v0.7.62: file handling, mothership async runs, heic support, file hardening, general ui improvements

.agents/skills/add-column-type/SKILL.md

@@ -15,7 +15,7 @@ This was not always true: adding `currency` originally took ~40 edits across 32
 Do **not** hunt for places to edit. Add your type to the `ColumnType` union first and let `tsc` produce the list:
 
 ```bash
-cd apps/sim && bunx tsc --noEmit -p tsconfig.json
+cd apps/sim && bun run type-check
 ```
 
 You will get two errors, naming `column-types/registry.ts` and `column-types/registry.server.ts`. Register in both.
@@ -153,7 +153,7 @@ Registering the *type* is compiler-enforced. Registering its *metadata* is not,
 
 ## Final Validation (Required)
 
-1. **`cd apps/sim && bunx tsc --noEmit -p tsconfig.json`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
+1. **`cd apps/sim && bun run type-check`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
 2. **Grep for leaks** — `grep -rnE "(===|!==) '{id}'|case '{id}':" apps/sim --include='*.ts' --include='*.tsx' | grep -v column-types/`. (All three forms: a plain `!==` and a `case` are how half of `currency`'s real branches are written.) Hits are expected; judge each. A hit is fine when it mounts a specific React component or encodes a genuinely one-off behavior (`json`'s mono textarea, `date`'s timezone-aware parsing). A hit is a **leak** when it restates something the registry could answer — an icon, a label, a colour, an operator set, a cast, a coercion. Leaks get a registry field, not a new branch.
 3. **Run the suite** — `bunx vitest run lib/table 'app/workspace/[workspaceId]/tables' lib/api app/api/table app/api/v1 lib/copilot/tools/server/table`. Existing tests must pass **unchanged**; needing to edit one means you changed behavior for the other types.
 4. **`bun run lint:check`, `bun run check:api-validation`, `bun run check:client-boundary`** from the repo root.

.agents/skills/add-enrichment/SKILL.md

@@ -128,7 +128,7 @@ export const ENRICHMENT_REGISTRY: EnrichmentRegistry = {
 
 ## Step 5: Verify
 
-1. `bunx tsc --noEmit` (from `apps/sim`, `NODE_OPTIONS=--max-old-space-size=8192`) and `bunx biome check` on the changed files.
+1. `bun run type-check` (from `apps/sim`) and `bunx biome check` on the changed files.
 2. In a table → **+ New column → Enrichments** → pick the new enrichment, map its inputs to columns, name the output column(s), Save. Confirm it appears in the catalog with its icon/description.
 3. With hosted keys (or a workspace BYOK key) configured for each provider's service, run a row and confirm the cell fills; the dev-server log shows `Enrichment hit { provider }`. A row whose providers all miss completes blank; a row where every provider errored shows an error cell.
 

.agents/skills/ship/SKILL.md

@@ -65,21 +65,10 @@ When the user runs `/ship`:
     echo "❌ block registry audit failed — do not ship"
     exit 1
   }
-  rm -f /tmp/ship-audit-results
-  for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
-           check:utils check:zustand-v5 \
-           check:react-query check:client-boundary check:bare-icons check:icon-paths \
-           check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
-           tool-metadata:check \
-           integration-catalog:check skills:check agent-stream-docs:check; do
-    ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
-  done
-  wait
-  # any non-zero line is a failing audit — read its /tmp/ship-audit-<name>.log and fix before shipping.
-  # `exit 1` on failure preserves the original sequential checks' semantics (their non-zero exit is
-  # what an agent gates on); never use `grep … && echo ❌ || echo ✅` here — it always exits 0.
-  if grep -vE '^0 ' /tmp/ship-audit-results; then echo "❌ audit(s) failed — do not ship"; exit 1; fi
-  echo "✅ all audits passed"
+  # Runs every audit CI runs, concurrently, and replays the output of any that fail.
+  # Do not hand-list the audits here: the list is derived in scripts/run-audits.ts, and the
+  # copy that used to live in this file had already drifted five audits behind package.json.
+  bun run check:audits || { echo "❌ audit(s) failed — do not ship"; exit 1; }
   ```
   If Phase A regenerated a file, its matching `:check` in Phase B now passes trivially — that parity is the point. Do not ship with any generator or audit failing; fix the cause (never silence it) and re-run. `check:migrations` and `type-check` are covered by steps 5 and CI respectively and are not repeated here.
 7. **Stage and commit** the changes with the generated message — including any files Phase A regenerated in step 6

.claude/commands/add-column-type.md

@@ -14,7 +14,7 @@ This was not always true: adding `currency` originally took ~40 edits across 32
 Do **not** hunt for places to edit. Add your type to the `ColumnType` union first and let `tsc` produce the list:
 
