Sync to upstream e63fe2e, and narrow the TS/JS patch layer to what upstream leaves

.github/workflows/release.yml

@@ -17,7 +17,18 @@ name: Release
 # distributes only via GitHub Releases and never pushes back to a protected
 # branch, so no RELEASE_PAT / NPM_TOKEN / OIDC secret is needed.
 on:
-  workflow_dispatch: {}
+  workflow_dispatch:
+    inputs:
+      prerelease:
+        description: >-
+          Cut this as a prerelease. GitHub's "latest release" is the most recent
+          NON-prerelease, and both install.sh and `codegraph upgrade` resolve
+          through it — so a prerelease reaches only whoever is told its exact
+          version, and nobody is upgraded into it. Use it to put a build in a
+          reviewer's hands before the branch merges; promote afterwards with
+          `gh release edit <tag> --prerelease=false --latest`, no rebuild.
+        type: boolean
+        default: false
 
 permissions:
   contents: write   # create the GitHub Release + tag
@@ -30,8 +41,11 @@ jobs:
   # needs its platform C toolchain (the GitHub runner images ship one, plus
   # rustup; build-kernel.sh adds each cross target itself). Unchanged from upstream.
   kernel:
-    # Only cut releases from main — guards against dispatching from a stray branch.
-    if: github.ref == 'refs/heads/main'
+    # A RELEASE may only be cut from main — that is what guards against a stray
+    # branch becoming everyone's next upgrade. A PRERELEASE is exempt: it is not
+    # anyone's upgrade target, and being able to build one from the branch under
+    # review is the point — main stays untouched while the build is tried.
+    if: github.ref == 'refs/heads/main' || inputs.prerelease
     strategy:
       fail-fast: false
       matrix:
@@ -61,7 +75,8 @@ jobs:
           if-no-files-found: error
 
   release:
-    if: github.ref == 'refs/heads/main'
+    # Same rule as the kernel job above.
+    if: github.ref == 'refs/heads/main' || inputs.prerelease
     runs-on: ubuntu-latest
     needs: kernel
     steps:
@@ -116,8 +131,33 @@ jobs:
           cat release/SHA256SUMS
 
       - name: Release notes
+        # The base is NOT named here. It moves every sync, a literal goes stale
+        # silently, and one did: every release from v1.6.0 on said "v1.5.0".
+        # FORK.md carries the pinned base, and it is read from this same commit.
         run: |
-          printf 'FM-Agent maintenance fork of codegraph (base: upstream v1.5.0).\n\nSelf-contained per-OS bundles (mac/linux/windows, arm64/x64) carrying the native Rust extraction kernel.\nSee FORK.md for the pinned base and the fork policy.\n' > notes.md
+          {
+            echo 'FM-Agent maintenance fork of [codegraph](https://github.com/colbymchenry/codegraph).'
+            echo
+            echo 'Self-contained per-OS bundles (mac/linux/windows, arm64/x64) carrying the'
+            echo 'native Rust extraction kernel. FORK.md at this tag records the pinned'
+            echo 'upstream base and every patch carried on top of it.'
+          } > notes.md
+          if [ "${{ inputs.prerelease }}" = "true" ]; then
+            {
+              echo
+              echo '## Prerelease'
+              echo
+              echo 'Not an upgrade target: `install.sh` and `codegraph upgrade` resolve through'
+              echo "GitHub's latest release, which skips prereleases, so nothing moves onto this"
+              echo 'build on its own. Install it by exact version:'
+              echo
+              echo '```'
+              echo "CODEGRAPH_VERSION=v${{ steps.ver.outputs.version }} bash <(curl -fsSL https://raw.githubusercontent.com/${{ github.repository }}/${{ github.sha }}/install.sh)"
+              echo '```'
+              echo
+              echo "Built from \`${{ github.ref_name }}\` at \`${{ github.sha }}\`."
+            } >> notes.md
+          fi
           cat notes.md
 
       - name: Create GitHub Release
@@ -133,5 +173,6 @@ jobs:
             gh release upload "$TAG" release/codegraph-* release/SHA256SUMS --clobber
           else
             gh release create "$TAG" release/codegraph-* release/SHA256SUMS \
-              --target "$GITHUB_SHA" --title "$TAG" --notes-file notes.md
+              --target "$GITHUB_SHA" --title "$TAG" --notes-file notes.md \
+              ${{ inputs.prerelease && '--prerelease' || '' }}
           fi

.gitignore

@@ -4,6 +4,9 @@ node_modules/
 # Build output
 dist/
 
+# svelte-package's scratch dir (ui/ library build)
+.svelte-kit/
+
 .cmem
 
 # IDE
@@ -79,3 +82,8 @@ target-linux/
 .kommandr/kommandr.db
 .kommandr/kommandr.db-wal
 .kommandr/kommandr.db-shm
+
+# Stray git bundles from the Windows VM transfer (a lost `:` in an scp target
+# once committed three of these, 7.9 MB, into a feature branch).
+*.bundle
+*.gitbundle