[shuv1337]

chore(sync): merge upstream dev through a5fda7e

Base: integration-v2 · Head: sync/upstream-dev-20261109

Summary

Merge 140 upstream dev commits after the #477 pin, preserve the existing Shuvcode overlay, and prepare 2.2.6-shuv.2. This PR does not merge itself, publish, or deploy anything.

Includes #478 (Claude CLI identity). After #478 landed, origin/integration-v2 was merged normally in de46a5bace; no rebase or history rewrite. packages/claude-plugin is byte-for-byte identical to the merged #478 tree. All verification below ran after that merge.

SHAs

Ref	SHA
Original fork base / #477	6a581a34c564da7c93cc8a1b19060c49811cafa9
Current PR base, including #478	51cede01da3c9ae590222d62f7aec06a53acea9e
Previous upstream pin	64f2403ffa55b8bbbd7c05f79b630f866f0ae66a
Frozen upstream dev pin, merged	a5fda7ee1347eb3bb1227724e0ad8cdc091ad7e3
Upstream tip at completion fetch, not merged	20c056d84249fe29be7244ff4f9e0aad044c4799
Combined product-code tree, built and smoke-tested	de46a5bacec2008616e703102c6e425d8a1d177f
Final head	715fd38f27dba3bfcbf7b75269c0ca41d55446cf

Commits after de46a5bace change only documentation/changelog, test fixtures/preload and the hygiene allowlist, not product code, dependencies, generated clients, or build configuration. The checks/results below distinguish those test-only fixes from the earlier builds.

Commits (first parent)

1. 0eb60e5f14 docs(sync): inventory preserved fork branches and freeze dev pin
2. bd6aebb7da chore(sync): merge upstream dev through a5fda7e
3. 73abd1f7dc chore(release): prepare 2.2.6-shuv.2 notes and version floor
4. de46a5bace normal merge of origin/integration-v2, including fix(claude-plugin): follow installed Claude CLI identity #478
5. e1d92e04f3 docs(sync): record merged Claude CLI identity update
6. 55ac7ee6d2 test(core): supply config for location activity tool flags
7. d201eed3fa test(app): await composer focus before opening review
8. fccce0789e docs(sync): record completion audit and validation

What the merge brings

• MCP credential-refresh locking, logout-aware remote configuration, legacy auth import, and Copilot native AI protocols and endpoint refresh.
• Session generation usage, cache-TTL warming changes, Console event watches, resilient instructions/skills and MCP prompt refresh.
• Durable/idempotent Code Mode VM tools and suspension; asynchronous server/plugin readiness with one-shot clients waiting client-side; ACP steering.
• Session read/unread menus, side-panel tab close/reopen behavior, dialog/focus improvements, and TUI model-picker/dialog/export changes.
• Upstream site/docs and infrastructure source updates, without restoring upstream deployment/release workflows.
• Fork fix(claude-plugin): follow installed Claude CLI identity #478: subscription requests use the installed Claude CLI identity, with the checked-in fallback when unavailable.

Fork preservation

• shuvcode package/bin, Shuvcode ACP identity, XDG app id, client service fallback/spawn identity, default ports 0x1337 / local 0x1338.
• npm dist-tag updater for shuvcode / shuvcode-node; CLI-only publish ownership guard for shuv1337/shuvcode.
• Bundled ClaudePlugin, Antigravity, quota, GPT-Live, $skill, quick quote, subagent sidebar and Night Owl default.
• Claude Agent SDK stays on disk but hidden: registry exclusion, no-op product export, config-id/integration-document exclusion, and app/TUI/CLI/mini list filters. The model-picker conflict retained isHiddenProvider.
• OAuth refresh single-flight, fix(cli): bound run setup RPCs and report startup progress #434 run setup/admission deadlines, run with autostart: false, fix(core): inherit parent agent denies on child sessions #475 fail-closed parent-agent deny inheritance, redirect guards, and chore(sync): merge upstream dev and audit v2.2.6 gaps #477's router-matched cross-site guard.
• No previously fork-deleted path/tree was restored. Retained upstream console/web/services/enterprise/stats/desktop sources are not fork publish targets. Fork workflow files are unchanged from the original base.

Conflict resolutions were checked with git show --remerge-diff bd6aebb7da (12 files), not GitHub's capped diff endpoint. This PR exceeds 300 files: review a local git diff origin/integration-v2...HEAD after fetching the branch.