 ```bash
-cd apps/sim && bunx tsc --noEmit -p tsconfig.json
+cd apps/sim && bun run type-check
 ```
 
 You will get two errors, naming `column-types/registry.ts` and `column-types/registry.server.ts`. Register in both.
@@ -152,7 +152,7 @@ Registering the *type* is compiler-enforced. Registering its *metadata* is not,
 
 ## Final Validation (Required)
 
-1. **`cd apps/sim && bunx tsc --noEmit -p tsconfig.json`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
+1. **`cd apps/sim && bun run type-check`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
 2. **Grep for leaks** — `grep -rnE "(===|!==) '{id}'|case '{id}':" apps/sim --include='*.ts' --include='*.tsx' | grep -v column-types/`. (All three forms: a plain `!==` and a `case` are how half of `currency`'s real branches are written.) Hits are expected; judge each. A hit is fine when it mounts a specific React component or encodes a genuinely one-off behavior (`json`'s mono textarea, `date`'s timezone-aware parsing). A hit is a **leak** when it restates something the registry could answer — an icon, a label, a colour, an operator set, a cast, a coercion. Leaks get a registry field, not a new branch.
 3. **Run the suite** — `bunx vitest run lib/table 'app/workspace/[workspaceId]/tables' lib/api app/api/table app/api/v1 lib/copilot/tools/server/table`. Existing tests must pass **unchanged**; needing to edit one means you changed behavior for the other types.
 4. **`bun run lint:check`, `bun run check:api-validation`, `bun run check:client-boundary`** from the repo root.

.claude/commands/add-enrichment.md

@@ -127,7 +127,7 @@ export const ENRICHMENT_REGISTRY: EnrichmentRegistry = {
 
 ## Step 5: Verify
 
-1. `bunx tsc --noEmit` (from `apps/sim`, `NODE_OPTIONS=--max-old-space-size=8192`) and `bunx biome check` on the changed files.
+1. `bun run type-check` (from `apps/sim`) and `bunx biome check` on the changed files.
 2. In a table → **+ New column → Enrichments** → pick the new enrichment, map its inputs to columns, name the output column(s), Save. Confirm it appears in the catalog with its icon/description.
 3. With hosted keys (or a workspace BYOK key) configured for each provider's service, run a row and confirm the cell fills; the dev-server log shows `Enrichment hit { provider }`. A row whose providers all miss completes blank; a row where every provider errored shows an error cell.
 

.claude/commands/ship.md

@@ -64,21 +64,10 @@ When the user runs `/ship`:
     echo "❌ block registry audit failed — do not ship"
     exit 1
   }
-  rm -f /tmp/ship-audit-results
-  for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
-           check:utils check:zustand-v5 \
-           check:react-query check:client-boundary check:bare-icons check:icon-paths \
-           check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
-           tool-metadata:check \
-           integration-catalog:check skills:check agent-stream-docs:check; do
-    ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
-  done
-  wait
-  # any non-zero line is a failing audit — read its /tmp/ship-audit-<name>.log and fix before shipping.
-  # `exit 1` on failure preserves the original sequential checks' semantics (their non-zero exit is
-  # what an agent gates on); never use `grep … && echo ❌ || echo ✅` here — it always exits 0.
-  if grep -vE '^0 ' /tmp/ship-audit-results; then echo "❌ audit(s) failed — do not ship"; exit 1; fi
-  echo "✅ all audits passed"
+  # Runs every audit CI runs, concurrently, and replays the output of any that fail.
+  # Do not hand-list the audits here: the list is derived in scripts/run-audits.ts, and the
+  # copy that used to live in this file had already drifted five audits behind package.json.
+  bun run check:audits || { echo "❌ audit(s) failed — do not ship"; exit 1; }
   ```
   If Phase A regenerated a file, its matching `:check` in Phase B now passes trivially — that parity is the point. Do not ship with any generator or audit failing; fix the cause (never silence it) and re-run. `check:migrations` and `type-check` are covered by steps 5 and CI respectively and are not repeated here.
 7. **Stage and commit** the changes with the generated message — including any files Phase A regenerated in step 6

