chore(sync): sync upstream main

.githooks/pre-commit

@@ -85,6 +85,7 @@ prettier_targets=()
 rust_tauri_targets=()
 has_src_changes=false
 has_tauri_changes=false
+has_support_matrix_changes=false
 
 while IFS= read -r file; do
   case "$file" in
@@ -105,10 +106,18 @@ while IFS= read -r file; do
       esac
       ;;
   esac
+
+  # These files are the inputs of CI's support-contract job
+  # (scripts/support-matrix.mjs check + homebrew-cask selftest).
+  case "$file" in
+    scripts/support-matrix*|README.md|README_EN.md|.github/workflows/ci.yml|.github/workflows/release.yml|package.json)
+      has_support_matrix_changes=true
+      ;;
+  esac
 done < <(git diff --cached --name-only --diff-filter=ACMR)
 
-if [ "$has_src_changes" = false ] && [ "$has_tauri_changes" = false ]; then
-  echo "[pre-commit] No src/ or src-tauri/ changes, skipping checks."
+if [ "$has_src_changes" = false ] && [ "$has_tauri_changes" = false ] && [ "$has_support_matrix_changes" = false ]; then
+  echo "[pre-commit] No src/, src-tauri/ or support-matrix changes, skipping checks."
   exit 0
 fi
 
@@ -158,7 +167,13 @@ fi
 
 if [ "$has_src_changes" = true ]; then
   echo "[pre-commit] Running frontend checks..."
-  pnpm run check:precommit:src
+  node scripts/run-checks.mjs precommit-src
+fi
+
+if [ "$has_support_matrix_changes" = true ]; then
+  echo "[pre-commit] Running support matrix checks..."
+  pnpm run check:support-matrix
+  pnpm run check:homebrew-cask
 fi
 
 if [ "$has_tauri_changes" = true ]; then
@@ -167,7 +182,7 @@ if [ "$has_tauri_changes" = true ]; then
   # cargo --locked 会直接失败，问题常常被拖到 pre-push 才暴露。
   # 这里在检测到典型报错后自动更新 Cargo.lock 并重新校验，减少反复踩坑。
   tauri_log="$(mktemp -t aio-precommit-tauri.XXXXXX)"
-  if pnpm run check:precommit:tauri 2>&1 | tee "$tauri_log"; then
+  if node scripts/run-checks.mjs precommit-tauri 2>&1 | tee "$tauri_log"; then
     rm -f "$tauri_log"
   else
     if grep -q "needs to be updated but --locked was passed" "$tauri_log"; then
@@ -188,7 +203,7 @@ if [ "$has_tauri_changes" = true ]; then
       git add -- "src-tauri/Cargo.lock"
 
       echo "[pre-commit] Re-running Rust fast checks with --locked..."
-      pnpm run check:precommit:tauri
+      node scripts/run-checks.mjs precommit-tauri
       rm -f "$tauri_log"
     else
       rm -f "$tauri_log"

.githooks/pre-push

@@ -9,5 +9,5 @@ cd "$repo_root"
 # tests accidentally execute ref names as commands.
 exec </dev/null
 
-echo "[pre-push] Running full pre-push checks (coverage + tauri test + clippy)..."
+echo "[pre-push] Running full pre-push checks (CI mirror: static checks + sharded coverage gate + tauri test + clippy)..."
 pnpm run check:prepush

.github/workflows/ci.yml

@@ -9,6 +9,13 @@ on:
 permissions:
   contents: read
 
+# A new push to the same PR/branch supersedes the in-flight run. This also
+# cancels the doomed pre-sync run on release-please PRs once
+# sync-release-pr-cargo-lock pushes the updated Cargo.lock.
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   pr-title:
     if: github.event_name == 'pull_request'
@@ -48,6 +55,9 @@ jobs:
       - name: Validate support matrix contract
         run: node scripts/support-matrix.mjs check
 
+      - name: Validate Homebrew Cask generator
+        run: node scripts/support-matrix.homebrew-cask.selftest.mjs
+
   desktop-support-contract:
     needs: support-contract
     strategy:
@@ -124,10 +134,13 @@ jobs:
         run: pnpm check:generated-bindings
 
