release: promote dev for beta16

.codex/skills/mendcode-release-flow/SKILL.md

@@ -0,0 +1,66 @@
+---
+name: mendcode-release-flow
+description: Use for MendCode project changes, release prep, PR promotion, version bump decisions, changelog updates, installer validation, and dev-to-main synchronization. Trigger whenever work may ship to users, touches package metadata/versioning, installer/update/health/changelog behavior, or the user mentions bumping a version, release, changelog, PR to dev/main, or letting the user test before shipping.
+---
+
+# MendCode Release Flow
+
+Follow this workflow for MendCode changes that may ship.
+
+## Non-negotiables
+
+- For maintainer/agent work inside the main MendCode repository, use the local `dev` branch by default. Do not create a separate branch unless the user explicitly asks for one, the current worktree has unrelated changes in the same files, or a GitHub contribution flow requires it.
+- Preserve unrelated local changes. If the active checkout is dirty, inspect the touched files first. Work in-place on `dev` only when the requested files are clean or the existing edits are clearly part of the same user-approved task.
+- If unrelated dirty files conflict with the task, stop and explain the blocker before creating a worktree or branch.
+- Before editing release/version/package files, ask or verify whether another agent already bumped the version locally or remotely.
+- Do not publish a release, merge to `main`, or overwrite a user worktree without explicit user intent.
+- Never leave open public PRs/issues as noise. Close, merge, or explain exactly why they must remain open.
+- Never hide security/release failures. If a supply-chain, secret, CodeQL, release, or installer check fails, keep the issue open until fixed or document the exact reason it is accepted.
+
+## Branch Policy
+
+- Internal MendCode maintainers and local agents work on `dev` by default.
+- External contributors should use a fork or feature branch and open a PR targeting `dev`, not `main`.
+- `main` is the public release branch. Only promote `dev` to `main` after CI passes, the user-visible change has been tested, version/changelog state is correct, and the user intends to ship.
+- For internal promotion, prefer a direct `dev` -> `main` PR. Do not create `codex/*` promotion branches unless GitHub cannot represent the intended merge directly or a conflict must be resolved outside the user's local checkout.
+- If an emergency promotion branch/worktree is unavoidable, delete the remote branch, local branch, and temporary worktree immediately after merge or close.
+- Local release or promotion workspaces under `$TMPDIR/mendcode` must be run through `src/mendcode/script/release` or its sourced cleanup helper so the current workspace's `src/mendcode/node_modules` is removed on success or failure. Do not run broad age-based temp cleaners or delete unowned/active temp workspaces.
+- Do not merge random branches directly into `main`. Bring useful branches back through PRs to `dev`, then delete stale branches after merge.
+- Before starting, check whether another PR/agent already contains the same work. Prefer continuing the existing local `dev` work over creating a duplicate branch.
+
+## Standard Flow
+
+1. Inspect `git status`, `git worktree list`, open PRs/issues, latest GitHub release, `origin/dev`, and `origin/main`.
+2. If a version bump may be needed, determine whether the bump already exists:
+   - Check `CHANGELOG.md`.
+   - Check `src/mendcode/packages/opencode/package.json`.
+   - Check extension/package metadata such as `src/mendcode/packages/extensions/zed/extension.toml`.
+   - Check recent merged PRs and tags.
+3. Ask the user before choosing a new version unless the version is already clearly bumped by another agent.
+4. Implement the change on local `dev` unless the Branch Policy says a separate branch/worktree is required.
+5. Run focused tests/scripts for the touched area. Use existing repo scripts and generated-client/build checks when relevant.
+6. Stop and let the user test locally when the change is user-visible. Do not bump/changelog/merge until the user says it works, unless they explicitly ask for fully autonomous shipping.
+7. After the user confirms it works:
+   - Bump version if needed.
+   - Add or update `CHANGELOG.md`.
+   - Open a PR to `dev`, wait for CI, and merge.
+   - Promote `dev` to `main` with a direct PR whenever possible, resolving conflicts deliberately.
+   - Sync `main` back to `dev` if needed so both branches have the same tree.
+8. If releasing:
+   - Use the Release workflow from `main`.
+   - Verify SHA256SUMS.
+   - Publish with real release notes/changelog, not only a SHA.
+   - Smoke-test the public installer in a temporary `HOME`.
+
+## Required Checks
+
+- For code: run the narrow test file or command covering the changed path.
+- For release: verify `mendcode --version` prints the release version.
+- For installer: test `curl -fsSL https://raw.githubusercontent.com/MendCode/MendCode/main/src/mendcode/install | bash -s -- --no-modify-path` in a temporary `HOME`.
+- For supply chain: verify secret scan, dependency review/vulnerability checks, CodeQL/Semgrep, and release artifact checksums before publishing.
+- For branch hygiene: verify open PRs/issues, latest release, branches, and `git diff origin/main..origin/dev`.
+- For local safety: before committing, review `git diff --name-only` and stage only files intentionally changed for this task.
+
+## Reporting
+
+Report only facts that were verified: PR numbers, release URL, version, test commands, and installer result. If the user asked not to report process, keep the final short.