.claude/rules/global.md

@@ -65,3 +65,10 @@ const filtered = filterUndefined(obj)
 
 ## Package Manager
 Use `bun` and `bunx`, not `npm` and `npx`.
+
+## Type-checking
+`tsc` must resolve to the native (Go) TypeScript 7 compiler. Do not remove the `@typescript/native` alias from the root `devDependencies` — nothing imports it, and deleting it looks harmless.
+
+`apps/sim` needs `@typescript/typescript6` for its runtime TypeScript API, and that package depends on `@typescript/old` — an alias of `typescript@6` — which declares its own `tsc` bin. Package managers pick bin winners by lexical sort rather than dependency depth, so `@typescript/old` beats `typescript` and `node_modules/.bin/tsc` silently becomes the JavaScript TypeScript 6 compiler: identical diagnostics, ~10x slower (83s vs 8s on `apps/sim`). The `@typescript/native` alias exists only to sort ahead of `@typescript/old`.
+
+`bun run check:native-typecheck` fails the build if a bare `tsc` stops reporting 7.x — which is also what a newly added package that sorts ahead of `@typescript/native` and ships a `tsc` bin would look like. See [microsoft/typescript-go#4567](https://github.com/microsoft/typescript-go/issues/4567).

.claude/skills/add-settings-page/SKILL.md

@@ -37,7 +37,7 @@ Key paths:
    hand-roll a Save button, a `beforeunload`, or an "Unsaved changes" modal —
    they're centralized. See the "Save / Discard + unsaved-changes guard" section
    in `.claude/rules/sim-settings-pages.md`.
-5. **Verify:** `cd apps/sim && bunx tsc --noEmit`; `bunx biome check --write <file>`.
+5. **Verify:** `cd apps/sim && bun run type-check`; `bunx biome check --write <file>`.
 
 ## Mode B — Audit existing settings pages
 
@@ -76,7 +76,7 @@ For each page component, confirm the checklist in `.claude/rules/sim-settings-pa
    unless they're also being changed for an unrelated, deliberate reason.
 7. Remove now-unused imports (`ChipInput`/`Search`) ONLY after grepping that
    they are not still used elsewhere in the file (e.g. by a detail view).
-8. **Verify the whole sweep:** `tsc --noEmit`, `biome check` on every touched
+8. **Verify the whole sweep:** `bun run type-check`, `biome check` on every touched
    file, and run the affected pages' tests. Diff each file against the base and
    confirm the change is purely structural before shipping.
 
@@ -105,5 +105,5 @@ contract. Then, per page:
 7. Check what the old row rendered *beside* the title (a badge, a timestamp, a
    transport label). The row's title truncates as one unit, so anything folded
    into it can be ellipsised away — move it to `description` or `badge`.
-8. Verify: `tsc --noEmit`, `biome check`, the page's tests, and a diff read of
+8. Verify: `bun run type-check`, `biome check`, the page's tests, and a diff read of
    every converted block for lost props, conditions, and `key` placement.