       - name: Plugin TypeScript SDK typecheck
-        run: pnpm plugin-sdk:typecheck
+        run: pnpm --filter @aio-coding-hub/plugin-sdk typecheck
+
+      - name: Plugin TypeScript SDK tests
+        run: pnpm --filter @aio-coding-hub/plugin-sdk test
 
       - name: Plugin scaffolder tests
-        run: pnpm create-aio-plugin:test
+        run: pnpm --filter create-aio-plugin test
 
       - name: Plugin GUI E2E smoke
         run: pnpm test:e2e
@@ -200,18 +213,16 @@ jobs:
         working-directory: src-tauri
         run: cargo clippy --all-targets --locked -- -D warnings
 
-      - name: Plugin WASM SDK tests
-        run: |
-          cargo test --manifest-path packages/plugin-wasm-sdk/Cargo.toml
-          cargo test --manifest-path packages/plugin-wasm-sdk/examples/redactor/Cargo.toml
-
       - name: Rust test
         working-directory: src-tauri
+        env:
+          CARGO_BUILD_JOBS: "1"
         run: cargo test --locked -- --test-threads=1
 
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
 
       - name: Dependency audit (cargo)
         working-directory: src-tauri
-        run: cargo audit
+        # quick-xml <0.41 is still pulled by current upstream Tauri/Wayland/notification deps.
+        run: cargo audit --ignore RUSTSEC-2026-0194 --ignore RUSTSEC-2026-0195

.github/workflows/release-pr-sync-cargo-lock.yml

@@ -22,6 +22,10 @@ jobs:
         with:
           ref: ${{ github.head_ref }}
           fetch-depth: 0
+          # Push with a PAT instead of GITHUB_TOKEN: runs re-triggered by a
+          # GITHUB_TOKEN push get stuck in action_required, leaving the
+          # release PR with its pre-sync red ci run forever.
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
 
       - name: Install Rust 1.90.0
         uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9

.github/workflows/release.yml

@@ -196,7 +196,7 @@ jobs:
           $label = "${{ matrix.stable_label }}"
           $targetDir = "src-tauri/target/${{ matrix.target }}/release"
 
-          # Find the built application exe (not the NSIS/MSI installer)
+          # Find the built application exe, not the bundled setup package.
           $exeName = "AIO Coding Hub.exe"
           $exePath = Join-Path $targetDir $exeName
 
@@ -237,10 +237,14 @@ jobs:
         run: |
           set -euo pipefail
 
-          # Download pinned stable release of appimagetool (no FUSE required).
+          # Fetch pinned stable release of appimagetool (no FUSE required).
           TOOL_URL="https://github.com/AppImage/appimagetool/releases/download/1.9.1/appimagetool-x86_64.AppImage"
+          TOOL_SHA256="ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3cb384eb0"
           TOOL_BIN="$(mktemp)"
-          curl -fsSL "$TOOL_URL" -o "$TOOL_BIN"
+          node scripts/fetch-checked-file.mjs \
+            --url "$TOOL_URL" \
+            --sha256 "$TOOL_SHA256" \
+            --output "$TOOL_BIN"
           chmod +x "$TOOL_BIN"
 