.codex/skills/mendcode-session-guardrails/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: mendcode-session-guardrails
+description: Use at the start of every task in the MendCode repository. Enforces local-only work, risk-based validation, minimal changes, and protection of disk, memory, CPU, and TUI rendering. Load this skill before inspecting or editing code, docs, config, tests, or runtime files.
+---
+
+# MendCode Session Guardrails
+
+Apply these rules to every task in this repository unless the user explicitly overrides a specific rule.
+
+## GitHub and external writes
+
+- Work locally by default. Never run `git push`, create, update, merge, or close GitHub PRs/issues, publish releases/packages, upload artifacts, or post GitHub comments.
+- A direct user request authorizes only that specific external write. Otherwise stop before it and ask.
+- Read-only commands such as `git status`, `git diff`, branch inspection, or remote inspection are allowed when relevant.
+- Do not create a commit unless the user explicitly asks for one.
+
+## Scope and non-regression
+
+- Inspect the worktree before editing. Preserve unrelated changes; never reset, clean, revert, or overwrite them.
+- Read the relevant callers, tests, configuration, and nearby patterns before changing behavior.
+- Make the smallest patch that solves the requested problem. Avoid broad refactors, dependency changes, generated output, migrations, or public API changes unless they are required.
+- Do not claim that MendCode is safe merely because a change is small: check imports, data flow, error paths, and affected callers.
+- For TUI/runtime work, preserve state ownership and event flow. Do not introduce render loops, duplicate subscriptions, unstable keys, unbounded concurrency, or unnecessary rerenders.
+
+## Tests and validation
+
+- For executable behavior, run the narrowest relevant test, typecheck, lint, or runtime smoke check after editing.
+- For a genuinely tiny non-executable change (for example, a skill, documentation, or formatting-only edit), skip the full test suite and validate the file format, frontmatter, and focused diff instead.
+- Treat configuration changes as executable when they can alter runtime behavior; validate them accordingly.
+- Do not run a full build or full test suite by habit. Expand validation only when the risk or repository workflow requires it, or the user asks.
+- Report every check that actually ran and clearly state checks that were intentionally skipped.
+
+## Disk, memory, CPU, and rendering budget
+
+- Prefer targeted reads/searches and bounded commands over full-repository scans, large logs, or repeated whole-file rewrites.
+- Do not create unnecessary generated files, caches, dumps, screenshots, or temporary artifacts; clean up anything required for validation.
+- Avoid unbounded loops, polling, watchers, retries, uncontrolled parallelism, and duplicate work.
+- Keep memory and CPU usage bounded with pagination, lazy work, bounded concurrency, and existing caches/abstractions where appropriate.
+- For UI/TUI changes, avoid rendering entire histories or large collections when only a visible/changed slice is needed.
+- If a change could affect performance or resource usage, inspect and validate that path specifically instead of assuming it is harmless.
+
+## Stop conditions and reporting
+
+- Ask before destructive actions, production/billing changes, security-impacting changes, or material scope expansion.
+- Before finishing, inspect only the relevant diff and confirm no accidental artifacts or unrelated files were changed.
+- Report concisely: changed files, real validation results, skipped checks, blockers, and non-goals.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,66 @@
+name: Bug report
+description: Report a reproducible MendCode bug
+title: "[Bug]: "
+labels:
+  - bug
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What happened?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      description: Give the smallest reproduction you can.
+      placeholder: |
+        1. Run ...
+        2. Open ...
+        3. See ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: MendCode version
+      placeholder: mend --version
+  - type: input
+    id: os
+    attributes:
+      label: OS
+      placeholder: macOS, Linux, Windows, WSL
+  - type: input
+    id: terminal
+    attributes:
+      label: Terminal
+      placeholder: Ghostty, iTerm2, Terminal.app, Windows Terminal
+  - type: textarea
+    id: config
+    attributes:
+      label: Relevant config
+      description: Redact secrets. Do not paste API keys or private prompts.
+      render: text
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and discussions.
+          required: true
+        - label: I removed secrets and private config from this report.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Discussions
+    url: https://github.com/MendCode/MendCode/discussions
+    about: Ask setup, package, mflow, TUI customization, and plugin/widget questions.
+  - name: Private vulnerability report
+    url: https://github.com/MendCode/MendCode/security/advisories/new
+    about: Report security issues privately. Do not open public issues for vulnerabilities.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,45 @@
+name: Feature request
+description: Suggest a MendCode feature or improvement
+title: "[Feature]: "
+labels:
+  - enhancement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What user problem should this solve?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Desired behavior
+      description: What should MendCode do?
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - CLI/setup
+        - TUI customization
+        - Plugins/widgets
+        - Packages/team sharing
+        - mflow
+        - TSM/worktrees
+        - Models/providers
+        - Docs
+        - Other
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched existing issues and discussions.
+          required: true

