merge: sync with upstream can1357/oh-my-pi

.bazelrc

@@ -6,7 +6,7 @@
 common --enable_platform_specific_config
 
 # Hermetic-ish action env: no host env leaks into action keys. Build scripts
-# that need host tools (cmake for audiopus_sys' bundled opus) get an explicit
+# that need host tools (cmake for opusic-sys' bundled Opus) get an explicit
 # PATH through crate annotations in MODULE.bazel.
 build --incompatible_strict_action_env
 
@@ -32,6 +32,22 @@ build --@rules_rust//rust/settings:error_format=human
 # Generated toolchains carry target_settings requiring the nightly channel.
 build --@rules_rust//rust/toolchain/channel=nightly
 
+# Pin the macOS deployment target for target and exec links. Unset, the
+# autodetected cc toolchain uses the selected SDK version: 10.11 under Command
+# Line Tools but 27.0 under full Xcode 27 (xcode-27 runners), which would lock
+# the addon to macOS 27+. 12.0 matches the Foundation Models bridge's Swift
+# target.
+build:macos --macos_minimum_os=12.0
+build:macos --host_macos_minimum_os=12.0
+# rustc strips Apple binaries with its bundled rust-objcopy, which leaves
+# minos >= 12.0 dylibs with a LINKEDIT string pool dyld rejects ("mis-aligned
+# LINKEDIT string pool"); rustc reports that for every proc-macro as E0463
+# "can't find crate". Strip at link time instead (-S drops debug info, the
+# opt-mode `strip=debuginfo` equivalent). Exec links (proc-macros, build
+# scripts) are covered here; the shipped addon in bazel/defs.bzl.
+build:macos --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cstrip=none
+build:macos --@rules_rust//rust/settings:extra_exec_rustc_flag=-Clink-arg=-Wl,-S
+
 
 # --- Rust validation (replaces cargo clippy/nextest in CI) --------------------
 # Mirrors cargo semantics: crates with `[lints] workspace = true` (pi-ast,

.cargo/config.toml

@@ -1,30 +1,14 @@
 # Cargo environment for the workspace.
 #
-# audiopus_sys 0.2.2 builds its vendored Opus via the `cmake` crate, and the
-# bundled opus CMakeLists still declares `cmake_minimum_required(VERSION 3.1)`.
-# CMake 4.0 removed compatibility with < 3.5, so any dev host with a modern
-# cmake fails `cargo check`/`cargo clippy` on pi-voice with
-# "Compatibility with CMake < 3.5 has been removed from CMake." The bazel build
-# already sets this override for the same crate (see the audiopus_sys
-# annotation in MODULE.bazel); mirror it here so the cargo path works too.
+# Native CMake builds use Ninja: Xcode's GNU make 3.81 can block while reading
+# cargo's forwarded jobserver pipe. CI images and the Nix dev shell include
+# Ninja; macOS dev hosts need `brew install ninja`.
 [env]
-CMAKE_POLICY_VERSION_MINIMUM = "3.5"
-# The Makefile generator can wedge cargo forever on macOS: the `cmake` crate
-# forwards cargo's jobserver via MAKEFLAGS, and Xcode's GNU make 3.81 blocks
-# reading a jobserver pipe whose write end doesn't survive `cmake -E env`
-# (observed in omp with whisper-rs-sys; audiopus_sys uses the same crate).
-# Ninja schedules itself and ignores make's jobserver protocol entirely.
-# CI needs no setup: the only cargo invocations there (cargo-deny/fetch) never
-# build cmake crates, workspace Rust compiles via Bazel (which ignores this
-# file, opus pinned in MODULE.bazel), and nix builds already carry ninja in
-# nativeBuildInputs. Dev hosts need ninja (nix dev-shell provides it; macOS:
-# `brew install ninja`).
 CMAKE_GENERATOR = "Ninja"
 # Store each crate's metadata only in its .rmeta instead of duplicating it into
 # every rlib. Measured on a reqwest-sized graph: 196 MB -> 130 MB target dir at
 # identical build times. Requires the pinned nightly (rust-toolchain.toml).
-# The accepted spelling is toolchain-coupled: cargo took `"DoNotEmbed"` before
-# ~2026-08 and a bare boolean after. This matches nightly-2026-08-08; if you
-# bump rust-toolchain.toml backwards, switch to `"DoNotEmbed"`.
+# The accepted spelling is toolchain-coupled: this nightly accepts a bare
+# boolean, while older nightlies took `"DoNotEmbed"`.
 [unstable]
 embed-metadata = false

