refactor: refresh runtime configuration and developer tooling

.bazelrc

@@ -17,7 +17,6 @@ build --announce_rc
 
 # Show test failures immediately.
 test --test_output=errors
-test --test_verbose_timeout_warnings
 test --action_env=PATH
 test --action_env=HOME
 
@@ -26,4 +25,3 @@ coverage --combined_report=lcov
 
 # User-local overrides (output_base, remote cache, etc.).
 try-import %workspace%/.bazelrc.project
-export PATH="/Users/gabrielfonseca/.cargo/bin:/Users/gabrielfonseca/.bun/bin:/Users/gabrielfonseca/.grok/bin:/Users/gabrielfonseca/.codeium/windsurf/bin:/Users/gabrielfonseca/bin:/Users/gabrielfonseca/.antigravity/antigravity/bin:/Users/gabrielfonseca/.antigravity/antigravity/bin:/Users/gabrielfonseca/.opencode/bin:/Users/gabrielfonseca/.antigravity/antigravity/bin:/Users/gabrielfonseca/.antigravity/antigravity/bin:/Users/gabrielfonseca/.local/bin:/Users/gabrielfonseca/.bun/bin:/Users/gabrielfonseca/.nvm/versions/node/v22.22.3/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/pkg/env/global/bin:/Library/Apple/usr/bin:/opt/homebrew/bin:/Users/gabrielfonseca/.grok/bin:/Users/gabrielfonseca/.codeium/windsurf/bin:/Users/gabrielfonseca/bin:/Users/gabrielfonseca/.antigravity/antigravity/bin:/Users/gabrielfonseca/.opencode/bin:/Users/gabrielfonseca/.local/bin:/Users/gabrielfonseca/.bun/bin:/Users/gabrielfonseca/.nvm/versions/node/v22.22.3/bin:/opt/homebrew/sbin:/Users/gabrielfonseca/Library/pnpm:/Users/gabrielfonseca/.cargo/bin:/Users/gabrielfonseca/.turso:/Users/gabrielfonseca/.turso"

.env.example

@@ -40,26 +40,26 @@ OLLAMA_MODEL=llama2
 # CONFIGURATION DIRECTORIES
 # ===========================================
 
-FCODE_CONFIG_HOME=~/.frontal-code
-FCODE_HOME=~/.frontal-code
+FRONTAL_CODE_CONFIG_HOME=~/.frontal-code
+FRONTAL_CODE_HOME=~/.frontal-code
 HOME=~/
 
 # ===========================================
 # DOCKER & SERVICE CONFIGURATION
 # ===========================================
 
-FCODE_MEMORY_PINECONE_URL=https://YOUR_INDEX_HOST
-FCODE_MEMORY_PINECONE_API_KEY=your_pinecone_api_key_here
-FCODE_MEMORY_PINECONE_NAMESPACE=dev
+FRONTAL_CODE_MEMORY_PINECONE_URL=https://YOUR_INDEX_HOST
+FRONTAL_CODE_MEMORY_PINECONE_API_KEY=your_pinecone_api_key_here
+FRONTAL_CODE_MEMORY_PINECONE_NAMESPACE=dev
 
 # Docker-specific paths
-FCODE_SANDBOX_HOME=/workspace/.sandbox-home
+FRONTAL_CODE_SANDBOX_HOME=/workspace/.sandbox-home
 
 # Sandbox backend controls
 # Enable Docker fallback backend explicitly (default: disabled)
-FCODE_SANDBOX_ENABLE_DOCKER=0
-# Optional Docker image override when FCODE_SANDBOX_ENABLE_DOCKER=1
-FCODE_SANDBOX_DOCKER_IMAGE=busybox:1.36
+FRONTAL_CODE_SANDBOX_ENABLE_DOCKER=0
+# Optional Docker image override when FRONTAL_CODE_SANDBOX_ENABLE_DOCKER=1
+FRONTAL_CODE_SANDBOX_DOCKER_IMAGE=busybox:1.36
 
 # Service Configuration
 
@@ -85,17 +85,17 @@ MOCK_PARITY_REPORT_PATH=/tmp/mock_parity_report.json
 # --- frontal-code-server control plane -------------------------------------------
 # Required. Without it the server refuses to start, because every task route
 # (create/cancel/complete/approval) would accept unauthenticated requests.
-FCODE_SERVER_API_KEY=change_me
+FRONTAL_CODE_SERVER_API_KEY=change_me
 