.cursor/commands/add-column-type.md

@@ -9,7 +9,7 @@ This was not always true: adding `currency` originally took ~40 edits across 32
 Do **not** hunt for places to edit. Add your type to the `ColumnType` union first and let `tsc` produce the list:
 
 ```bash
-cd apps/sim && bunx tsc --noEmit -p tsconfig.json
+cd apps/sim && bun run type-check
 ```
 
 You will get two errors, naming `column-types/registry.ts` and `column-types/registry.server.ts`. Register in both.
@@ -147,7 +147,7 @@ Registering the *type* is compiler-enforced. Registering its *metadata* is not,
 
 ## Final Validation (Required)
 
-1. **`cd apps/sim && bunx tsc --noEmit -p tsconfig.json`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
+1. **`cd apps/sim && bun run type-check`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
 2. **Grep for leaks** — `grep -rnE "(===|!==) '{id}'|case '{id}':" apps/sim --include='*.ts' --include='*.tsx' | grep -v column-types/`. (All three forms: a plain `!==` and a `case` are how half of `currency`'s real branches are written.) Hits are expected; judge each. A hit is fine when it mounts a specific React component or encodes a genuinely one-off behavior (`json`'s mono textarea, `date`'s timezone-aware parsing). A hit is a **leak** when it restates something the registry could answer — an icon, a label, a colour, an operator set, a cast, a coercion. Leaks get a registry field, not a new branch.
 3. **Run the suite** — `bunx vitest run lib/table 'app/workspace/[workspaceId]/tables' lib/api app/api/table app/api/v1 lib/copilot/tools/server/table`. Existing tests must pass **unchanged**; needing to edit one means you changed behavior for the other types.
 4. **`bun run lint:check`, `bun run check:api-validation`, `bun run check:client-boundary`** from the repo root.

.cursor/commands/add-enrichment.md

@@ -122,7 +122,7 @@ export const ENRICHMENT_REGISTRY: EnrichmentRegistry = {
 
 ## Step 5: Verify
 
-1. `bunx tsc --noEmit` (from `apps/sim`, `NODE_OPTIONS=--max-old-space-size=8192`) and `bunx biome check` on the changed files.
+1. `bun run type-check` (from `apps/sim`) and `bunx biome check` on the changed files.
 2. In a table → **+ New column → Enrichments** → pick the new enrichment, map its inputs to columns, name the output column(s), Save. Confirm it appears in the catalog with its icon/description.
 3. With hosted keys (or a workspace BYOK key) configured for each provider's service, run a row and confirm the cell fills; the dev-server log shows `Enrichment hit { provider }`. A row whose providers all miss completes blank; a row where every provider errored shows an error cell.
 

