monorepo: absorb m4ttstack/apps

.github/renovate-global.json5

@@ -5,7 +5,7 @@
 // bumped in the consumers below. A repo that no longer exists fails the whole
 // run (platform-unknown-error), so this list must follow renames and
 // consolidations: deck, board, console, chat, tui-kit and app-kit all live in
-// m4ttstack/apps now. rt's own extensions/vscode/rt-context is excluded on
+// this repo now. rt's own extensions/vscode/rt-context is excluded on
 // purpose: its rt-client dep is bumped by hand alongside the package it
 // ships next to, never by a PR against this repo.
 {
@@ -15,7 +15,6 @@
   autodiscover: false,
   repositories: [
     "m4ttstack/rt",
-    "m4ttstack/apps",
     "m4ttstack/gitq",
     "m4ttstack/fast-browser",
   ],

.github/workflows/checks.yml

@@ -38,9 +38,11 @@ jobs:
   # moves to a static-macos job that runs on every PR, never into unit.
   static:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.4.2
@@ -53,40 +55,46 @@ jobs:
       - name: Lockfile in sync
         run: bun install && git diff --exit-code -- bun.lock
 
-      - name: Typecheck
-        run: bunx tsc --noEmit
-
       # A schema change that would invalidate stored settings needs a
       # storeVersion bump and a matching migrateFrom entry (a never-shipped
       # key may instead be acknowledged); the committed lock is the record.
       - name: Settings schema lock is in sync
         run: bun run cli.ts settings schema lock && git diff --exit-code -- packages/rt-client/src/settings/schema.lock.json
 
-      # The checkout is shallow and on a PR holds only the merge commit, so
-      # origin/main has to be fetched explicitly into its tracking ref. The
-      # v* tags are fetched too: the latest release's lock says which keys
-      # have shipped, and only a key that has not may skip a migration.
+      # The checkout has full history but only names the ref it checked out,
+      # so origin/main still needs an explicit fetch into its tracking ref.
+      # The v* tags are fetched too: the latest release's lock says which
+      # keys have shipped, and only a key that has not may skip a migration.
       - name: Settings schema changes are classified
-        run: git fetch --no-tags --depth=1 origin +refs/heads/main:refs/remotes/origin/main '+refs/tags/v*:refs/tags/v*' && bun run cli.ts settings schema diff --against-ref origin/main
+        run: git fetch --no-tags origin +refs/heads/main:refs/remotes/origin/main '+refs/tags/v*:refs/tags/v*' && bun run cli.ts settings schema diff --against-ref origin/main
 
       # release.yml is grandfathered out of the lint: it carries pre-existing
       # shellcheck findings whose quoting is tangled with the release flow.
       # Lint it the day it is next edited, not from this gate.
       - name: Workflow lint
         run: |
           bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash) 1.7.12 "$RUNNER_TEMP"
-          "$RUNNER_TEMP/actionlint" .github/workflows/bundle-apps.yml .github/workflows/checks.yml .github/workflows/e2e.yml .github/workflows/purity.yml .github/workflows/renovate.yml .github/workflows/timings.yml
+          "$RUNNER_TEMP/actionlint" .github/workflows/checks.yml .github/workflows/e2e.yml .github/workflows/purity.yml .github/workflows/renovate.yml .github/workflows/timings.yml
 
-      # Drift here is invisible until someone runs it by hand, which is how
-      # two commands reached main with no reference page.
-      - name: Command reference is in sync
-        run: bun run docs:check
-
-      # Every leaf that requires a positional must declare how it behaves when
-      # the arg is omitted (picker/list/prompt or an explicit exempt). A new
-      # command that just errors on a missing arg fails here, not in review.
-      - name: Picker convention is enforced
-        run: bun run picker:check
+      # A PR restores main's newest cache; main restores its own previous one.
+      # Entries older than a week are dropped first or compiled binaries pile up.
+      - uses: actions/cache@v4
+        with:
+          path: .git/turbo-cache
+          key: turbo-${{ runner.os }}-${{ github.sha }}
+          restore-keys: turbo-${{ runner.os }}-
+      - run: find .git/turbo-cache -type f -mtime +7 -delete 2>/dev/null || true
+      - name: Apps and packages, plus rt's static gates (turbo)
+        if: github.event_name == 'pull_request'
+        env:
+          TURBO_TELEMETRY_DISABLED: "1"
+          TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }}
+        run: scripts/turbo.sh check --affected --concurrency=4 --output-logs=errors-only
+      - name: Apps and packages, plus rt's static gates (turbo, main)
+        if: github.event_name != 'pull_request'
+        env:
+          TURBO_TELEMETRY_DISABLED: "1"
+        run: scripts/turbo.sh check --concurrency=4 --output-logs=errors-only
 
