Merge origin/main into feat/conversation-outline-timeline

Author: elkaix

.agents/skills/agent-core-dev/orient.md

@@ -68,10 +68,10 @@ There is no domain-layer numbering — a domain may import any other domain, gui
 
 ## Comment convention
 
-`packages/agent-core-v2/AGENTS.md` bans comments: no file headers, no section banners, no statement-level narration — the code is the source of truth. The only exception is JSDoc attached to exported symbols, which flows into the generated `.d.ts` and the consumers' IDE hover. Tooling directives (`eslint-disable`, `@ts-expect-error`, …) are banned too: fix the underlying lint/type problem instead, and put negative type-safety cases in compiler-asserted fixtures. DI scope is carried by registration: `LifecycleScope.App`, `LifecycleScope.Session`, or `LifecycleScope.Agent`. A `workspace*` filename marks workspace-domain ownership, not a DI scope (see service-authoring.md).
+`packages/agent-core-v2/AGENTS.md` bans comments entirely: no file headers, no section banners, no statement-level narration, no JSDoc (not even on exported symbols) — the code is the source of truth. The only exception is a load-bearing lint-suppression directive (`oxlint-disable` / `eslint-disable`) for a deliberate pattern; other tooling directives (`@ts-expect-error`, …) are banned: fix the underlying lint/type problem instead, and put negative type-safety cases in compiler-asserted fixtures. DI scope is carried by registration: `LifecycleScope.App`, `LifecycleScope.Session`, or `LifecycleScope.Agent`. A `workspace*` filename marks workspace-domain ownership, not a DI scope (see service-authoring.md).
 
 ## Red lines (this stage)
 
 - Import via the `#/...` alias (mapped to `src/`); never reach into another domain's internals by relative path.
 - Short-lived may inject long-lived; never the reverse.
-- No comments — not file headers, not beside statements; exported-symbol JSDoc is the only exception.
+- No comments — not file headers, not beside statements, not JSDoc; a load-bearing lint-suppression directive is the only exception.

.agents/skills/agent-core-dev/service-authoring.md

@@ -164,7 +164,7 @@ What belongs here:
 - **Helper classes / functions** used only by this impl (e.g. a built-in writer, an `extractError` helper) — co-located in the same file.
 - **Top-level `registerScopedService(...)`** — one per Service the file owns; importing the impl file runs the registration.
 
-Base class: extend `Service` (from `#/_base/di/service`) when the unit needs capability calls on `this` — `provide` / `effect` / `on` / `get` / `ref` (e.g. contributing a record to a `collection` token). `Service` extends `Disposable`, so `_register` keeps working; constructor-time `provide` / `on` / `effect` calls are buffered and flushed by the kernel after construction, while `get` / `ref` throw inside the constructor (dependencies stay constructor parameters). Otherwise extend `Disposable` — both are full DI units; a service whose own members collide with the `Service` vocabulary (`name` / `state` / `config` / `get`) must stay on `Disposable` (leave a NOTE comment saying so).
+Base class: extend `Service` (from `#/_base/di/service`) when the unit needs capability calls on `this` — `provide` / `effect` / `on` / `get` / `ref` (e.g. contributing a record to a `collection` token). `Service` extends `Disposable`, so `_register` keeps working; constructor-time `provide` / `on` / `effect` calls are buffered and flushed by the kernel after construction, while `get` / `ref` throw inside the constructor (dependencies stay constructor parameters). Otherwise extend `Disposable` — both are full DI units; a service whose own members collide with the `Service` vocabulary (`name` / `state` / `config` / `get`) must stay on `Disposable`.
 
 ## Constructor conventions
 
@@ -296,9 +296,8 @@ Importing the package therefore fires every `register*` side effect, exactly as
 
 ## Comments
 
-- **No comments** (orient.md): no file headers, no statement-level narration; the only exception is JSDoc attached to exported symbols.
+- **No comments** (orient.md): no file headers, no statement-level narration, no JSDoc; the only exception is a load-bearing lint-suppression directive.
 - **Methods and fields carry no comments by default.** Well-named identifiers and types say *what*; the code is the source of truth for *how*.
-- Write an inline comment only when the *why* is non-obvious (a hidden constraint, a subtle invariant, a workaround). One short line.
 - For unimplemented stubs, throw `NotImplementedError('feature')` rather than `throw new Error('TODO: …')` (errors.md).
 
 ## Complete minimal example

.agents/skills/agent-core-dev/test.md

@@ -21,7 +21,7 @@ Resolving by interface is what makes `registerScopedService(ISut, Sut, …)` par
 
 Pure functions, value objects, and services with **no** `@IService` dependencies may be constructed directly.
 
-The only other exception is a test that genuinely needs **two independent instances** of the same service with different dependencies (e.g. constructing two `TurnService`s with different `ILoopRunner`s). A singleton-per-container resolution cannot produce both, so `ix.createInstance(Impl)` is acceptable there — annotate it with a comment explaining why.
+The only other exception is a test that genuinely needs **two independent instances** of the same service with different dependencies (e.g. constructing two `TurnService`s with different `ILoopRunner`s). A singleton-per-container resolution cannot produce both, so `ix.createInstance(Impl)` is acceptable there — state the reason in the test name and local identifiers.
 