The September rewrite map is not an exact November inventory: the standalone Codex identity plugin and xAI popular-order override were already absent at the #477 base. Night Owl now lives in the theme default. These historical differences are documented rather than silently restoring old implementations or claiming they exist.

Branch inventory

The complete inventory and completion audit records a disposition for every local/origin unmerged branch at the original base, excluding upstream refs and the symbolic default-branch alias. It has 188 grouped rows:

Disposition	Rows
Previously landed / equivalent referenced / #478 now merged	99
Intentionally parked and preserved under a named work reference	87
Obsolete sync #456, superseded by #457; ref retained	1
This sync branch	1

No branch was deleted or automatically reconciled. No additional missing fix was identified. Historical merged PRs document their original landing, not permission to restore pre-rewrite code. #478 is included only through the requested normal merge.

Upstream changes to review

These touch request handling, permissions, auth or execution boundaries. Listed for the reviewer; this completion pass does not supply a new security assessment:

• #62827: MCP OAuth refresh under the shared credential lock.
• #62760: stop applying cached remote configuration after logout.
• #62568: legacy auth import into a fresh database.
• #62762: credential change notifications.
• #62034, #62171: Copilot native protocols and API endpoint refresh.
• #62823: ChatGPT workspace usage-limit retry classification.
• #62569, #62796: plugin readiness in request handlers and clients.
• #62507, #62672, #62702: Console instructions/skills endpoints, concurrency and policy retention.
• #62662, #62734, #62774, #62924: Console/MCP watches and follow-up wake limits.
• #62459, #62444, #62686: Code Mode VM execution/suspension and build-channel flag defaults.
• #54394: ACP session steering.
• #62147, #62141: file reads/suggestions and shell exit/timeout handling.
• #61254, #62266: MCP output-schema handling and prompt-refresh failure behavior.
• #62831, #62926, #62941: warming requests and cache-miss/TTL timing.

Version: 2.2.6-shuv.2

CLI manifest and lockfile carry 2.2.6-shuv.2; CHANGELOG.md contains its section, upstream pin, #478 and carried known issues. Release version resolution now honors the checked-in minimum when npm latest trails it. OPENCODE_CHANNEL=latest was checked and resolves 2.2.6-shuv.2.

The requested integration-v2 builds intentionally use the existing preview-version convention, not release versions: Bun prints shuvcode v0.0.0-integration-v2-202611092217; Node prints shuvcode-node v0.0.0-integration-v2-202611092220. No release-channel artifact is claimed here.

Verification

Every runtime check used throwaway HOME/XDG/database state, no inherited credentials, and a private loopback-only network namespace. The namespace retained the normal unprivileged uid, not root, so permission tests remained meaningful. No running user service, config or session was used.

Check	Result
bun run check	Pass; 39/39 typecheck tasks, 0 lint errors (550 existing warnings). Forced uncached run also passed. Repeated after both test fixes.
Exact per-package typecheck:tsc loop from fork CI	Pass after #478. Core's compiler check repeated after its fixture fix.
Fork Turbo unit gate, uncached, concurrency 3	Initial combined-tree run: 34/35 tasks pass; only core failed while constructing the location-activity fixture.
Full core suite after fixture fix	7,416 pass, 16 skip, 0 fail. All 35 package gates therefore have a successful result; a second full Turbo invocation is not claimed.
Fixed location-activity file ×10	200 pass, 0 fail.
Other representative suites	CLI 448 pass / 7 skip; server 138 pass / 1 skip; TUI 1,737 pass / 2 skip; Claude plugin 43 pass; release scripts 22 pass / 12 skip (jj unavailable); all 0 fail.
Effect rules and simplification lint	10 rule tests pass; lint exit 0.
Client generation	packages/client bun run generate: exit 0, no generated changes.
Code Mode packed-package gate	bun run script/publish.ts --dry-run: exit 0; Node and workerd-condition import probes pass. No publishing occurs.
Requested CLI build	OPENCODE_CHANNEL=integration-v2 bun run --cwd packages/cli build: pass, all configured targets.
Node build	Native Linux x64 build:node --single --skip-install, reusing the Bun build's embedded web archive: pass.
Built binary smoke	Bun and Node version/help and service lifecycle pass: election/readiness, MCP socket, auth, embedded UI, plugin discovery, unauthenticated 401, clean stop.
Compiled #434 run-deadline tests	15/15 pass on each binary.
Whitespace and changed test formatting	Pass.
Extra standalone packages/app typecheck:e2e	Known failure: 181 diagnostics on both this branch and an isolated 51cede01da archive; exact diagnostic messages match after ignoring shifted line numbers. Not a new regression; canonical and CI typechecks pass.

