chore: adopt upstream workflow tooling

Ported from the pythinker-cli reference repo:
- typos spell-check workflow with _typos.toml (tests/fixtures excluded,
  real names allow-listed); fixes one real comment typo it surfaced
- monthly update-flake-lock workflow (flake.nix is hand-maintained)
- CodeRabbit commit_status for the local merge-gate hook
- worktree-status skill for auditing delegation worktrees

Author: elkaix

.agents/skills/worktree-status/SKILL.md

@@ -0,0 +1,127 @@
+---
+name: worktree-status
+description: Audit all git worktrees in the current project. Use when the user asks about worktree status, which branches are merged, which have uncommitted changes, or which worktrees can be safely cleaned up.
+---
+
+# worktree-status
+
+Report the status of every git worktree for the current project, covering
+dirty state and merge status.
+
+## When to use
+
+- User asks "which worktrees can I clean up?"
+- User asks "what's the status of my worktrees / branches?"
+- Before batch-cleaning worktrees, to avoid losing uncommitted work
+
+## Procedure
+
+### 1. Pull latest main (MANDATORY)
+
+You MUST pull latest main before any status checks. Without this, merge
+detection (both ancestry and content diff) will produce stale results and
+you may mistakenly conclude a branch is not merged.
+
+```bash
+cd "$(git rev-parse --show-toplevel)" && git pull origin main
+```
+
+### 2. Collect worktree info
+
+```bash
+PROJECT_DIR="$(git rev-parse --show-toplevel)"
+
+for wt in $(git worktree list --porcelain | grep "^worktree " | sed 's/^worktree //' | grep -v "$PROJECT_DIR$"); do
+  branch=$(git -C "$wt" branch --show-current 2>/dev/null)
+  [ -z "$branch" ] && branch="(detached)"
+  name=$(basename "$wt")
+
+  # dirty?
+  if [ -z "$(git -C "$wt" status --short 2>/dev/null)" ]; then
+    dirty="clean"
+  else
+    dirty="DIRTY"
+  fi
+
+  # merged into origin/main?
+  # NOTE: `git merge-base --is-ancestor` does NOT detect squash-merged
+  # branches. Always follow up with a content diff (step 3) for branches
+  # that appear "not merged".
+  if [ "$branch" != "(detached)" ]; then
+    if git merge-base --is-ancestor "$branch" origin/main 2>/dev/null; then
+      merged="merged"
+    else
+      merged="not merged (verify with content diff)"
+    fi
+  else
+    merged="n/a"
+  fi
+
+  echo ""
+  echo "[$name]  branch=$branch  $dirty  $merged"
+  if [ "$dirty" = "DIRTY" ]; then
+    git -C "$wt" status --short 2>/dev/null | sed 's/^/  /'
+  fi
+done
+```
+
+### 3. Detect squash-merged branches (content diff)
+
+For any branch that shows "not merged", check whether the branch's
+changes are already in main. The correct method is:
+
+1. Find the files the branch actually changed (relative to merge-base).
+2. For each changed file, compare the branch version with main.
+   If all files are identical, the branch was squash-merged.
+
+**⚠️ Do NOT use `git diff origin/main <branch>`** — that compares the
+two tips directly, so commits added to main *after* the branch diverged
+will show up as false differences.
+
+```bash
+BRANCH="<branch>"
+BASE=$(git merge-base origin/main "$BRANCH")
+
+# List files the branch touched
+FILES=$(git diff --name-only "$BASE" "$BRANCH")
+
+# Compare each file between branch and current main
+for f in $FILES; do
+  d=$(git diff "$BRANCH" origin/main -- "$f" | wc -l)
+  if [ "$d" != "0" ]; then
+    echo "❌ $f — differs"
+  else
+    echo "✅ $f — identical in main"
+  fi
+done
+# All ✅ = squash-merged
+```
+
+### 4. Present results
+
+**Always present results as a Markdown table.** Every worktree must appear
+as a row. Never use abbreviated or prose-only summaries.
+
+| Worktree | Branch | Dirty | Merged | Can clean? |
+|---|---|---|---|---|
+| `example-wt` | `feat-foo` | ✅ clean | ✅ squash-merged | ✅ |
+| `another-wt` | `fix-bar` | ⚠️ 3 files | ❌ not merged | ❌ dirty + not merged |
+| `detached-wt` | (detached) | ⚠️ 14 files | n/a | ❌ has uncommitted changes |
+
+Column definitions:
+
+- **Dirty**: `✅ clean` or `⚠️ N files`
+- **Merged**: `✅ merged` / `✅ squash-merged` (confirmed via content diff) / `❌ not merged` / `n/a`
+- **Can clean?**: `✅` only when merged (or squash-merged) AND clean
+
+Add extra columns (e.g. notes) only when relevant.
+
+### 5. Cleanup (only when asked)
+
+Only clean worktrees the user explicitly approves. For each:
+
+```bash
+NAME="<worktree-name>"
+git worktree remove "/path/to/$NAME"
+git branch -D "<branch>"  # only if the branch is no longer needed
+```