 # Set to 1 only to deliberately run an open control plane on a trusted network.
-# FCODE_SERVER_ALLOW_ANONYMOUS=1
+# FRONTAL_CODE_SERVER_ALLOW_ANONYMOUS=1
 
 # --- Integration webhooks ---------------------------------------------------
-# One secret per source, named FCODE_<SOURCE>_WEBHOOK_SECRET. A delivery to
+# One secret per source, named FRONTAL_CODE_<SOURCE>_WEBHOOK_SECRET. A delivery to
 # /v1/webhooks/<source> is rejected with 401 unless the matching secret is set
 # and the request carries a valid `x-<source>-signature` HMAC.
-FCODE_GITHUB_WEBHOOK_SECRET=change_me
-# FCODE_LINEAR_WEBHOOK_SECRET=change_me
+FRONTAL_CODE_GITHUB_WEBHOOK_SECRET=change_me
+# FRONTAL_CODE_LINEAR_WEBHOOK_SECRET=change_me
 
 # ===========================================
 # TOOLS.FRONTAL.DEV CONFIGURATION
@@ -104,10 +104,10 @@ FCODE_GITHUB_WEBHOOK_SECRET=change_me
 # Frontal Code CLI configuration for tools.frontal.dev
 # Set these when using deployed infrastructure:
 # export FRONTAL_BASE_URL="https://tools.frontal.dev/frontal-code"
-# export FCODE_HOSTED_CALLBACK_URL="https://tools.frontal.dev/frontal-code/webhooks/tasks"
+# export FRONTAL_CODE_HOSTED_CALLBACK_URL="https://tools.frontal.dev/frontal-code/webhooks/tasks"
 
 # Hosted task worker configuration
-FCODE_HOSTED_TASK_FILE=/tmp/frontal-code_hosted_task.json
+FRONTAL_CODE_HOSTED_TASK_FILE=/tmp/frontal-code_hosted_task.json
 
 # ===========================================
 # OPTIONAL OVERRIDES

.frontal-code/settings.json

@@ -120,8 +120,8 @@
             "read:org",
             "workflow"
           ],
-          "client_id_env": "FCODE_GITHUB_CLIENT_ID",
-          "client_secret_env": "FCODE_GITHUB_CLIENT_SECRET"
+          "client_id_env": "FRONTAL_CODE_GITHUB_CLIENT_ID",
+          "client_secret_env": "FRONTAL_CODE_GITHUB_CLIENT_SECRET"
         }
       },
       "linear": {
@@ -138,8 +138,8 @@
             "issues:create",
             "comments:create"
           ],
-          "client_id_env": "FCODE_LINEAR_CLIENT_ID",
-          "client_secret_env": "FCODE_LINEAR_CLIENT_SECRET"
+          "client_id_env": "FRONTAL_CODE_LINEAR_CLIENT_ID",
+          "client_secret_env": "FRONTAL_CODE_LINEAR_CLIENT_SECRET"
         }
       },
       "graphite": {
@@ -154,8 +154,8 @@
             "stacks:write",
             "comments:write"
           ],
-          "client_id_env": "FCODE_GRAPHITE_CLIENT_ID",
-          "client_secret_env": "FCODE_GRAPHITE_CLIENT_SECRET"
+          "client_id_env": "FRONTAL_CODE_GRAPHITE_CLIENT_ID",
+          "client_secret_env": "FRONTAL_CODE_GRAPHITE_CLIENT_SECRET"
         }
       },
       "slack": {
@@ -170,16 +170,16 @@
             "chat:write",
             "channels:read"
           ],
-          "client_id_env": "FCODE_SLACK_CLIENT_ID",
-          "client_secret_env": "FCODE_SLACK_CLIENT_SECRET"
+          "client_id_env": "FRONTAL_CODE_SLACK_CLIENT_ID",
+          "client_secret_env": "FRONTAL_CODE_SLACK_CLIENT_SECRET"
         }
       }
     }
   },
   "plugins": {
     "auto_load": [],
     "enabled": true,
-    "plugins_dir": "${FCODE_CONFIG_DIR:-${HOME}/.frontal-code}/plugins",
+    "plugins_dir": "${FRONTAL_CODE_CONFIG_DIR:-${HOME}/.frontal-code}/plugins",
     "registry_url": "https://plugins.frontal-code.ai",
     "trusted_sources": [
       "https://github.com",