.config/nextest.toml

@@ -4,10 +4,10 @@
 #
 # Doctests are NOT run by nextest (upstream limitation: they have no stable
 # libtest-json interface). `scripts/run-rs-task.ts` pairs the nextest run with
-# `cargo test --doc`. That pass executes nothing today — pi-natives is a
-# `cdylib` (rustdoc collects no doctests from it) and pi-builtins' examples are
-# `ignore`d vendored uutils docs — and is kept so the first runnable doctest
-# added to a lib crate actually runs.
+# `cargo test --doc`, which runs every runnable doctest in the workspace's lib
+# crates. Today that is tree-sitter-go's one example: pi-natives is a `cdylib`
+# (rustdoc collects no doctests from it) and pi-builtins' examples are
+# `ignore`d vendored uutils docs.
 
 [profile.default]
 # Print each failure when it happens and again in the final summary — a run

.gitattributes

@@ -55,3 +55,10 @@ poetry.lock -text
 # Changelogs are append-mostly; auto-merge by unioning both sides.
 packages/*/CHANGELOG.md merge=union
 
+# Generated, minified catalog artifacts: regenerate instead of diffing/merging.
+packages/catalog/src/models.json binary
+packages/catalog/src/compat/rules.json binary
+
+# Generated tree-sitter parser: regenerate from grammar.js (see its README.md).
+crates/vendor/tree-sitter-go/src/parser.c linguist-generated
+

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,6 @@
 ## What
 
-<!-- Brief description of the change -->
+<!-- Brief description of the change. Include at least one sentence in your own words explaining what changed and why, as required by CONTRIBUTING.md. -->
 
 ## Why
 
@@ -14,4 +14,4 @@
 
 - [ ] `bun check` passes
 - [ ] Tested locally
-- [ ] CHANGELOG updated (if user-facing)
+- [ ] CHANGELOG updated with the required attribution (if user-facing; internal issue fixes use issue links, external contributions add the PR link and contributor credit after creation)

.github/actions/bazel-cache/action.yml

@@ -24,10 +24,24 @@ description: >
    entries untouched for 14 days are pruned before the build so
    ever-seeding archives don't grow without bound.
 
+   Only main saves. actions/cache entries are scoped to the ref that saved
+   them: a tag or branch run can read main's archives, but whatever it saves
+   is readable only by that same ref, while still counting against the
+   shared 10 GB repo quota. A tag-dispatched release saved a ~5 GB darwin
+   archive under refs/tags/v18.2.10 and GitHub's LRU eviction then dropped
+   main's darwin archives, so the next release built cold.
+
 inputs:
    scope:
       description: Disk-cache key discriminator shared by compatible consumers
       required: true
+   fallback-scope:
+      description: >
+         Optional scope whose newest archive is the last restore fallback
+         (e.g. the sibling darwin target on the same runner image, which
+         shares every exec-config action). Empty disables it.
+      required: false
+      default: ""
 
