release: promote dev to main for beta16

.github/osv-release.toml

@@ -1,13 +1,3 @@
 [[IgnoredVulns]]
 id = "GHSA-j965-2qgj-vjmq"
 reason = "aws-sdk v2 has no fixed version reported by OSV. It is retained only as a transitive package while release artifacts are built with scripts disabled, SBOM, and provenance attestations."
-
-[[IgnoredVulns]]
-id = "GHSA-4mjr-xmp4-gh2g"
-ignoreUntil = 2026-09-07
-reason = "qs 6.16.0 is the first fixed version but remains inside the enforced seven-day minimum release-age window. Revisit immediately after the hold expires."
-
-[[IgnoredVulns]]
-id = "GHSA-x5fp-wj9c-mxmx"
-ignoreUntil = 2026-09-07
-reason = "qs 6.16.0 is the first fixed version but remains inside the enforced seven-day minimum release-age window. Revisit immediately after the hold expires."

.github/workflows/codeql.yml

@@ -48,6 +48,13 @@ jobs:
     name: Analyze JavaScript and TypeScript
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 20
+    # Reuse main's CodeQL database for pull requests and analyze the diff with
+    # the existing code as context. CodeQL falls back to a full scan when the
+    # base database, diff ranges, or runner requirements are unavailable.
+    env:
+      CODEQL_ACTION_OVERLAY_ANALYSIS: "true"
+      CODEQL_ACTION_OVERLAY_ANALYSIS_CODE_SCANNING_JAVASCRIPT: "true"
+      CODEQL_ACTION_DIFF_INFORMED_QUERIES: "true"
     steps:
       - name: Checkout repository
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10

.github/workflows/runtime-recovery.yml

@@ -0,0 +1,74 @@
+name: Runtime and recovery tests
+
+on:
+  pull_request:
+    paths:
+      - "src/mendcode/**"
+      - ".github/workflows/runtime-recovery.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: runtime-recovery-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  contracts:
+    name: Linux runtime and recovery contracts
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+      - name: Setup pnpm
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1
+        with:
+          version: 11.0.9
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version-file: src/mendcode/package.json
+      - name: Install frozen dependencies
+        working-directory: src/mendcode
+        run: pnpm --pm-on-fail=ignore install --frozen-lockfile --ignore-scripts
+      - name: Prepare deterministic test runtime
+        working-directory: src/mendcode/packages/opencode
+        run: |
+          bun run script/fix-node-pty.ts
+          MODELS_DEV_API_JSON="$PWD/test/tool/fixtures/models-api.json" bun run script/generate.ts
+      - name: Typecheck
+        working-directory: src/mendcode
+        run: bun run --cwd packages/opencode typecheck
+      - name: Release index contracts
+        working-directory: src/mendcode
+        run: node --test script/release-index.test.mjs
+      - name: Runtime and updater regressions
+        working-directory: src/mendcode/packages/opencode
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Some suites replace Bun modules globally. Separate processes keep
+          # those mocks and the test/preload.ts database roots isolated.
+          run_test() {
+            bash -c 'export MENDCODE_DB="${TMPDIR:-/tmp}/opencode-test-data-$$/share/contracts.db"; exec bun test --timeout 30000 "$@"' bash "$@"
+          }
+          for test_file in \
+            test/installation/*.test.ts \
+            test/storage/compatibility.test.ts test/storage/writer-lease.test.ts test/storage/sql-identifiers.test.ts \
+            test/mend/code-mode.test.ts test/session/context-profile.test.ts test/session/tool-discovery.test.ts \
+            test/mend/smart-context.test.ts test/mend/smart-service.test.ts test/mend/smart-approval.test.ts \
+            test/permission/next.test.ts test/tool/shell-analysis.test.ts \
+            test/cli/run-attach.test.ts test/cli/upgrade-channel.test.ts test/cli/upgrade-readonly.test.ts \
+            test/cli/tui/shared-server.test.ts test/cli/tui/thread.test.ts \
+            test/cli/tui/widgets-runtime.test.tsx test/cli/tui/widgets-tray.test.tsx \
+            test/cli/tui/agent-command-panel.test.tsx \
+            test/mend/concurrent-model-policy.test.ts \
+            test/plugin/auth-override.test.ts \
+            test/session/continuity.test.ts test/session/session-notes.test.ts test/session/llm.test.ts \
+            test/server/usage.test.ts test/server/release-channel.test.ts test/server/upgrade-progress.test.ts; do
+            run_test "$test_file"
+          done
+          run_test test/session/prompt.test.ts --test-name-pattern "wakes an async parent by default for a background task"

.github/workflows/stable-startup.yml

@@ -33,6 +33,6 @@ jobs:
         working-directory: src/mendcode/packages/opencode
         run: |
           bun run typecheck
-          for test_file in test/installation/backend-startup.test.ts test/installation/recorded-schema.test.ts test/cli/tui/thread.test.ts test/plugin/auth-override.test.ts; do
+          for test_file in test/installation/backend-startup.test.ts test/storage/compatibility.test.ts test/cli/tui/thread.test.ts test/plugin/auth-override.test.ts; do
             bash -c 'export MENDCODE_DB="${TMPDIR:-/tmp}/opencode-test-data-$$/share/contracts.db"; exec bun test --timeout 30000 "$@"' bash "$test_file"
           done

.github/workflows/windows-installer.yml

@@ -0,0 +1,49 @@
+name: Windows installer contracts
+
+on:
+  pull_request:
+    paths:
+      - "src/mendcode/install.ps1"
+      - "src/mendcode/script/windows-installer-smoke.ts"
+      - ".github/workflows/windows-installer.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: windows-installer-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  installer:
+    runs-on: windows-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+        with:
+          bun-version-file: src/mendcode/package.json
+      - name: Verify published executable fixture
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $ErrorActionPreference = "Stop"
+          $fixture = Join-Path $env:RUNNER_TEMP "mendcode-fixture"
+          gh release download v0.1.43 --repo MendCode/MendCode --pattern mendcode-windows-x64.zip --pattern SHA256SUMS --dir $fixture
+          if ($LASTEXITCODE -ne 0) { throw "Fixture download failed" }
+          $archive = Join-Path $fixture "mendcode-windows-x64.zip"
+          gh attestation verify $archive --repo MendCode/MendCode --signer-workflow MendCode/MendCode/.github/workflows/release.yml --deny-self-hosted-runners
+          if ($LASTEXITCODE -ne 0) { throw "Fixture provenance failed" }
+          Expand-Archive -LiteralPath $archive -DestinationPath (Join-Path $fixture "bin")
+          "MENDCODE_INSTALLER_TEST_BINARY=$(Join-Path $fixture 'bin/mendcode.exe')" >> $env:GITHUB_ENV
+          "MENDCODE_VERSION=0.1.43" >> $env:GITHUB_ENV
+      - name: Exercise current installer with verified fixture
+        working-directory: src/mendcode
+        shell: pwsh
+        run: |
+          bun run script/windows-installer-smoke.ts
+          if ($LASTEXITCODE -ne 0) { throw "Windows installer contract failed" }