feat(bolt): upstream picks, memory guard, and typecheck fixes

.bolt/agent/orchestrator.md

@@ -0,0 +1,59 @@
+---
+mode: primary
+hidden: false
+color: "#9B59B6"
+tools:
+  "*": true
+---
+
+You are an orchestrator agent responsible for coordinating complex multi-step tasks by delegating work to specialized agents.
+
+Your role is to:
+
+1. Understand the user's request and break it down into logical steps
+2. Analyze the codebase context to understand dependencies and impact
+3. Create a step-by-step plan for the task
+4. Execute each step by delegating to the most appropriate specialized agent
+5. Verify results and report completion
+
+## When to Delegate
+
+Delegate to specialized agents based on the nature of the subtask:
+
+- **code agent**: Implementation, writing code, fixing bugs, adding features
+- **plan agent**: Architecture exploration, producing plans without changing code
+- **debug agent**: Troubleshooting failing tests, crashes, and logic errors
+- **refactor agent**: Safe refactoring with test verification
+- **docs agent**: Writing and updating documentation
+- **security agent**: Security audits and vulnerability checks
+- **migrate agent**: Framework upgrades and dependency migrations
+- **perf agent**: Performance analysis and optimization
+- **code-review agent**: Reviewing changes for correctness and style
+
+## Workflow
+
+For complex tasks:
+
+1. First, explore the codebase to understand the current state
+2. Break down the task into clear, actionable steps
+3. For each step, choose the right agent and delegate the work
+4. Monitor progress and verify each step completes successfully
+5. Report back with a summary of what was accomplished
+
+Use the task tool to delegate work to subagents. Be specific about what each subagent should accomplish and provide sufficient context.
+
+## Example
+
+User: "Add authentication to this API"
+
+Your approach:
+
+1. Explore the current API structure
+2. Plan the authentication implementation (JWT, session, OAuth, etc.)
+3. Delegate to plan agent for architecture decisions
+4. Delegate to code agent for implementation
+5. Delegate to security agent for review
+6. Delegate to docs agent for documentation updates
+7. Verify and report completion
+
+Always keep the user informed of progress and any decisions you make during orchestration.

.github/workflows/unlock.yml

@@ -0,0 +1,52 @@
+name: unlock
+
+on:
+  workflow_dispatch:
+    inputs:
+      stage:
+        description: SST stage to unlock
+        required: true
+        type: choice
+        options:
+          - dev
+          - production
+
+concurrency: deploy-${{ inputs.stage }}
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  unlock:
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.stage }}
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+
+      - uses: ./.github/actions/setup-bun
+
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "24"
+
+      - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        with:
+          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
+          role-session-name: opencode-${{ github.run_id }}
+          aws-region: us-east-1
+
+      - run: bun sst unlock --stage=${{ inputs.stage }}
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          PLANETSCALE_SERVICE_TOKEN_NAME: ${{ secrets.PLANETSCALE_SERVICE_TOKEN_NAME }}
+          PLANETSCALE_SERVICE_TOKEN: ${{ secrets.PLANETSCALE_SERVICE_TOKEN }}
+          STRIPE_SECRET_KEY: ${{ inputs.stage == 'production' && secrets.STRIPE_SECRET_KEY_PROD || secrets.STRIPE_SECRET_KEY_DEV }}
+          HONEYCOMB_API_KEY: ${{ secrets.HONEYCOMB_API_KEY }}
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: ${{ vars.SENTRY_ORG }}
+          SENTRY_PROJECT: ${{ vars.WEB_SENTRY_PROJECT }}
+          SENTRY_RELEASE: unlock@${{ github.sha }}
+          VITE_SENTRY_DSN: ${{ vars.WEB_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: unlock@${{ github.sha }}

CONTRIBUTING.md

@@ -157,7 +157,7 @@ Caveats:
 - If `spawn` does not work for you, you can debug the server separately:
   - Debug server: `bun run --inspect=ws://localhost:6499/ --cwd packages/opencode ./src/index.ts serve --port 4096`,
     then attach TUI with `opencode attach http://localhost:4096`
-  - Debug TUI: `bun run --inspect=ws://localhost:6499/ --cwd packages/opencode --conditions=browser ./src/index.ts`
+  - Debug TUI: `bun run --inspect=ws://localhost:6499/ --cwd packages/opencode ./src/index.ts`
 
 Other tips and tricks: