Resolve merge conflicts with upstream main

Author: avianion

.agents/claude-code-cli.ts

@@ -10,7 +10,7 @@ const baseDefinition = createCliAgent({
   startCommand: 'claude --dangerously-skip-permissions',
   permissionNote:
     'Always use `--dangerously-skip-permissions` when testing to avoid permission prompts that would block automated tests.',
-  model: 'anthropic/claude-opus-4.6',
+  model: 'anthropic/claude-opus-4.7',
 })
 
 // Constants must be inside handleSteps since it gets serialized via .toString()

.agents/codebuff-local-cli.ts

@@ -10,7 +10,7 @@ const baseDefinition = createCliAgent({
   startCommand: 'bun --cwd=cli run dev',
   permissionNote:
     'No permission flags needed for Codebuff local dev server.',
-  model: 'anthropic/claude-opus-4.6',
+  model: 'anthropic/claude-opus-4.7',
   skipPrepPhase: true,
   cliSpecificDocs: `## Codebuff CLI Specific Guidance
 

.agents/codex-cli.ts

@@ -81,7 +81,7 @@ const baseDefinition = createCliAgent({
   startCommand: 'codex -a never -s danger-full-access',
   permissionNote:
     'Always use `-a never -s danger-full-access` when testing to avoid approval prompts that would block automated tests.',
-  model: 'anthropic/claude-opus-4.6',
+  model: 'anthropic/claude-opus-4.7',
   extraInputParams: {
     reviewType: {
       type: 'string',

.agents/gemini-cli.ts

@@ -10,7 +10,7 @@ const baseDefinition = createCliAgent({
   startCommand: 'gemini --yolo',
   permissionNote:
     'Always use `--yolo` (or `--approval-mode yolo`) when testing to auto-approve all tool actions and avoid prompts that would block automated tests.',
-  model: 'anthropic/claude-opus-4.6',
+  model: 'anthropic/claude-opus-4.7',
   cliSpecificDocs: `## Gemini CLI Commands
 
 Gemini CLI uses slash commands for navigation:

.agents/types/agent-definition.ts

@@ -380,7 +380,9 @@ export type ModelName =
 
   // Anthropic
   | 'anthropic/claude-sonnet-4.6'
+  | 'anthropic/claude-opus-4.7'
   | 'anthropic/claude-opus-4.6'
+  | 'anthropic/claude-opus-4.5'
   | 'anthropic/claude-haiku-4.5'
   | 'anthropic/claude-sonnet-4.5'
   | 'anthropic/claude-opus-4.1'
@@ -427,8 +429,7 @@ export type ModelName =
   // Other open source models
   | 'moonshotai/kimi-k2'
   | 'moonshotai/kimi-k2:nitro'
-  | 'moonshotai/kimi-k2.5'
-  | 'moonshotai/kimi-k2.5:nitro'
+  | 'moonshotai/kimi-k2.6'
   | 'z-ai/glm-5'
   | 'z-ai/glm-4.6'
   | 'z-ai/glm-4.6:nitro'
@@ -437,6 +438,7 @@ export type ModelName =
   | 'z-ai/glm-4.7-flash'
   | 'z-ai/glm-4.7-flash:nitro'
   | 'minimax/minimax-m2.5'
+  | 'minimax/minimax-m2.7'
   | (string & {})
 
 import type { ToolName, GetToolParams } from './tools'

.agents/types/tools.ts

@@ -16,6 +16,7 @@ export type ToolName =
   | 'read_docs'
   | 'read_files'
   | 'read_subtree'
+  | 'render_ui'
   | 'run_file_change_hooks'
   | 'run_terminal_command'
   | 'set_messages'
@@ -47,6 +48,7 @@ export interface ToolParamsMap {
   read_docs: ReadDocsParams
   read_files: ReadFilesParams
   read_subtree: ReadSubtreeParams
+  render_ui: RenderUiParams
   run_file_change_hooks: RunFileChangeHooksParams
   run_terminal_command: RunTerminalCommandParams
   set_messages: SetMessagesParams
@@ -179,10 +181,10 @@ export interface ProposeStrReplaceParams {
   /** Array of replacements to make. */
   replacements: {
     /** The string to replace. This must be an *exact match* of the string you want to replace, including whitespace and punctuation. */
-    old: string
-    /** The string to replace the corresponding old string with. Can be empty to delete. */
-    new: string
-    /** Whether to allow multiple replacements of old string. */
+    oldString: string
+    /** The string to replace the corresponding oldString with. Can be empty to delete. */
+    newString: string
+    /** Whether to allow multiple replacements of oldString. */
     allowMultiple?: boolean
   }[]
 }
@@ -229,6 +231,23 @@ export interface ReadSubtreeParams {
   maxTokens?: number
 }
 
+/**
+ * Render a small interactive UI widget in the Codebuff CLI. Currently supports a button that opens a link.
+ */
+export interface RenderUiParams {
+  /** The UI widget to render. */
+  widget: {
+    /** Widget type. Currently, the only supported widget is button. */
+    type: 'button'
+    /** Short button label shown to the user. */
+    text: string
+    /** The http:// or https:// URL to open when the user clicks the button. */
+    link: string
+    /** Theme-aware color treatment. Use primary for the main action and secondary for lower-emphasis actions. */
+    variant?: 'primary' | 'secondary'
+  }
+}
+
 /**
  * Parameters for run_file_change_hooks tool
  */
@@ -286,10 +305,10 @@ export interface StrReplaceParams {
   /** Array of replacements to make. */
   replacements: {
     /** The string to replace. This must be an *exact match* of the string you want to replace, including whitespace and punctuation. */
-    old: string
-    /** The string to replace the corresponding old string with. Can be empty to delete. */
-    new: string
-    /** Whether to allow multiple replacements of old string. */
+    oldString: string
+    /** The string to replace the corresponding oldString with. Can be empty to delete. */
+    newString: string
+    /** Whether to allow multiple replacements of oldString. */
     allowMultiple?: boolean
   }[]
 }