 ## Two harnesses
 

.agents/skills/agent-core-dev/verify.md

@@ -21,7 +21,7 @@ Walk the stages you touched and confirm:
 - **Design** — scope follows state identity; no `Map<sessionId, …>` at `App`; dependency arrows do not make a foundational layer know an upstream one; no cycle was routed around.
 - **Implement** — no `new` on `@IService`-carrying classes; `@IX` on constructor params only (service params after static params); interface + impl carry `_serviceBrand`; decorator names unique; coded errors only; flags for unreleased behavior.
 - **Test** — SUT resolved by interface; stubs under `test/`; scope tests re-register after `_clearScopedRegistryForTests()`; teardown through one `DisposableStore`.
-- **Files** — no comments (exported-symbol JSDoc excepted); registration runs from the impl file's top level; the new domain is exported from `src/index.ts`.
+- **Files** — no comments (no JSDoc either); registration runs from the impl file's top level; the new domain is exported from `src/index.ts`.
 
 Then re-read the [global red lines](SKILL.md#global-red-lines) once — they catch most cross-stage mistakes in a single scan.
 

.agents/skills/release/SKILL.md

@@ -18,8 +18,11 @@ mechanics and failure modes.
 - **Private lanes use the push boundary.** `publishedPackages` only lists packages published to npm.
   Desktop and VS Code are private workspaces, so `detect-lane-bumps.mjs` compares their versions at
   `github.event.before` and `github.sha`.
-- **Desktop is tag-driven.** The required `cut-desktop-tag` job creates `desktop-v<version>`, which
-  starts `desktop-release.yml`.
+- **Desktop Stable and Beta are tag-driven.** The required `cut-desktop-tag` job creates
+  `desktop-v<version>`, which starts `desktop-release.yml`; prerelease versions publish to the
+  explicit Beta feed.
+- **Desktop Nightly is default-branch driven.** `nightly.yml` calls `desktop-release.yml` after each
+  scheduled main build and publishes a signed Nightly prerelease only when the main commit changed.
 - **VS Code is isolated.** `vscode-release.yml` supports `workflow_call` and version-checked manual
   dispatch. Existing registry versions are skipped by the publisher scripts, so recovery is safe.
 
@@ -35,6 +38,7 @@ workspace, set its `private` and changesets policy explicitly and update `flake.
 |---|---|---|
 | `Release` | every main push after CI + Nix | Detect lane versions, build, run changesets |
 | `Cut desktop release tag` | desktop version changed | Required and idempotent; App token makes the tag trigger the desktop workflow |
+| `Desktop Nightly` | scheduled main build | Reusable workflow; signed assets and the explicit Nightly update feed |
 | `Publish VS Code extension` | extension version changed | Reusable workflow; six VSIX targets, both registries, provenance |
 | `Native release artifact` | CLI was published | Six signed/tested zips, checksums, provenance |
 | `Publish native release assets` | native builds passed | All-or-nothing immutable upload with `manifest.json` |
@@ -56,6 +60,8 @@ otherwise errors.
   genuinely half-published release — read the log; do not blind-rerun.
 - **Version PR looks wrong.** Never patch the `changeset-release/main` branch by hand. Fix or add
   changesets on `main`; the next workflow run regenerates the PR.
+- **Beta or Nightly checks Stable.** GitHub does not infer update channels. Confirm the release is a
+  prerelease and contains `beta*.yml` or `nightly*.yml`; do not rename Stable manifests.
 - **Native builder fails after npm publish succeeded.** npm state is final. Re-run failed jobs from
   the same run before any assets upload. A complete asset set is an idempotent no-op. A partial set
   must not be filled from a rebuild; keep it or publish a new patch version.
@@ -83,6 +89,7 @@ otherwise errors.
 
 ```bash
 gh run list --workflow=release.yml --branch=main -L 3        # workflow health
+gh run list --workflow=nightly.yml --branch=main -L 3        # Nightly desktop health
 gh pr list --search 'ci: release packages in:title' --state open
 pnpm release:status                                           # all live lanes
 npm view @pymodel/pythinker-code dist-tags --json

.changeset/abort-signal-listener-ceiling.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Silence the MaxListenersExceededWarning that could appear during long agent turns with many parallel tool calls.

.changeset/broadcast-user-prompts.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Fix messages sent from one web client not appearing on other clients connected to the same session.

.changeset/drop-allow-remote-terminals.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": major
+---
+
+Remove the `--allow-remote-terminals` flag from `pythinker web`; PTY terminal routes now stay available on loopback binds only.

.changeset/effort-persist-default-ceiling.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Persist a picked thinking effort as the default only up to the model's own default effort; a more expensive pick stays session-only.

.changeset/infinite-retry-mode.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Add `PYTHINKER_CODE_INFINITE_RETRY=1` to retry every failed model request indefinitely with backoff instead of failing the turn, for long unattended runs.