extract fuz_app

.cargo/config.toml

@@ -0,0 +1,2 @@
+[alias]
+xtask = "run --package xtask --"

.env.development.example

@@ -0,0 +1,45 @@
+# Development environment
+# Copy to .env.development (or run: cargo xtask dev-setup)
+
+# Runtime environment
+NODE_ENV=development
+
+# Zzz app directory (config, state, cache, runtime)
+PUBLIC_ZZZ_DIR="./.zzz"
+
+# Comma-separated filesystem paths Zzz can access (e.g., "./projects,~/code")
+PUBLIC_ZZZ_SCOPED_DIRS="./src/test/fs1,./src/test/fs2"
+
+# Server port — zzz_server itself reads ZZZ_PORT/--port and always binds
+# loopback (no HOST override). This PORT is read by the `zzz` CLI when
+# picking the daemon port; `cargo xtask dev` forces 4461 (the Vite proxy target).
+PORT=4461
+
+# Frontend SvelteKit env vars (used by $env/static/public in constants.ts)
+PUBLIC_ZZZ_SERVER_PROTOCOL=http
+PUBLIC_ZZZ_SERVER_HOST=localhost
+PUBLIC_ZZZ_SERVER_PORT=5173
+PUBLIC_ZZZ_SERVER_API_PATH="/api"
+PUBLIC_ZZZ_SERVER_PROXIED_PORT=4461
+PUBLIC_ZZZ_WEBSOCKET_URL=ws://localhost:4461/api/ws
+
+# Debug delay in milliseconds for API responses (0 = no delay)
+PUBLIC_ZZZ_BACKEND_ARTIFICIAL_DELAY=0
+
+# Database — PostgreSQL (the Rust backend connects via tokio-postgres)
+DATABASE_URL=postgres://localhost/zzz
+
+# Auth - cookie signing key (generate with: openssl rand -base64 32)
+SECRET_FUZ_COOKIE_KEYS=dev-only-not-for-production-use-000
+
+# Security - allowed origins for API requests
+# Patterns: https://example.com, https://*.example.com, http://localhost:*
+FUZ_ALLOWED_ORIGINS=http://localhost:*
+
+# Bootstrap token path (for initial admin account creation)
+FUZ_BOOTSTRAP_TOKEN_PATH=.zzz/bootstrap_token
+
+# AI provider API keys (optional, for remote providers)
+SECRET_OPENAI_API_KEY=
+SECRET_ANTHROPIC_API_KEY=
+SECRET_GOOGLE_API_KEY=

.env.production.example

@@ -0,0 +1,39 @@
+# Production environment
+# Copy to .env.production (or run: cargo xtask prod-setup)
+
+# Zzz app directory (config, state, cache, runtime)
+PUBLIC_ZZZ_DIR="./.zzz"
+
+# Comma-separated filesystem paths Zzz can access
+PUBLIC_ZZZ_SCOPED_DIRS=
+
+# Server port — zzz_server reads ZZZ_PORT/--port (default 4460) and always
+# binds loopback (no HOST override). PORT is read by the `zzz` CLI when
+# picking the daemon port.
+PORT=4460
+DATABASE_URL=postgres://localhost/zzz
+
+# Auth - cookie signing key (generate with: openssl rand -base64 32)
+SECRET_FUZ_COOKIE_KEYS=CHANGE_ME_generate_with_openssl_rand_base64_32
+
+# Security - allowed origins for API requests
+FUZ_ALLOWED_ORIGINS=http://localhost:*
+
+# Bootstrap token path (for initial admin account creation)
+# FUZ_BOOTSTRAP_TOKEN_PATH=.zzz/bootstrap_token
+
+# Frontend SvelteKit env vars (used by $env/static/public in constants.ts)
+PUBLIC_ZZZ_SERVER_PROTOCOL=http
+PUBLIC_ZZZ_SERVER_HOST=localhost
+PUBLIC_ZZZ_SERVER_PORT=4460
+PUBLIC_ZZZ_SERVER_API_PATH="/api"
+PUBLIC_ZZZ_WEBSOCKET_URL=ws://localhost:4460/api/ws
+PUBLIC_ZZZ_SERVER_PROXIED_PORT=4460
+
+# Debug delay in milliseconds for API responses (0 = no delay)
+PUBLIC_ZZZ_BACKEND_ARTIFICIAL_DELAY=0
+
+# AI provider API keys (optional, for remote providers)
+SECRET_OPENAI_API_KEY=
+SECRET_ANTHROPIC_API_KEY=
+SECRET_GOOGLE_API_KEY=

.github/workflows/check.yml

@@ -8,23 +8,48 @@ on:
     branches: [main]
   pull_request:
     branches: ['**']
+  # Allow manually re-running the check from the Actions tab.
+  workflow_dispatch:
+
+# Cancel a PR's in-progress run when a new commit supersedes it; let main-branch
+# runs finish so every commit on main stays verified.
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+# Least privilege: the check only reads the repo.
+permissions:
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     strategy:
       matrix:
-        node-version: ['22.15']
+        node-version: ['24.14']
 
     steps:
-      - uses: actions/checkout@v2
+      # persist-credentials: false keeps the GITHUB_TOKEN out of .git/config, so a
+      # compromised build dependency can't read it. If you add a step that pushes
+      # via git (deploy, tag, generated commit), set this back to true or
+      # authenticate that step explicitly.
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ matrix.node-version }}
+          cache: npm
       - run: npm ci
-      - run: cp src/lib/server/.env.development.example .env.development
-      - run: cp src/lib/server/.env.production.example .env.production
+      - run: cp .env.development.example .env.development
+      - run: cp .env.production.example .env.production
       - run: npx svelte-kit sync
       - run: npx @fuzdev/gro check --workspace --build
+
+  # The cross-backend wire-contract suites (cross_backend_rust / _proxy) run
+  # against the Rust `zzz_server`. They need a sibling Rust workspace checkout, a
+  # Postgres service, and a cached cargo build, so they run locally
+  # (`npm run test:cross`) rather than in CI for now.

.gitignore

@@ -22,6 +22,10 @@ target/
 *.pem
 id_rsa
 
+# Local (per-machine, never shared)
+*.local
+*.local.*
+
 # Ignore
 *.ignore
 *.ignore.*
@@ -39,6 +43,9 @@ tmp/
 # Workflow
 /worktree
 
+# Benchmark run artifacts (per-run, machine-specific timings)
+/src/benchmarks/cross_impl.latest.json
+
 # Os
 .DS_Store
 Thumbs.db