.github/workflows/benchmarks.yml

@@ -17,8 +17,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Rust toolchain
-        name: Install pinned Rust toolchain
+      - name: Install pinned Rust toolchain
         run: rustup show
 
       - name: Cache cargo registry

.github/workflows/dependencies.yml

@@ -23,8 +23,7 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Rust toolchain
-        name: Install pinned Rust toolchain
+      - name: Install pinned Rust toolchain
         run: rustup show
 
       - name: Update dependencies
@@ -64,8 +63,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Rust toolchain
-        name: Install pinned Rust toolchain
+      - name: Install pinned Rust toolchain
         run: rustup show
 
       - name: Check outdated dependencies
@@ -76,5 +74,5 @@ jobs:
 
       - name: Check for security advisories
         run: |
-          cargo install cargo-audit
+          cargo install cargo-audit --locked
           cargo audit

.github/workflows/npm-cli.yml

@@ -1,6 +1,7 @@
 name: Frontal Code CLI npm
 
 on:
+  push:
     branches: [main]
     paths:
       - '.github/workflows/npm-cli.yml'

.github/workflows/security.yml

@@ -19,19 +19,19 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Rust toolchain
-        name: Install pinned Rust toolchain
+      - name: Install pinned Rust toolchain
         run: rustup show
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 20
 
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+
       - name: Run cargo audit
-        uses: rustsec/audit-check@v1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+        run: cargo audit
 
       - name: Run npm audit for Slack extension
         working-directory: extensions/frontal-code-slack
@@ -49,4 +49,3 @@ jobs:
         uses: actions/dependency-review-action@v4
         with:
           fail-on-severity: critical
-

.gitignore

@@ -35,8 +35,9 @@ extensions/frontal-code-slack/node_modules/
 # Bazel (Bzlmod)
 .bazelrc.project
 coverage/
+!tools/coverage/
+!tools/coverage/**
 bazel-bin
 bazel-out
 bazel-testlogs
 bazel-frontal-code
-

.pre-commit-config.yaml

@@ -2,16 +2,14 @@ repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v4.5.0
     hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
       - id: check-yaml
+        args: [--allow-multiple-documents]
       - id: check-added-large-files
         args: ['--maxkb=1000']
       - id: check-merge-conflict
       - id: check-toml
       - id: check-json
       - id: check-executables-have-shebangs
-      - id: check-shebang-scripts-are-executable
       - id: mixed-line-ending
 
   - repo: https://github.com/doublify/pre-commit-rust
@@ -21,30 +19,10 @@ repos:
         args: ['--workspace', '--all-targets', '--all-features']
       - id: clippy
         args: ['--workspace', '--all-targets', '--all-features', '--', '-D', 'warnings']
-      - id: rust-fmt
+      - id: fmt
         args: ['--']
 
-  - repo: https://github.com/codespell-project/codespell
-    rev: v2.2.6
-    hooks:
-      - id: codespell
-        args:
-          - '--ignore-words-list=crate,serde,clippy,struct,impl,fn,mut,async,await'
-          - '--skip=*.lock,*.sum,target/,Cargo.lock'
-
-  - repo: https://github.com/r0x0r/pre-commit-rustsec
-    rev: v1.0.0
-    hooks:
-      - id: cargo-audit
-        args: ['--workspace']
-
   # --- Bazel / polyglot tooling (added by the Bzlmod migration) ---------------
-  - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: v0.41.0
-    hooks:
-      - id: markdownlint
-        files: '.*\.md$'
-
   - repo: https://github.com/editorconfig-checker/editorconfig-checker.python
     rev: 2.7.3
     hooks:
@@ -57,33 +35,6 @@ repos:
 
   # --- Biome (Ultracite preset) for TS/JS/JSON/YAML formatting & lint ------
   # Replaces prettier: Biome is the single formatter/linter for the monorepo's
-  # TypeScript and JavaScript surface (including the Frontal Code SDKs).
-  - repo: local
-    hooks:
-      - id: biome-check
-        name: biome check
-        entry: bunx @biomejs/biome check --write --no-errors-on-unmatched
-        language: system
-        types_or: [file]
-        files: '\.(ts|tsx|js|jsx|json|jsonc|ya?ml)$'
-        pass_filenames: false
-        always_run: true
-
-      - id: biome-format
-        name: biome format
-        entry: bunx @biomejs/biome format --write --no-errors-on-unmatched
-        language: system
-        types_or: [file]
-        files: '\.(ts|tsx|js|jsx|json|jsonc|ya?ml)$'
-        pass_filenames: false
-        always_run: true
-
-  - repo: https://github.com/hadolint/hadolint
-    rev: v2.12.0
-    hooks:
-      - id: hadolint
-        files: '(\.devcontainer/Dockerfile|infrastructure/docker/.*\.Dockerfile|extensions/frontal-code-slack/Dockerfile|sdks/Dockerfile|infrastructure/proxy/Dockerfile)$'
-
   - repo: local
     hooks:
       - id: cargo-test
@@ -129,12 +80,6 @@ repos:
         types: [bazel]
         pass_filenames: false
 