 outputs:
    rc:
@@ -37,7 +51,7 @@ outputs:
       description: Exact GitHub cache key for a later explicit save
       value: ${{ steps.backend.outputs.cache-key }}
    save-needed:
-      description: Whether a disk-cache build can save a new exact-key archive
+      description: Whether this run should save a new exact-key disk-cache archive (hosted, inexact restore, on main)
       value: ${{ steps.compose.outputs.save-needed }}
    remote:
       description: Whether the shell probe selected the cluster remote cache
@@ -65,11 +79,16 @@ runs:
            key="bazel-disk-v3-${{ inputs.scope }}-${{ runner.os }}-${{ runner.arch }}-$CONFIG_HASH-$SOURCE_HASH"
            prefix="bazel-disk-v3-${{ inputs.scope }}-${{ runner.os }}-${{ runner.arch }}-$CONFIG_HASH-"
            bare_prefix="bazel-disk-v3-${{ inputs.scope }}-${{ runner.os }}-${{ runner.arch }}-"
+           fallback_prefix=""
+           if [ -n "${{ inputs.fallback-scope }}" ]; then
+             fallback_prefix="bazel-disk-v3-${{ inputs.fallback-scope }}-${{ runner.os }}-${{ runner.arch }}-"
+           fi
            {
              echo "remote=$remote"
              echo "cache-key=$key"
              echo "cache-prefix=$prefix"
              echo "cache-bare-prefix=$bare_prefix"
+             echo "cache-fallback-prefix=$fallback_prefix"
            } >> "$GITHUB_OUTPUT"
 
       - name: Restore bazel disk cache
@@ -94,17 +113,19 @@ runs:
            restore-keys: |
               ${{ steps.backend.outputs.cache-prefix }}
               ${{ steps.backend.outputs.cache-bare-prefix }}
+              ${{ steps.backend.outputs.cache-fallback-prefix }}
 
       - name: Compose cache config
         id: compose
         shell: bash
         env:
            REMOTE: ${{ steps.backend.outputs.remote }}
            RESTORE_HIT: ${{ steps.restore.outputs.cache-hit }}
+           ON_MAIN: ${{ github.ref == 'refs/heads/main' }}
         run: |
            set -euo pipefail
            save_needed=false
-           if [ "$REMOTE" != "true" ] && [ "$RESTORE_HIT" != "true" ]; then
+           if [ "$REMOTE" != "true" ] && [ "$RESTORE_HIT" != "true" ] && [ "$ON_MAIN" = "true" ]; then
              save_needed=true
            fi
 

.github/actions/bazel-natives/action.yml

@@ -17,6 +17,14 @@ inputs:
       description: Disk-cache key discriminator (see bazel-cache action)
       required: false
       default: natives
+   fallback-scope:
+      description: Optional second scope whose newest archive seeds this one when it has none (same runner image only)
+      required: false
+      default: ""
+   save:
+      description: Save the refreshed disk-cache archive when the bazel-cache action says one is needed
+      required: false
+      default: "true"
 
 runs:
    using: composite
@@ -25,6 +33,7 @@ runs:
         uses: ./.github/actions/bazel-cache
         with:
            scope: ${{ inputs.cache-scope }}
+           fallback-scope: ${{ inputs.fallback-scope }}
 
       - name: Build native addons
         shell: bash
@@ -40,7 +49,7 @@ runs:
            read -r -a targets <<< "$NATIVE_TARGETS"
            bun scripts/bazel-natives.ts "${targets[@]}" --dest "$NATIVE_DEST"
       - name: Save bazel disk cache
-        if: steps.cache.outputs.save-needed == 'true'
+        if: steps.cache.outputs.save-needed == 'true' && inputs.save == 'true'
         uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
            # Must mirror the restore path list in the bazel-cache action.