           label="${{ matrix.stable_label }}"
@@ -388,3 +392,98 @@ jobs:
               release_id: releaseId,
               draft: false,
             });
+
+  publish-homebrew-cask:
+    needs: [release-please, publish]
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    env:
+      HOMEBREW_TAP_REPOSITORY: ${{ vars.HOMEBREW_TAP_REPOSITORY || 'dyndynjyxa/homebrew-aio-coding-hub' }}
+      HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup Node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+
+      - name: Generate Homebrew Cask
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          release_assets_api="repos/${{ github.repository }}/releases/${{ needs.release-please.outputs.release_id }}/assets"
+
+          macos_arm_sha256="$(
+            gh api "$release_assets_api" --paginate \
+              --jq '.[] | select(.name == "aio-coding-hub-macos-arm.zip") | .digest' \
+              | sed 's/^sha256://'
+          )"
+          macos_intel_sha256="$(
+            gh api "$release_assets_api" --paginate \
+              --jq '.[] | select(.name == "aio-coding-hub-macos-intel.zip") | .digest' \
+              | sed 's/^sha256://'
+          )"
+
+          if [[ -z "$macos_arm_sha256" || -z "$macos_intel_sha256" ]]; then
+            echo "Missing macOS zip digests for Homebrew Cask generation." >&2
+            echo "macos_arm_sha256=${macos_arm_sha256:-<missing>}" >&2
+            echo "macos_intel_sha256=${macos_intel_sha256:-<missing>}" >&2
+            exit 1
+          fi
+
+          node scripts/support-matrix.mjs homebrew-cask \
+            --tag "${{ needs.release-please.outputs.tag_name }}" \
+            --repo "${{ github.repository }}" \
+            --macos-arm-sha256 "$macos_arm_sha256" \
+            --macos-intel-sha256 "$macos_intel_sha256" \
+            --output generated-homebrew/Casks/aio-coding-hub.rb
+
+      - name: Skip Homebrew tap sync when token is missing
+        if: env.HOMEBREW_TAP_TOKEN == ''
+        run: |
+          echo "HOMEBREW_TAP_TOKEN is not configured; generated Cask will not be pushed."
+
+      - name: Sync Homebrew tap
+        if: env.HOMEBREW_TAP_TOKEN != ''
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Fail fast with an actionable message when the token cannot access
+          # the tap repo — git's own failure mode is a cryptic
+          # "could not read Username" prompt.
+          status=$(curl -s -o /dev/null -w "%{http_code}" \
+            -H "Authorization: Bearer ${HOMEBREW_TAP_TOKEN}" \
+            "https://api.github.com/repos/${HOMEBREW_TAP_REPOSITORY}")
+          if [[ "$status" != "200" ]]; then
+            echo "::error::HOMEBREW_TAP_TOKEN cannot access ${HOMEBREW_TAP_REPOSITORY} (HTTP ${status}). The PAT must be valid and have contents read/write on the tap repository."
+            exit 1
+          fi
+
+          git check-ref-format --normalize "refs/heads/main" >/dev/null
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          # git-over-HTTPS expects Basic auth (this is what actions/checkout
+          # sends); a raw "bearer" header is rejected for some token types.
+          auth_header="AUTHORIZATION: basic $(printf 'x-access-token:%s' "${HOMEBREW_TAP_TOKEN}" | base64 -w0)"
+
+          git -c http.extraheader="$auth_header" \
+            clone "https://github.com/${HOMEBREW_TAP_REPOSITORY}.git" homebrew-tap
+
+          mkdir -p homebrew-tap/Casks
+          cp generated-homebrew/Casks/aio-coding-hub.rb homebrew-tap/Casks/aio-coding-hub.rb
+
+          cd homebrew-tap
+          if git diff --quiet -- Casks/aio-coding-hub.rb; then
+            echo "Homebrew Cask is already up to date."
+            exit 0
+          fi
+
+          git add Casks/aio-coding-hub.rb
+          git commit -m "chore: update aio-coding-hub ${{ needs.release-please.outputs.tag_name }}"
+          git -c http.extraheader="$auth_header" push origin HEAD

.gitignore

@@ -32,6 +32,7 @@ docs/*
 !docs/plugin-system-development-plan.md
 !docs/plugin-system-rfc.md
 !docs/plugin-manifest-v1.md
+!docs/release-homebrew.md
 !docs/plugins/
 !docs/plugins/**
 docs/superpowers/
@@ -41,10 +42,12 @@ docs/superpowers/
 check-doc/
 AGENTS.md
 coverage*/
+.vitest-reports/
 .cursor/
 .trellis/
 .agents/
 .serena/
+.superpowers/
 src/templates/
 .codex/
 .codex-temp/

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.60.2"
+  ".": "0.60.10"
 }