fix(app): sync upstream and harden production web session state

.github/actions/setup-bun/action.yml

@@ -1,6 +1,10 @@
 name: "Setup Bun"
 description: "Setup Bun with caching and install dependencies"
 inputs:
+  node-version:
+    description: "Node.js version used by dependency install scripts"
+    required: false
+    default: "24"
   install-flags:
     description: "Additional flags to pass to 'bun install'"
     required: false
@@ -13,7 +17,7 @@ runs:
     - name: Setup Node
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
-        node-version: "24"
+        node-version: ${{ inputs.node-version }}
 
     - name: Get baseline download URL
       id: bun-url

.github/workflows/test.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - dev
+      - production
   pull_request:
   workflow_dispatch:
 
@@ -31,7 +32,7 @@ jobs:
             host: blacksmith-4vcpu-ubuntu-2404
           - name: windows
             host: blacksmith-4vcpu-windows-2025
-    runs-on: ${{ matrix.settings.host }}
+    runs-on: ${{ github.repository == 'anomalyco/opencode' && matrix.settings.host || (matrix.settings.name == 'windows' && 'windows-latest' || 'ubuntu-latest') }}
     defaults:
       run:
         shell: bash
@@ -54,6 +55,10 @@ jobs:
           git config --global user.email "bot@opencode.ai"
           git config --global user.name "opencode"
 
+      - name: Install ripgrep
+        if: runner.os == 'Windows'
+        run: choco install ripgrep --version 15.1.0 --yes --no-progress
+
       - name: Cache Turbo
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
@@ -65,7 +70,7 @@ jobs:
 
       - name: Run unit tests
         timeout-minutes: 20
-        run: GITHUB_ACTIONS=false bun turbo test
+        run: GITHUB_ACTIONS=false bun turbo test --concurrency=${{ github.repository == 'anomalyco/opencode' && '10' || '2' }}
         env:
           OPENCODE_EXPERIMENTAL_DISABLE_FILEWATCHER: ${{ runner.os == 'Windows' && 'true' || 'false' }}
 
@@ -89,9 +94,10 @@ jobs:
             host: blacksmith-4vcpu-ubuntu-2404
           - name: windows
             host: blacksmith-4vcpu-windows-2025
-    runs-on: ${{ matrix.settings.host }}
+    runs-on: ${{ github.repository == 'anomalyco/opencode' && matrix.settings.host || (matrix.settings.name == 'windows' && 'windows-latest' || 'ubuntu-latest') }}
     env:
       PLAYWRIGHT_BROWSERS_PATH: ${{ github.workspace }}/.playwright-browsers
+      PLAYWRIGHT_WORKERS: ${{ github.repository == 'anomalyco/opencode' && '5' || '2' }}
     defaults:
       run:
         shell: bash
@@ -101,15 +107,12 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
         with:
           # Playwright 1.59 hangs while extracting Chromium with Node 24.16.
           node-version: "24.15"
 
-      - name: Setup Bun
-        uses: ./.github/actions/setup-bun
-
       - name: Read Playwright version
         id: playwright-version
         run: |

.github/workflows/typecheck.yml

@@ -2,14 +2,14 @@ name: typecheck
 
 on:
   push:
-    branches: [dev]
+    branches: [dev, production]
   pull_request:
-    branches: [dev]
+    branches: [dev, production]
   workflow_dispatch:
 
 jobs:
   typecheck:
-    runs-on: blacksmith-4vcpu-ubuntu-2404
+    runs-on: ${{ github.repository == 'anomalyco/opencode' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-latest' }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
@@ -18,4 +18,8 @@ jobs:
         uses: ./.github/actions/setup-bun
 
       - name: Run typecheck
-        run: bun typecheck
+        run: bun typecheck --concurrency=${{ github.repository == 'anomalyco/opencode' && '10' || '2' }}
+
+      - name: Typecheck browser regression fixtures
+        working-directory: packages/app
+        run: bun run typecheck:e2e

.github/workflows/upstream-sync.yml

@@ -2,11 +2,11 @@ name: Sync Upstream
 
 on:
   schedule:
-    - cron: '0 6 * * *'
+    - cron: "0 6 * * *"
   workflow_dispatch:
     inputs:
       force:
-        description: 'Force merge even if already up-to-date'
+        description: "Force merge even if already up-to-date"
         type: boolean
         default: false
 
@@ -91,6 +91,32 @@ jobs:
             } >> "$GITHUB_OUTPUT"
           fi
 
+      # GITHUB_TOKEN pushes do not trigger the normal push workflows. Gate here.
+      - name: Setup validation tools
+        if: steps.merge.outputs.status == 'merged'
+        uses: ./.github/actions/setup-bun
+
+      - name: Validate merged types and unit tests
+        if: steps.merge.outputs.status == 'merged'
+        run: |
+          bun turbo typecheck --concurrency=2
+          bun --cwd packages/app run typecheck:e2e
+          GITHUB_ACTIONS=false bun turbo test --concurrency=2
+          bun --cwd packages/client run check:generated
+          bun --cwd packages/opencode run test:httpapi
+
+      - name: Install browser test dependencies
+        if: steps.merge.outputs.status == 'merged'
+        working-directory: packages/app
+        run: bunx playwright install --with-deps chromium firefox
+
+      - name: Validate merged browser behavior
+        if: steps.merge.outputs.status == 'merged'
+        working-directory: packages/app
+        env:
+          CI: true
+        run: bun run test:e2e:local
+
       - name: Push merged changes
         if: steps.merge.outputs.status == 'merged'
         shell: bash