.github/actions/bun-install/action.yml

@@ -14,25 +14,41 @@ runs:
         shell: bash
         run: |
            # bun is baked into the omp-kata runner image — reuse it only when it
-           # matches the repo pin (package.json "packageManager"). A lagging
-           # preloaded bun skews version-sensitive codegen (gen:tool-views) and
-           # test-runner behavior, so a mismatch fetches the pinned build instead.
+           # satisfies the repo pin (package.json "packageManager"). The pin is
+           # either exact ("bun@1.4.2") or a floor ("bun@>=1.4"): an exact pin
+           # installs that build on mismatch, a floor installs latest when the
+           # preloaded bun is older than the floor. A lagging preloaded bun skews
+           # version-sensitive codegen (gen:tool-views) and test-runner behavior.
            want="$(sed -n 's/.*"packageManager": *"bun@\([^"]*\)".*/\1/p' package.json)"
            if [ -z "$want" ]; then
              echo "::error::could not read pinned bun version from package.json packageManager"
              exit 1
            fi
-           echo "bun_version=$want" >> "$GITHUB_OUTPUT"
+           case "$want" in
+             '>='*) floor="${want#>=}"; install="latest" ;;
+             *)     floor="$want";      install="bun-v$want" ;;
+           esac
+           # bun.sh/install takes a release tag argument; "latest" is spelled as no argument.
+           echo "bun_install=$([ "$install" = latest ] || echo "$install")" >> "$GITHUB_OUTPUT"
            have=""
            if command -v bun >/dev/null 2>&1; then
              have="$(bun --version)"
            fi
-           if [ "$have" = "$want" ]; then
+           ok=false
+           if [ -n "$have" ]; then
+             if [ "$install" = latest ]; then
+               # floor satisfied when the floor sorts first (or equal) under sort -V
+               [ "$(printf '%s\n%s\n' "$floor" "$have" | sort -V | head -n1)" = "$floor" ] && ok=true
+             elif [ "$have" = "$want" ]; then
+               ok=true
+             fi
+           fi
+           if [ "$ok" = true ]; then
              echo "setup_bun=false" >> "$GITHUB_OUTPUT"
-             echo "bun present: $have (matches pin)"
+             echo "bun present: $have (satisfies $want)"
            else
              echo "setup_bun=true" >> "$GITHUB_OUTPUT"
-             echo "bun on runner: ${have:-none}; installing pinned $want"
+             echo "bun on runner: ${have:-none}; does not satisfy $want, installing $install"
            fi
            # The repo keys "are we on can.internal infra?" off $BAZEL_REMOTE_USER
            # (the bazel-remote-ci secret is envFrom-injected into every omp-kata
@@ -51,16 +67,18 @@ runs:
         shell: bash
         run: |
            export BUN_INSTALL="${HOME}/.bun"
-           curl -fsSL https://bun.sh/install | bash -s "bun-v${{ steps.env.outputs.bun_version }}"
+           # Unquoted on purpose: an empty tag (floor pin) must pass no argument, which the
+           # script reads as "latest".
+           curl -fsSL https://bun.sh/install | bash -s -- ${{ steps.env.outputs.bun_install }}
            echo "${BUN_INSTALL}/bin" >> "$GITHUB_PATH"
 
       # Off-infra (GitHub-hosted): actions/cache for the bun store, split into
       # restore + save. actions/cache entries are scoped per ref but count
       # against the shared 10 GB repo quota — letting every PR branch save its
       # own copy of the ~500 MB store duplicated it 19x, evicting the far more
       # valuable bazel disk-cache archives (which is why release darwin builds
-      # kept going cold). PRs only restore; non-PR runs (main pushes, releases,
-      # dispatches) produce the shared entry every PR can see.
+      # kept going cold). Only main saves: a tag or branch copy is readable by
+      # that ref alone, so it wastes quota; every other ref restores main's.
       - name: Restore bun store (GitHub cache)
         id: bun-cache
         if: steps.env.outputs.cache == 'gha'
@@ -100,10 +118,10 @@ runs:
            retry_cache="$(mktemp -d "${RUNNER_TEMP:-/tmp}/bun-cache-retry.XXXXXX")"
            bun install --frozen-lockfile --cache-dir="$retry_cache"
 
-      # Producer half of the split cache: only non-PR runs save, so the store
-      # exists once per lockfile generation instead of once per PR ref.
+      # Producer half of the split cache: only main saves, so the store exists
+      # once per lockfile generation instead of once per ref.
       - name: Save bun store (GitHub cache)
-        if: steps.env.outputs.cache == 'gha' && github.event_name != 'pull_request' && steps.bun-cache.outputs.cache-hit != 'true'
+        if: steps.env.outputs.cache == 'gha' && github.ref == 'refs/heads/main' && steps.bun-cache.outputs.cache-hit != 'true'
         uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
            path: ~/.bun/install/cache