.coderabbit.yaml

@@ -19,6 +19,10 @@ reviews:
   suggested_reviewers: false
   poem: false
   review_status: true
+  # Commit status "CodeRabbit" on the PR head: pending while reviewing, success
+  # when done. Consumed by .claude/hooks/coderabbit-merge-gate.sh to block
+  # `gh pr merge` until the review of the latest push has finished.
+  commit_status: true
   collapse_walkthrough: true
   abort_on_close: true
 

.github/workflows/typos.yml

@@ -0,0 +1,22 @@
+name: Typo checker
+
+# Config: _typos.toml (excludes tests/fixtures with deliberate misspellings,
+# allow-lists real names like `sherif` and variant spellings).
+
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  run:
+    name: Spell Check with Typos
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Check spelling of the entire repository
+        uses: crate-ci/typos@80c8a4945eec0f6d464eaf9e65ed98ef085283d1 # pinned from v1.38.1

.github/workflows/update-flake-lock.yml

@@ -0,0 +1,39 @@
+name: Update flake.lock
+
+on:
+  schedule:
+    # 06:00 UTC on the 1st of each month.
+    - cron: "0 6 1 * *"
+  workflow_dispatch:
+
+concurrency:
+  group: update-flake-lock
+  cancel-in-progress: false
+
+jobs:
+  update-lock:
+    name: Update Nix flake.lock
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@1d87d45818068401a10cf16bdc5f00b24994a83f # pinned from main
+
+      - name: Update flake.lock and open PR
+        uses: DeterminateSystems/update-flake-lock@5ba4a20ae344a5edd7b97ed3002219974f4d20d7 # pinned from main
+        with:
+          pr-title: "chore(nix): monthly flake.lock update"
+          pr-labels: dependencies
+          # NOTE: this PR is opened with the default GITHUB_TOKEN, which does
+          # not trigger required status checks under branch protection. A
+          # maintainer must push an empty commit or close+reopen the PR to fire
+          # CI before merge. Use a fine-grained PAT/App token in a follow-up if
+          # fully hands-off dependency PRs become necessary.
+          branch: update-flake-lock

_typos.toml

@@ -0,0 +1,27 @@
+# Config for crate-ci/typos (CI: .github/workflows/typos.yml).
+# Tests and fixtures are excluded wholesale: they contain deliberate
+# misspellings (fuzzy-match inputs like `comand`, `buton`) and base64/id
+# blobs that false-positive on short tokens.
+
+[files]
+extend-exclude = [
+  "blackbox/",
+  "**/test/**",
+  "**/tests/**",
+  "**/*.test.ts",
+  "**/__snapshots__/**",
+  "**/CHANGELOG.md",
+  "pnpm-lock.yaml",
+]
+
+[default.extend-words]
+# Real names / accepted spellings, not typos.
+sherif = "sherif"             # https://github.com/QuiiBz/sherif — monorepo linter
+unparseable = "unparseable"   # valid variant spelling used across the codebase
+uncatalogued = "uncatalogued" # valid British spelling
+mis = "mis"                   # hyphenated prefix in comments: mis-parses, mis-set
+flase = "flase"               # deliberate typo example in a config-error comment
+nd = "nd"                     # ndJsonStream, `Nd` cron interval token
+dows = "dows"                 # formatDows — days-of-week (cron)
+fo = "fo"                     # `/FO` flag of Windows schtasks
+pn = "pn"                     # "PNGs" tokenized as PN by the checker

apps/pythinker-web/src/api/daemon/agentEventProjector.ts

@@ -445,7 +445,7 @@ export interface AgentProjector {
   /** Project a single raw agent-core event into zero or more AppEvents. Never throws. */
   project(rawType: string, payload: unknown, sessionId: string, meta?: ProjectMeta): AppEvent[];
   /**
-   * Bind an externally-known promptId to the next turn.startd for this session.
+   * Bind an externally-known promptId to the next turn.started for this session.
    * Call this right after submitPrompt() returns, before the first turn.started arrives.
    */
   bindNextPromptId(sessionId: string, promptId: string): void;