.cursor/commands/ship.md

@@ -59,21 +59,10 @@ When the user runs `/ship`:
     echo "❌ block registry audit failed — do not ship"
     exit 1
   }
-  rm -f /tmp/ship-audit-results
-  for s in check:boundaries check:api-validation:strict check:desktop-bridge check:desktop-ipc \
-           check:utils check:zustand-v5 \
-           check:react-query check:client-boundary check:bare-icons check:icon-paths \
-           check:realtime-prune check:tool-registry-boundary check:tool-request-boundary \
-           tool-metadata:check \
-           integration-catalog:check skills:check agent-stream-docs:check; do
-    ( bun run "$s" >"/tmp/ship-audit-${s//:/-}.log" 2>&1; echo "$? $s" >>/tmp/ship-audit-results ) &
-  done
-  wait
-  # any non-zero line is a failing audit — read its /tmp/ship-audit-<name>.log and fix before shipping.
-  # `exit 1` on failure preserves the original sequential checks' semantics (their non-zero exit is
-  # what an agent gates on); never use `grep … && echo ❌ || echo ✅` here — it always exits 0.
-  if grep -vE '^0 ' /tmp/ship-audit-results; then echo "❌ audit(s) failed — do not ship"; exit 1; fi
-  echo "✅ all audits passed"
+  # Runs every audit CI runs, concurrently, and replays the output of any that fail.
+  # Do not hand-list the audits here: the list is derived in scripts/run-audits.ts, and the
+  # copy that used to live in this file had already drifted five audits behind package.json.
+  bun run check:audits || { echo "❌ audit(s) failed — do not ship"; exit 1; }
   ```
   If Phase A regenerated a file, its matching `:check` in Phase B now passes trivially — that parity is the point. Do not ship with any generator or audit failing; fix the cause (never silence it) and re-run. `check:migrations` and `type-check` are covered by steps 5 and CI respectively and are not repeated here.
 7. **Stage and commit** the changes with the generated message — including any files Phase A regenerated in step 6

.github/workflows/test-build.yml

@@ -117,59 +117,11 @@ jobs:
       - name: Lint code
         run: bun run lint:check
 
-      - name: Enforce monorepo boundaries
-        run: bun run check:boundaries
-
-      - name: API contract boundary audit
-        run: bun run check:api-validation:strict
-
-      - name: Desktop bridge contract audit
-        run: bun run check:desktop-bridge
-
-      # Complements the bridge audit above, which compares against a snapshot
-      # this same PR is allowed to regenerate. This one derives every fact from
-      # the source both sides execute, so it has no such blind spot.
-      - name: Desktop IPC contract audit
-        run: bun run check:desktop-ipc
-
-      - name: Shared utils enforcement audit
-        run: bun run check:utils
-
-      - name: Zustand v5 selector audit
-        run: bun run check:zustand-v5
-
-      - name: React Query pattern audit
-        run: bun run check:react-query
-
-      - name: Client boundary import audit
-        run: bun run check:client-boundary
-
-      - name: Bare-icon theme-safety audit
-        run: bun run check:bare-icons
-
-      - name: Icon SVG path validity audit
-        run: bun run check:icon-paths
-
-      - name: Verify realtime prune graph
-        run: bun run check:realtime-prune
-
-      - name: Tool registry client-boundary audit
-        run: bun run check:tool-registry-boundary
-
-      - name: Tool request transport boundary audit
-        run: bun run check:tool-request-boundary
-
-      - name: Verify generated tool metadata is in sync
-        run: bun run tool-metadata:check
-
-      - name: Verify integration deployment metadata is in sync
-        run: bun run integration-catalog:check
-
-      - name: Verify skill projections are in sync
-        run: bun run skills:check
-
-      - name: Verify agent stream capability docs are in sync
-        run: bun run agent-stream-docs:check
+      # Every zero-argument `check:*` script, run concurrently. The list is derived in
+      # scripts/run-audits.ts, which also writes the per-audit timing table to the job
+      # summary and annotates failures. Audits needing a base ref stay separate below.
+      - name: Repo audits
+        run: bun run check:audits
 
       - name: Migration safety (zero-downtime) audit
         run: |
@@ -219,21 +171,6 @@ jobs:
           fi
           echo "✅ Schema and migrations are in sync"
 
-      # DEAD PATH: nothing generates `apps/sim/coverage`. The test step runs
-      # `vitest run` without `--coverage`, and vitest.config.ts declares no
-      # coverage provider, so this uploads nothing and still reports success in
-      # ~1s (`fail_ci_if_error: false` hides it). `@vitest/coverage-v8` IS
-      # installed, so wiring it up is possible — but coverage instrumentation
-      # costs test time and nothing gates on the result today. Left in place
-      # pending a decision to either enable coverage or drop this step; do not
-      # read its green tick as "coverage was published".
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
-        with:
-          directory: ./apps/sim/coverage
-          fail_ci_if_error: false
-          verbose: true
-
   # Next.js production build, in parallel with lint + tests. Sticky disks are
   # cloned from the last committed snapshot per job and committed last-writer-
   # wins, so concurrent mounts are safe. The bun/node_modules disks are shared