.claude/settings.json

@@ -0,0 +1,5 @@
+{
+  "permissions": {
+    "defaultMode": "auto"
+  }
+}

.github/workflows/bot-sweep.yml

@@ -0,0 +1,38 @@
+name: Freebuff Bot Sweep
+
+# Hourly dry-run sweep over active freebuff sessions. Calls the
+# /api/admin/bot-sweep endpoint, which emails james@codebuff.com with a
+# ranked list of suspects. No bans are issued — review and run
+# scripts/ban-freebuff-bots.ts manually.
+
+on:
+  schedule:
+    - cron: '0 * * * *'
+  workflow_dispatch:
+
+jobs:
+  sweep:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Trigger bot-sweep
+        env:
+          BOT_SWEEP_SECRET: ${{ secrets.BOT_SWEEP_SECRET }}
+          BOT_SWEEP_URL: ${{ vars.BOT_SWEEP_URL || 'https://www.codebuff.com/api/admin/bot-sweep' }}
+        run: |
+          set -euo pipefail
+          if [ -z "$BOT_SWEEP_SECRET" ]; then
+            echo "BOT_SWEEP_SECRET is not set — skipping."
+            exit 0
+          fi
+          status=$(curl -sS -o /tmp/resp.json -w '%{http_code}' \
+            -X POST "$BOT_SWEEP_URL" \
+            -H "Authorization: Bearer $BOT_SWEEP_SECRET" \
+            -H "Content-Type: application/json" \
+            --max-time 120)
+          echo "HTTP $status"
+          cat /tmp/resp.json
+          echo
+          if [ "$status" != "200" ]; then
+            exit 1
+          fi

.github/workflows/cli-release-build.yml

@@ -176,19 +176,31 @@ jobs:
         run: |
           cd cli/bin
           if [[ "${{ runner.os }}" == "Windows" ]]; then
-            ./${{ inputs.binary-name }}.exe --version
+            BIN="./${{ inputs.binary-name }}.exe"
           else
-            ./${{ inputs.binary-name }} --version
+            BIN="./${{ inputs.binary-name }}"
           fi
 
+          # Fast path: --version exits synchronously through commander, so it
+          # only catches early sync failures. Run it for parity with old CI.
+          "$BIN" --version
+
+          # Slow path: keep the binary alive long enough for *async* startup
+          # failures (e.g. the Parser.init rejection that crashed the
+          # post-OpenTUI-upgrade Windows build) to surface in stdout/stderr.
+          bun ../scripts/smoke-binary.ts "$BIN"
+
       - name: Create tarball
         shell: bash
         run: |
           BINARY_FILE="${{ inputs.binary-name }}"
           if [[ "${{ runner.os }}" == "Windows" ]]; then
             BINARY_FILE="${{ inputs.binary-name }}.exe"
           fi
-          tar -czf ${{ inputs.binary-name }}-${{ matrix.target }}.tar.gz -C cli/bin "$BINARY_FILE"
+          # Bundle the binary alongside tree-sitter.wasm — the CLI loads
+          # the wasm as a sibling file at runtime since bun --compile
+          # asset embedding wasn't reliable on Windows.
+          tar -czf ${{ inputs.binary-name }}-${{ matrix.target }}.tar.gz -C cli/bin "$BINARY_FILE" tree-sitter.wasm
 
       - name: Upload binary artifact
         uses: actions/upload-artifact@v7
@@ -317,13 +329,23 @@ jobs:
         shell: bash
         run: |
           cd cli/bin
-          ./${{ inputs.binary-name }}.exe --version
+          BIN="./${{ inputs.binary-name }}.exe"
+
+          # Sync check — exits via commander before async tasks fire.
+          "$BIN" --version
+
+          # Long-running check — gives async startup failures time to surface.
+          # This is the step that would have caught the post-OpenTUI-upgrade
+          # tree-sitter wasm crash on Windows.
+          bun ../scripts/smoke-binary.ts "$BIN"
 
       - name: Create tarball
         shell: bash
         run: |
           BINARY_FILE="${{ inputs.binary-name }}.exe"
-          tar -czf ${{ inputs.binary-name }}-win32-x64.tar.gz -C cli/bin "$BINARY_FILE"
+          # Bundle tree-sitter.wasm next to the binary; see the
+          # equivalent matrix-job tar step for context.
+          tar -czf ${{ inputs.binary-name }}-win32-x64.tar.gz -C cli/bin "$BINARY_FILE" tree-sitter.wasm
 
       - name: Upload binary artifact
         uses: actions/upload-artifact@v7

.github/workflows/cli-release-prod.yml

@@ -12,6 +12,11 @@ on:
           - patch
           - minor
           - major
+      checkout_ref:
+        description: 'Git ref to build from (commit SHA, branch, or tag). Defaults to latest main.'
+        required: false
+        default: ''
+        type: string
 
 concurrency:
   group: cli-prod-release
@@ -80,7 +85,7 @@ jobs:
       binary-name: codebuff
       new-version: ${{ needs.prepare-and-commit-prod.outputs.new_version }}
       artifact-name: updated-package
-      checkout-ref: ${{ github.sha }}
+      checkout-ref: ${{ inputs.checkout_ref || github.sha }}
       env-overrides: '{"NEXT_PUBLIC_CB_ENVIRONMENT": "prod"}'
     secrets: inherit