Keep upstream's internal `@opencode/*` workspace package names, `OPENCODE_*` environment variables, server protocol, and CLI terminology. They are implementation contracts, not installed-app identity, and retaining them minimizes merge conflicts. MobileCode-specific identity is limited to packaging metadata, application data directories, URL protocol, assets, and release configuration.
+
+Upstream adds and changes workflows under `.github/workflows/`. MobileCode keeps only `release-macos.yml`, so delete any new upstream workflow files during the merge (`git rm`), and resolve modify/delete conflicts on removed workflows by keeping them deleted.
 
 After resolving any branded-file conflicts, verify from `packages/desktop`:
 

.github/TEAM_MEMBERS

@@ -20,4 +20,3 @@ Slickstef11
 usrnk1
 vimtor
 StarpTech
-vaprdev

.github/actions/setup-bun/action.yml

@@ -1,6 +1,10 @@
 name: "Setup Bun"
 description: "Setup Bun with caching and install dependencies"
 inputs:
+  bun-version:
+    description: "Bun version to install instead of the root packageManager version"
+    required: false
+    default: ""
   install-flags:
     description: "Additional flags to pass to 'bun install'"
     required: false
@@ -15,56 +19,61 @@ runs:
       with:
         node-version: "24"
 
-    - name: Get Bun version and baseline download URL
+    - name: Get baseline download URL
       id: bun-url
       shell: bash
       run: |
-        V=$(node -p "require('./package.json').packageManager.split('@')[1]")
-        # Bun 1.4.2 includes the patched peer-variant fix in oven-sh/bun#33646.
-        if [ "$RUNNER_OS" = "Windows" ]; then V=1.4.2; fi
-        echo "version=$V" >> "$GITHUB_OUTPUT"
         if [ "$RUNNER_ARCH" = "X64" ]; then
+          V="${{ inputs.bun-version }}"
+          if [ -z "$V" ]; then V=$(node -p "require('./package.json').packageManager.split('@')[1]"); fi
+          TAG=$([ "$V" = "canary" ] && echo "canary" || echo "bun-v${V}")
           case "$RUNNER_OS" in
             macOS)   OS=darwin ;;
             Linux)   OS=linux ;;
             Windows) OS=windows ;;
           esac
-          echo "url=https://github.com/oven-sh/bun/releases/download/bun-v${V}/bun-${OS}-x64-baseline.zip" >> "$GITHUB_OUTPUT"
+          echo "url=https://github.com/oven-sh/bun/releases/download/${TAG}/bun-${OS}-x64-baseline.zip" >> "$GITHUB_OUTPUT"
         fi
 
     - name: Setup Bun
-      id: setup-bun
       uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
-        bun-version: ${{ !steps.bun-url.outputs.url && steps.bun-url.outputs.version || '' }}
+        bun-version: ${{ !steps.bun-url.outputs.url && inputs.bun-version || '' }}
+        bun-version-file: ${{ !steps.bun-url.outputs.url && !inputs.bun-version && 'package.json' || '' }}
         bun-download-url: ${{ steps.bun-url.outputs.url }}
 
     - name: Get cache directory
       id: cache
       shell: bash
-      run: echo "dir=$(bun pm cache)" >> "$GITHUB_OUTPUT"
+      run: |
+        echo "dir=$(bun pm cache)" >> "$GITHUB_OUTPUT"
+        echo "version=$(bun --version)" >> "$GITHUB_OUTPUT"
 
+    # On Windows, extracting the cache archive takes longer than Bun downloading and
+    # extracting the same packages itself, so Windows installs skip the cache.
     - name: Restore Bun dependencies
       id: bun-cache
+      if: runner.os != 'Windows'
       uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ${{ steps.cache.outputs.dir }}
-        key: ${{ runner.os }}-bun-${{ steps.setup-bun.outputs.bun-version }}-${{ hashFiles('**/bun.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-bun-${{ steps.setup-bun.outputs.bun-version }}-
+        key: ${{ runner.os }}-${{ runner.arch }}-bun-${{ steps.cache.outputs.version }}-${{ hashFiles('bun.lock', 'patches/**') }}
+        # Each dev merge changes beta's bun.lock. Beta falls back to the newest cache for the same Bun version
+        # (Bun's cache stores every package version separately) instead of installing everything from npm.
+        restore-keys: ${{ (github.ref_name == 'beta' && format('{0}-{1}-bun-{2}-', runner.os, runner.arch, steps.cache.outputs.version)) || '' }}
 
     - name: Install setuptools for distutils compatibility
       # Ubuntu 24.04 marks its Python as externally managed (PEP 668); allow the install rather than log an error.
       run: python3 -m pip install --break-system-packages setuptools || pip install setuptools || true
       shell: bash
 
     - name: Install dependencies
-      run: bun install ${{ inputs.install-flags }}
+      run: bun install --frozen-lockfile ${{ inputs.install-flags }}
       shell: bash
 
     - name: Save Bun dependencies
-      if: steps.bun-cache.outputs.cache-hit != 'true' && github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
+      if: runner.os != 'Windows' && steps.bun-cache.outputs.cache-hit != 'true' && github.event_name != 'pull_request' && github.event_name != 'pull_request_target'
       uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ${{ steps.cache.outputs.dir }}
-        key: ${{ runner.os }}-bun-${{ steps.setup-bun.outputs.bun-version }}-${{ hashFiles('**/bun.lock') }}
+        key: ${{ steps.bun-cache.outputs.cache-primary-key }}

.github/pull_request_template.md

@@ -17,6 +17,13 @@ Please provide a description of the issue, the changes you made to fix it, and w
 
 ### How did you verify your code works?
 
+### Visual
+
+_Optional, for user-facing changes: a small looping animated SVG (240×72) of the change, shown in the desktop app's "What's new in beta". Replace the block below or delete this section._
+
+```svg
+```
+
 ### Screenshots / recordings
 
 _If this is a UI change, please include a screenshot or recording._