Neon tide 2

.github/dependabot.yml

@@ -1,14 +1,44 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
+# Automated dependency maintenance for every shipped ecosystem and workflow surface.
 version: 2
 updates:
-  # Enable version updates for npm
-  - package-ecosystem: "npm"
-    # Look for `package.json` and `lock` files in the `root` directory
-    directory: "/"
-    # Check the npm registry for updates every day (weekdays)
+  - package-ecosystem: 'npm'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+      time: '06:00'
+      timezone: 'America/New_York'
+    open-pull-requests-limit: 10
+    labels:
+      - 'dependencies'
+      - 'npm'
+    commit-message:
+      prefix: 'deps'
+
+  - package-ecosystem: 'cargo'
+    directory: '/crates/pairofcleats-tui'
+    schedule:
+      interval: 'weekly'
+      day: 'monday'
+      time: '06:00'
+      timezone: 'America/New_York'
+    open-pull-requests-limit: 10
+    labels:
+      - 'dependencies'
+      - 'cargo'
+    commit-message:
+      prefix: 'deps'
+
+  - package-ecosystem: 'github-actions'
+    directory: '/'
     schedule:
-      interval: "daily"
+      interval: 'weekly'
+      day: 'monday'
+      time: '06:00'
+      timezone: 'America/New_York'
+    open-pull-requests-limit: 5
+    labels:
+      - 'dependencies'
+      - 'github-actions'
+    commit-message:
+      prefix: 'ci'

.github/workflows/ci-long.yml

@@ -4,6 +4,9 @@ permissions:
   contents: read
 
 on:
+  push:
+    tags:
+      - 'v*'
   workflow_dispatch:
 
 concurrency:
@@ -53,9 +56,9 @@ jobs:
             npm run bootstrap:ci
           else
             echo "node_modules cache hit; verifying native modules."
-            if ! npm run verify:native; then
+            if ! node tools/setup/rebuild-native.js --verify; then
               echo "native verification failed; running targeted repair:native."
-              npm run repair:native
+              node tools/setup/rebuild-native.js --repair
             fi
           fi
           node -v
@@ -82,4 +85,5 @@ jobs:
             .testLogs/**
             .diagnostics/**
           if-no-files-found: ignore
+          include-hidden-files: true
           compression-level: 0

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ permissions:
 on:
   push:
     branches: [main]
+    tags:
+      - 'v*'
+  workflow_dispatch:
   pull_request:
 
 concurrency:
@@ -52,6 +55,12 @@ jobs:
       - name: Env usage guardrail
         run: npm run env:check
 
+      - name: Generated surfaces freshness
+        run: node tools/docs/generated-surfaces.js --check-freshness
+
+      - name: Command surface audit
+        run: node tools/ci/check-command-surface.js
+
       - name: Gate lane
         run: |
           node tests/run.js --lane gate --allow-timeouts --junit .testLogs/junit-gate.xml --log-dir .testLogs
@@ -65,8 +74,50 @@ jobs:
             .testLogs/**
             .diagnostics/**
           if-no-files-found: ignore
+          include-hidden-files: true
           compression-level: 0
 
+  rust-tui:
+    name: rust-tui
+    runs-on: ubuntu-latest
+    needs: gate
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: 1.86.0
+          components: rustfmt, clippy
+
+      - name: Restore Cargo cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            crates/pairofcleats-tui/target
+          key: cargo-${{ runner.os }}-${{ hashFiles('crates/pairofcleats-tui/Cargo.lock') }}
+          restore-keys: |
+            cargo-${{ runner.os }}-
+
+      - name: Cargo fmt
+        working-directory: crates/pairofcleats-tui
+        run: cargo fmt --check
+
+      - name: Cargo check
+        working-directory: crates/pairofcleats-tui
+        run: cargo check --locked
+
+      - name: Cargo test
+        working-directory: crates/pairofcleats-tui
+        run: cargo test --locked
+
+      - name: Cargo clippy
+        working-directory: crates/pairofcleats-tui
+        run: cargo clippy --locked -- -D warnings
+
   ubuntu:
     name: ubuntu
     runs-on: ubuntu-latest
@@ -110,14 +161,25 @@ jobs:
             npm run bootstrap:ci
           else
             echo "node_modules cache hit; verifying native modules."
-            if ! npm run verify:native; then
+            if ! node tools/setup/rebuild-native.js --verify; then
               echo "native verification failed; running targeted repair:native."
-              npm run repair:native
+              node tools/setup/rebuild-native.js --repair
             fi
           fi
           node -v
           npm -v
 
+      - name: Install optional LSP tools (best effort)
+        shell: bash
+        run: |
+          set +e
+          node tools/tooling/install.js --scope cache --tools pyright,yaml-language-server,gopls,csharp-ls,solargraph,phpactor --json
+          status=$?
+          if [ $status -ne 0 ]; then
+            echo "optional tooling install had non-fatal failures (continuing)."
+          fi
+          exit 0
+
       - name: CI Suite
         run: |
           node tools/ci/run-suite.js --mode ci --skip-prechecks
@@ -130,6 +192,21 @@ jobs:
           $env:PAIROFCLEATS_CACHE_ROOT = $cacheRoot
           node tools/index/cache-gc.js --apply --grace-days 3 --max-deletes 200 --repo .
 