.github/ISSUE_TEMPLATE/question.yml

@@ -0,0 +1,21 @@
+name: Question
+description: Ask a usage question
+title: "[Question]: "
+labels:
+  - question
+body:
+  - type: markdown
+    attributes:
+      value: For general usage help, GitHub Discussions may be a better place than Issues.
+  - type: textarea
+    id: question
+    attributes:
+      label: Question
+      description: What are you trying to do?
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Context
+      description: Include commands, docs links, or config snippets. Redact secrets.

.github/codeql/codeql-config.yml

@@ -0,0 +1,4 @@
+name: MendCode CodeQL
+
+paths-ignore:
+  - src/mendcode/packages/opencode/script/run-workspace-server

.github/dependabot.yml

@@ -9,6 +9,8 @@ updates:
       time: "09:00"
       timezone: "America/New_York"
     open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7
     groups:
       bun-dependencies:
         patterns:
@@ -27,6 +29,8 @@ updates:
       time: "09:05"
       timezone: "America/New_York"
     open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7
     groups:
       bun-github-action:
         patterns:
@@ -45,6 +49,8 @@ updates:
       time: "09:10"
       timezone: "America/New_York"
     open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7
     groups:
       bun-console-resource:
         patterns:
@@ -63,6 +69,8 @@ updates:
       time: "09:15"
       timezone: "America/New_York"
     open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7
     groups:
       bun-vscode-sdk:
         patterns:
@@ -81,6 +89,8 @@ updates:
       time: "09:30"
       timezone: "America/New_York"
     open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7
     groups:
       github-actions:
         patterns:

.github/osv-release.toml

@@ -0,0 +1,3 @@
+[[IgnoredVulns]]
+id = "GHSA-j965-2qgj-vjmq"
+reason = "aws-sdk v2 has no fixed version reported by OSV. It is retained only as a transitive package while release artifacts are built with scripts disabled, SBOM, and provenance attestations."

.github/pull_request_template.md

@@ -0,0 +1,32 @@
+## Summary
+
+Describe what changed and why.
+
+## Type
+
+- [ ] Bug fix
+- [ ] Feature
+- [ ] Documentation
+- [ ] Refactor
+- [ ] Release/package maintenance
+- [ ] Security hardening
+
+## Verification
+
+List the commands or manual checks you ran.
+
+```bash
+
+```
+
+## Screenshots or Recordings
+
+Required for TUI/UI-facing changes when practical.
+
+## Checklist
+
+- [ ] I kept this PR focused.
+- [ ] I tested the affected behavior.
+- [ ] I updated docs when behavior changed.
+- [ ] I did not include secrets, private config, or unrelated local files.
+- [ ] I checked whether release assets, installer behavior, or package docs need updates.

.github/release.yml

@@ -0,0 +1,25 @@
+changelog:
+  exclude:
+    labels:
+      - ignore-for-release
+    authors:
+      - dependabot
+  categories:
+    - title: Features
+      labels:
+        - enhancement
+        - feature
+    - title: Fixes
+      labels:
+        - bug
+        - fix
+    - title: Documentation
+      labels:
+        - documentation
+        - docs
+    - title: Security
+      labels:
+        - security
+    - title: Other
+      labels:
+        - "*"