   # The Go helper's own vet + tests, plus the shared protocol fixtures both
   # languages golden-test (lib/ui/__tests__/protocol.test.ts runs in the unit
@@ -106,6 +114,35 @@ jobs:
       - name: rt-ui vet and tests
         run: bun run ui:test
 
+  # deck supervises launchd and shells to plutil, both macOS-only, so its suite
+  # runs here and nowhere else (scripts/turbo.sh drops it off macOS).
+  deck-macos:
+    runs-on: macos-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.2
+      - run: bun install --frozen-lockfile
+      - uses: actions/cache@v4
+        with:
+          path: .git/turbo-cache
+          key: turbo-${{ runner.os }}-${{ github.sha }}
+          restore-keys: turbo-${{ runner.os }}-
+      - run: find .git/turbo-cache -type f -mtime +7 -delete 2>/dev/null || true
+      - if: github.event_name == 'pull_request'
+        env:
+          TURBO_TELEMETRY_DISABLED: "1"
+          TURBO_SCM_BASE: ${{ github.event.pull_request.base.sha }}
+        run: scripts/turbo.sh test --filter=deck --affected --output-logs=errors-only
+      - if: github.event_name != 'pull_request'
+        env:
+          TURBO_TELEMETRY_DISABLED: "1"
+        run: scripts/turbo.sh test --filter=deck --output-logs=errors-only
+
   # macos-latest, matching e2e.yml: much of the tree is macOS-specific (launchd
   # labels, TCC, codesign, ~/Library paths) and the bunfig preload that isolates
   # HOME for tests is exercised the same way developers run it locally.
@@ -163,7 +200,7 @@ jobs:
   # would skip unit and this job too, and a skipped required check reads as
   # passing on GitHub.
   checks:
-    needs: [scope, static, go, unit]
+    needs: [scope, static, go, deck-macos, unit]
     if: always()
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -173,13 +210,15 @@ jobs:
           SCOPE: ${{ needs.scope.result }}
           STATIC: ${{ needs.static.result }}
           GO: ${{ needs.go.result }}
+          DECK: ${{ needs.deck-macos.result }}
           UNIT: ${{ needs.unit.result }}
           MODE: ${{ needs.scope.outputs.mode }}
         run: |
-          echo "scope=$SCOPE static=$STATIC go=$GO unit=$UNIT mode=$MODE"
+          echo "scope=$SCOPE static=$STATIC go=$GO deck=$DECK unit=$UNIT mode=$MODE"
           [ "$SCOPE" = success ] || { echo "scope did not succeed"; exit 1; }
           [ "$STATIC" = success ] || { echo "static did not succeed"; exit 1; }
           [ "$GO" = success ] || { echo "go did not succeed"; exit 1; }
+          [ "$DECK" = success ] || { echo "deck-macos did not succeed"; exit 1; }
           [ "$UNIT" = success ] && exit 0
           [ "$UNIT" = skipped ] && [ "$MODE" = skip ] && exit 0
           echo "unit was $UNIT with mode $MODE"

.github/workflows/e2e.yml

@@ -47,10 +47,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.2
 
       - name: Install dependencies
         run: |
-          bun install
+          bun install --frozen-lockfile
 
       - name: Cache Cargo
         uses: actions/cache@v4
@@ -105,14 +107,16 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.2
 
       - uses: actions/setup-go@v5
         with:
           go-version-file: ui/go.mod
           cache-dependency-path: ui/go.sum
 
       - name: Install dependencies
-        run: bun install
+        run: bun install --frozen-lockfile
 
       - name: Cache Cargo
         uses: actions/cache@v4

.github/workflows/release.yml

@@ -13,7 +13,35 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # App code runs here and only here. The release job below imports the
+  # Developer ID key and never runs a recipe; it receives these bytes as an
+  # artifact and signs them like any fetched helper.
+  build-apps:
+    runs-on: macos-15
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.2
+      - run: bun install --frozen-lockfile
+      - name: Build the tree rows
+        run: bun scripts/build-apps.ts --arch arm64
+      # upload-artifact strips executable bits and dereferences symlinks;
+      # tar keeps the binaries runnable.
+      - name: Pack the handoff
+        run: tar czf apps-handoff.tgz -C rt-tray/deps/arm64 .
+      - uses: actions/upload-artifact@v4
+        with:
+          name: apps-handoff
+          path: apps-handoff.tgz
+
   release:
+    needs: build-apps
     runs-on: macos-15
     permissions:
       contents: write
@@ -57,7 +85,9 @@ jobs:
         with:
           bun-version: 1.4.2
       - name: Install dependencies
-        run: bun install --frozen-lockfile
+        run: |
+          bun install --frozen-lockfile --ignore-scripts
+          bun run postinstall
 