+      - name: Upload quality artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ci-quality-artifacts-ubuntu
+          path: |
+            .diagnostics/test-summary.json
+            .diagnostics/test-timings.json
+            .diagnostics/test-profile.json
+            .diagnostics/coverage/**
+            .testLogs/junit.xml
+          if-no-files-found: ignore
+          include-hidden-files: true
+          compression-level: 0
+
       - name: Upload test artifacts
         if: failure()
         uses: actions/upload-artifact@v4
@@ -139,6 +216,7 @@ jobs:
             .testLogs/**
             .diagnostics/**
           if-no-files-found: ignore
+          include-hidden-files: true
           compression-level: 0
 
   windows:
@@ -182,20 +260,44 @@ jobs:
             npm run bootstrap:ci
           } else {
             Write-Host 'node_modules cache hit; verifying native modules.'
-            npm run verify:native
+            node tools/setup/rebuild-native.js --verify
             if ($LASTEXITCODE -ne 0) {
               Write-Host 'native verification failed; running targeted repair:native.'
-              npm run repair:native
+              node tools/setup/rebuild-native.js --repair
               if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
             }
           }
           node -v
           npm -v
 
+      - name: Install optional LSP tools (best effort)
+        shell: pwsh
+        run: |
+          node tools/tooling/install.js --scope cache --tools pyright,yaml-language-server,gopls,csharp-ls,solargraph,phpactor --json
+          if ($LASTEXITCODE -ne 0) {
+            Write-Host 'optional tooling install had non-fatal failures (continuing).'
+          }
+          exit 0
+
       - name: CI Suite
         run: |
           node tools/ci/run-suite.js --mode ci --skip-prechecks
 
+      - name: Upload quality artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ci-quality-artifacts-windows
+          path: |
+            .diagnostics/test-summary.json
+            .diagnostics/test-timings.json
+            .diagnostics/test-profile.json
+            .diagnostics/coverage/**
+            .testLogs/junit.xml
+          if-no-files-found: ignore
+          include-hidden-files: true
+          compression-level: 0
+
       - name: Upload test artifacts
         if: failure()
         uses: actions/upload-artifact@v4
@@ -205,6 +307,7 @@ jobs:
             .testLogs/**
             .diagnostics/**
           if-no-files-found: ignore
+          include-hidden-files: true
           compression-level: 0
 
   macos:
@@ -248,18 +351,44 @@ jobs:
             npm run bootstrap:ci
           else
             echo "node_modules cache hit; verifying native modules."
-            if ! npm run verify:native; then
+            if ! node tools/setup/rebuild-native.js --verify; then
               echo "native verification failed; running targeted repair:native."
-              npm run repair:native
+              node tools/setup/rebuild-native.js --repair
             fi
           fi
           node -v
           npm -v
 
+      - name: Install optional LSP tools (best effort)
+        shell: bash
+        run: |
+          set +e
+          node tools/tooling/install.js --scope cache --tools pyright,yaml-language-server,gopls,csharp-ls,solargraph,phpactor --json
+          status=$?
+          if [ $status -ne 0 ]; then
+            echo "optional tooling install had non-fatal failures (continuing)."
+          fi
+          exit 0
+
       - name: CI Suite
         run: |
           node tools/ci/run-suite.js --mode ci --skip-prechecks
 
+      - name: Upload quality artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ci-quality-artifacts-macos
+          path: |
+            .diagnostics/test-summary.json
+            .diagnostics/test-timings.json
+            .diagnostics/test-profile.json
+            .diagnostics/coverage/**
+            .testLogs/junit.xml
+          if-no-files-found: ignore
+          include-hidden-files: true
+          compression-level: 0
+
       - name: Upload test artifacts
         if: failure()
         uses: actions/upload-artifact@v4
@@ -269,4 +398,5 @@ jobs:
             .testLogs/**
             .diagnostics/**
           if-no-files-found: ignore
+          include-hidden-files: true
           compression-level: 0

.github/workflows/codeql.yml

@@ -14,8 +14,16 @@ on:
 
 jobs:
   analyze:
-    name: CodeQL (javascript)
+    name: CodeQL (${{ matrix.language }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript
+            build-mode: none
+          - language: rust
+            build-mode: autobuild
     steps:
       - name: Rate limit (nightly)
         if: github.event_name == 'schedule'
@@ -71,8 +79,21 @@ jobs:
         if: (github.event_name != 'push' || steps.rate.outputs.skip != 'true') && (github.event_name != 'schedule' || steps.nightly.outputs.skip != 'true')
         uses: github/codeql-action/init@v4
         with:
-          languages: javascript
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Setup Rust toolchain
+        if: matrix.language == 'rust' && (github.event_name != 'push' || steps.rate.outputs.skip != 'true') && (github.event_name != 'schedule' || steps.nightly.outputs.skip != 'true')
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: 1.86.0
+
+      - name: Autobuild Rust
+        if: matrix.language == 'rust' && (github.event_name != 'push' || steps.rate.outputs.skip != 'true') && (github.event_name != 'schedule' || steps.nightly.outputs.skip != 'true')
+        uses: github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL Analysis
         if: (github.event_name != 'push' || steps.rate.outputs.skip != 'true') && (github.event_name != 'schedule' || steps.nightly.outputs.skip != 'true')
         uses: github/codeql-action/analyze@v4
+        with:
+          category: '/language:${{ matrix.language }}'