-      - id: actionlint
-        name: actionlint
-        entry: actionlint
-        language: system
-        files: '^\.github/workflows/.*\.(ya?ml)$'
-
       - id: renovate-config-validator
         name: renovate config validator
         entry: npx --yes --package renovate -- renovate-config-validator renovate.json

BUILD

@@ -1,6 +1,11 @@
 package(default_visibility = ["//visibility:public"])
 
-exports_files(["MODULE.bazel"])
+exports_files([
+    "MODULE.bazel",
+    ".gitignore",
+    "biome.json",
+    "ultracite.json",
+])
 
 # Buildifier from @buildifier_prebuilt, exposed for Bazel formatter targets.
 alias(
@@ -23,6 +28,7 @@ filegroup(
         "//:.cargo/config.toml",
         "//:rust-toolchain.toml",
         "//crates:all_crates",
+        "//crates/plugins:bundled_plugins",
         "//examples:srcs",
         "//sdks/rust:rust_sdk_srcs",
         "//tests:all_test_crates",

CONFIGURATION.md

@@ -144,8 +144,8 @@ The main configuration file is `config/project.json`:
 
 The system looks for `project.json` in this order:
 
-1. `$FCODE_CONFIG_HOME/project.json` - Custom config directory
-2. `$FCODE_HOME/project.json` - Frontal Code home directory  
+1. `$FRONTAL_CODE_CONFIG_HOME/project.json` - Custom config directory
+2. `$FRONTAL_CODE_HOME/project.json` - Frontal Code home directory
 3. `~/.frontal-code/project.json` - User's home directory
 4. `config/project.json` - Project-local configuration
 
@@ -200,20 +200,20 @@ Environment variables override configuration file settings:
 ### Core Configuration Overrides
 ```bash
 # Runtime settings
-export FCODE_DEFAULT_PROVIDER="openai"
+export FRONTAL_CODE_DEFAULT_PROVIDER="openai"
 export RUSTY_CLAUDE_PERMISSION_MODE="workspace-write"
-export FCODE_LOG_LEVEL="debug"
+export FRONTAL_CODE_LOG_LEVEL="debug"
 
 # Feature flags
-export FCODE_ENABLE_TELEMETRY="false"
-export FCODE_ENABLE_PLUGINS="true"
-export FCODE_ENABLE_CACHING="true"
+export FRONTAL_CODE_ENABLE_TELEMETRY="false"
+export FRONTAL_CODE_ENABLE_PLUGINS="true"
+export FRONTAL_CODE_ENABLE_CACHING="true"
 
 # Paths
-export FCODE_CONFIG_HOME="/custom/config/path"
-export FCODE_HOME="/custom/frontal-code/home"
-export FCODE_CACHE_DIR="/custom/cache"
-export FCODE_LOGS_DIR="/custom/logs"
+export FRONTAL_CODE_CONFIG_HOME="/custom/config/path"
+export FRONTAL_CODE_HOME="/custom/frontal-code/home"
+export FRONTAL_CODE_CACHE_DIR="/custom/cache"
+export FRONTAL_CODE_LOGS_DIR="/custom/logs"
 ```
 
 ### API Provider Variables
@@ -238,8 +238,8 @@ export FRONTAL_BASE_URL="https://ai.frontal.dev/v1"
 ### Service Variables
 ```bash
 # Memory/Pinecone
-export FCODE_MEMORY_PINECONE_URL="https://index.pinecone.io"
-export FCODE_MEMORY_PINECONE_API_KEY="..."
+export FRONTAL_CODE_MEMORY_PINECONE_URL="https://index.pinecone.io"
+export FRONTAL_CODE_MEMORY_PINECONE_API_KEY="..."
 ```
 
 ## Legacy Runtime Configuration