       # `plugins.install` adds this marketplace on every machine rt sets up, so
       # it has to be live before the release shipping that installer is. It
@@ -157,13 +187,20 @@ jobs:
           restore-keys: mattstack-deps-${{ runner.os }}-
 
       - name: Fetch bundled dependencies
-        # GH_TOKEN: console and chat are private repos, so their release
-        # assets refuse bare curl; fetch-deps falls back to gh, which needs
-        # a token that can read the m4ttstack app repos.
         env:
           GH_TOKEN: ${{ secrets.MATTSTACK_RELEASE_TOKEN }}
         run: scripts/fetch-deps.sh arm64
 
+      - name: Land the tree rows
+        uses: actions/download-artifact@v4
+        with:
+          name: apps-handoff
+          path: handoff
+      - run: |
+          mkdir -p rt-tray/deps/arm64
+          tar xzf handoff/apps-handoff.tgz -C rt-tray/deps/arm64
+          ls rt-tray/deps/arm64
+
       # Saved straight after the fetch, so a run that fails later (notarize,
       # clean room) still keeps its downloads. Files deps.lock no longer pins
       # are dropped first, or a restore-keys hit would carry them forever.

.gitignore

@@ -37,3 +37,17 @@ rt-tray/.build-xcode/
 .lane-b-status.md
 
 ui/dist/
+
+# apps and packages (imported from the apps repo)
+dist-ssr
+*.local
+storybook-static
+*storybook.log
+.turbo
+FEEDBACK-*.md
+packages/ui/scripts/treeshake-probe/dist
+probe/src/server/embedded/manifest.ts
+probe/dist-bin
+probe/vendor
+probe/bun.lock
+docs/apps/design/gate-triage-modal/gate-triage-modal.html

.prettierignore

@@ -0,0 +1,36 @@
+node_modules
+dist
+storybook-static
+docs
+bun.lock
+packages/ui/scripts/treeshake-probe/dist
+packages/tui-kit
+apps/*/design
+apps/board/skills/*/SKILL.md
+apps/deck/core/generated
+apps/deck/src/registry/__fixtures__/deps-lock-serve.fixture.json
+packages/tokens/src/radix.ts
+packages/tokyo/src/ramps.ts
+apps/*/state
+apps/*/state.*
+apps/*/src/server/embedded/manifest.ts
+# rt's own code keeps rt's style (double quotes); prettier is the apps' tool
+/cli.ts
+/test-setup.ts
+/test-timings.json
+/tsconfig.json
+/lib
+/commands
+/e2e
+/scripts
+/skills
+/marketplace
+/extensions
+/website
+/rt-tray
+/ui
+/packages/rt-client
+/packages/settings-kit
+/packages/git-core
+/.github
+/*.md

.prettierrc

@@ -0,0 +1,17 @@
+{
+  "endOfLine": "lf",
+  "semi": true,
+  "singleQuote": true,
+  "arrowParens": "avoid",
+  "tabWidth": 2,
+  "trailingComma": "es5",
+  "plugins": ["@ianvs/prettier-plugin-sort-imports"],
+  "importOrder": [
+    "^(react/(.*)$)|^(react$)",
+    "<THIRD_PARTY_MODULES>",
+    "",
+    "^@mattstack/(.*)$",
+    "^[./]"
+  ],
+  "importOrderParserPlugins": ["typescript", "jsx"]
+}

.storybook/main.ts

@@ -0,0 +1,19 @@
+import type { StorybookConfig } from '@storybook/react-vite';
+
+const config: StorybookConfig = {
+  stories: [
+    '../stories/**/*.mdx',
+    '../stories/**/*.stories.@(ts|tsx)',
+    '../packages/ui/src/**/*.mdx',
+    '../packages/ui/src/**/*.stories.@(js|jsx|mjs|ts|tsx)',
+    '../apps/console/src/**/*.stories.@(ts|tsx)',
+    '../apps/board/src/**/*.stories.@(ts|tsx)',
+  ],
+  addons: [
+    '@chromatic-com/storybook',
+    '@storybook/addon-a11y',
+    '@storybook/addon-docs',
+  ],
+  framework: '@storybook/react-vite',
+};
+export default config;