Fixes found by verification

• 55ac7ee6d2: upstream added Flag → Config to Tool.node; the fork's location-activity test graph intentionally supplies its own Location. Provide Config.testLayer() so the real Tool/Flag graph can be compiled. Before: import-time Unbound layer node: @opencode/Location; after: all 20 cases pass, including 10 repeats each. No product code change.
• d201eed3fa: wait for initial composer autofocus before opening review in the editor-launch timeout test. Upstream now preserves focus changes during panel animation. Before: 3/10 targeted failures at the panel-focus assertion; baseline 51cede01da passed 10/10. After: 10/10 pass, and the full session-header keeper 28/28 pass. All existing focus, launch, disabled-state and timeout assertions remain; no sleeps, retries or product changes were added.

E2E

Final full suite on d201eed3fa: 755 passed, 0 failed, five workers, no retries (4.3 minutes). Command: PLAYWRIGHT_BUILD=1 PLAYWRIGHT_BASE_URL=http://127.0.0.1:4310 bun run test:e2e, using a fresh private static server and the existing production-fixture build. The two earlier full runs used bun --cwd packages/app test:e2e:built; no app product code changed between the build and the final run.

Earlier full runs (both before the last e2e test correction) were 754/755 and 753/755. The repeated focus failure is addressed above. The second run also intermittently failed mobile touch-tab reorder; that unchanged test passed 10/10 in isolated repeats on both this branch and the 51cede01da baseline. That evidence alone does not establish a root cause.

Deferred / unverified

• chore(sync): merge upstream dev and audit v2.2.6 gaps #477 R2-F1 absolute-form request-target/Origin behavior remains unresolved; R2-F2 explicit bare next/beta versions remains deferred. Those implementations are unchanged.
• Standalone e2e typecheck baseline failures and historical rewrite-map differences are recorded in the audit; no unrelated repair was attempted.
• No live provider auth/subscription billing or real-model end-to-end reply, cross-platform binary execution, full service-worker/component suites, or new security mutation campaign is claimed.
• Post-pin 20c056d842 is deliberately not merged.

Feature flag

No new fork flag: this is an upstream sync, release metadata and test-fixture fixes. Upstream's experimental codemode_vm remains controlled by the existing flag registry (on for local/dev, off for release/other preview channels).

Review fixes

• Fixed the hygiene finding in the audit path and allowed the upstream /Users/me example without editing upstream read.ts.
• Core preload now creates fresh XDG/test-home roots before application imports and clears inherited config overrides; updated the existing isolation assertions. Direct credential tests: 60 passed (10 repeats). File-system traces for those tests and the full suite show zero accesses to real Shuvcode data/config/state/cache roots, including real auth.json.
• Added the Console watch auto-creation, external-event wake behavior, wake limits and information-only fencing note (no new flag); marked shuv.1 unpublished; removed the doubled AGENTS blank line.
• Final local validation: bun run check 39/39 tasks passed, hygiene PII/artifact check clean, AGENTS/preload Prettier and git diff --check passed. Full isolated core suite: 7,416 passed, 16 skipped, 0 failed in a private loopback namespace with uid 1000 and all capabilities dropped (host port 8080 is occupied). Earlier attempts exposed the old isolation assertion, host-port conflict and namespace capability effects; the final run resolves those conditions without changing product code.
• Commits: b155801676, 5024ba68c5, 64249b7563, d8b762dc00, 55dd16b680, 715fd38f27. gh pr checks 479 --repo shuv1337/shuvcode --watch completed successfully: all five checks green (hygiene, typecheck, plugin-browser and both Socket checks). No merge or release.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​resvg/​resvg-wasm@​2.6.2
	npm/​wrangler@​4.156.2
	npm/​@​hona/​strobe@​0.14.0 ⏵ 0.26.0	+1		+19	+1

View full report