Chore/actions cleanup

.github/workflows/beta.yml

@@ -2,8 +2,6 @@ name: beta
 
 on:
   workflow_dispatch:
-  schedule:
-    - cron: "0 * * * *"
 
 jobs:
   sync:

.github/workflows/branding-check.yml

@@ -4,8 +4,7 @@ on:
   push:
     branches:
       - main
-      - dev
-  pull_request:
+  workflow_dispatch:
 
 permissions:
   contents: read

.github/workflows/close-issues.yml

@@ -1,8 +1,6 @@
 name: close-issues
 
 on:
-  schedule:
-    - cron: "0 2 * * *" # Daily at 2:00 AM
   workflow_dispatch:
 
 jobs:

.github/workflows/close-prs.yml

@@ -1,8 +1,6 @@
 name: close-prs
 
 on:
-  schedule:
-    - cron: "0 22 * * *" # Daily at 10:00 PM UTC
   workflow_dispatch:
     inputs:
       dry-run:

.github/workflows/compliance-close.yml

@@ -1,9 +1,6 @@
 name: compliance-close
 
 on:
-  schedule:
-    # Run every 30 minutes to check for expired compliance windows
-    - cron: "*/30 * * * *"
   workflow_dispatch:
 
 permissions:

.github/workflows/containers.yml

@@ -3,7 +3,7 @@ name: containers
 on:
   push:
     branches:
-      - dev
+      - main
     paths:
       - packages/containers/**
       - .github/workflows/containers.yml

.github/workflows/deploy.yml

@@ -3,8 +3,7 @@ name: deploy
 on:
   push:
     branches:
-      - dev
-      - production
+      - main
   workflow_dispatch:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}

.github/workflows/desktop-build.yml

@@ -9,14 +9,10 @@ name: desktop-build
 # Linux packages are unsigned here.
 
 on:
+  # Only the dev->main merge (push to main); ad-hoc runs via workflow_dispatch.
   push:
     branches:
       - main
-      # W-01 §2.2.6 trigger extension: exercise the Windows packaging path on
-      # the dev mainline too (windows targets only, no release publishing — the
-      # release job stays main-only), so NSIS + Trusted Signing + the packaged
-      # smoke regress on every dev push instead of only at release time.
-      - dev
   workflow_dispatch:
     inputs:
       channel:

.github/workflows/docs-locale-sync.yml

@@ -3,7 +3,7 @@ name: docs-locale-sync
 on:
   push:
     branches:
-      - dev
+      - main
     paths:
       - packages/web/src/content/docs/*.mdx
 

.github/workflows/docs-update.yml

@@ -1,8 +1,6 @@
 name: docs-update
 
 on:
-  schedule:
-    - cron: "0 */12 * * *"
   workflow_dispatch:
 
 env:

.github/workflows/duplicate-issues.yml

@@ -1,8 +1,7 @@
 name: duplicate-issues
 
 on:
-  issues:
-    types: [opened, edited]
+  workflow_dispatch:
 
 jobs:
   check-duplicates:

.github/workflows/generate.yml

@@ -3,7 +3,8 @@ name: generate
 on:
   push:
     branches:
-      - dev
+      - main
+  workflow_dispatch:
 
 jobs:
   generate:

.github/workflows/nix-eval.yml

@@ -2,9 +2,7 @@ name: nix-eval
 
 on:
   push:
-    branches: [dev]
-  pull_request:
-    branches: [dev]
+    branches: [main]
   workflow_dispatch:
 
 concurrency:

.github/workflows/nix-hashes.yml

@@ -6,7 +6,7 @@ permissions:
 on:
   workflow_dispatch:
   push:
-    branches: [dev, beta]
+    branches: [main]
     paths:
       - "bun.lock"
       - "package.json"

.github/workflows/pr-management.yml

@@ -1,8 +1,7 @@
 name: pr-management
 
 on:
-  pull_request_target:
-    types: [opened]
+  workflow_dispatch:
 
 jobs:
   add-contributor-label:

.github/workflows/pr-routing.yml

@@ -1,8 +1,7 @@
 name: pr-routing
 
 on:
-  pull_request_target:
-    types: [opened, reopened, edited, synchronize, ready_for_review]
+  workflow_dispatch:
 
 permissions:
   contents: read

.github/workflows/pr-standards.yml

@@ -1,8 +1,7 @@
 name: pr-standards
 
 on:
-  pull_request_target:
-    types: [opened, edited, synchronize]
+  workflow_dispatch:
 
 jobs:
   check-standards:

.github/workflows/publish.yml

@@ -2,13 +2,11 @@ name: publish
 run-name: "${{ format('release {0}', inputs.bump) }}"
 
 on:
+  # Only the dev->main merge (push to main) builds; releases themselves are
+  # workflow_dispatch with an explicit version.
   push:
     branches:
-      - ci
-      - dev
-      - beta
-      - fix/npm-native-binary-install
-      - snapshot-*
+      - main
   workflow_dispatch:
     inputs:
       bump:

.github/workflows/release-github-action.yml

@@ -3,7 +3,7 @@ name: release-github-action
 on:
   push:
     branches:
-      - dev
+      - main
     paths:
       - "github/**"
 

.github/workflows/stats.yml

@@ -1,9 +1,7 @@
 name: stats
 
 on:
-  schedule:
-    - cron: "0 12 * * *" # Run daily at 12:00 UTC
-  workflow_dispatch: # Allow manual trigger
+  workflow_dispatch:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 

.github/workflows/storybook.yml

@@ -2,15 +2,7 @@ name: storybook
 
 on:
   push:
-    branches: [dev]
-    paths:
-      - ".github/workflows/storybook.yml"
-      - "package.json"
-      - "bun.lock"
-      - "packages/storybook/**"
-      - "packages/ui/**"
-  pull_request:
-    branches: [dev]
+    branches: [main]
     paths:
       - ".github/workflows/storybook.yml"
       - "package.json"

.github/workflows/test.yml

@@ -3,8 +3,7 @@ name: test
 on:
   push:
     branches:
-      - dev
-  pull_request:
+      - main
   workflow_dispatch:
 
 concurrency:

.github/workflows/typecheck.yml

@@ -2,10 +2,8 @@ name: typecheck
 
 on:
   push:
-    branches: [dev]
-  # Gate every PR regardless of target branch: the typecheck baseline is easily polluted by stale
-  # worktrees/generated files, so keep it required and branch-agnostic.
-  pull_request:
+    branches:
+      - main
   workflow_dispatch:
 
 jobs:

packages/deepagent-code/src/mcp/index.ts

@@ -37,6 +37,7 @@ import { InstanceState } from "@/effect/instance-state"
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process"
 import { CrossSpawnSpawner } from "@deepagent-code/core/cross-spawn-spawner"
 import { applyEdits, modify, parse } from "jsonc-parser"
+import { Filesystem } from "@/util/filesystem"
 
 const log = Log.create({ service: "mcp" })
 const DEFAULT_TIMEOUT = 30_000
@@ -48,16 +49,17 @@ const TolerantListToolsResultSchema = ListToolsResultSchema.extend({
 // Replace one server entry in a jsonc config file in place, keeping comments and sibling keys
 // intact. Returns false when the file is absent or no longer declares that server (raced removal
 // or a shadowed origin) so the caller can surface that the plaintext may still live there.
+// Filesystem (node:fs) rather than Bun.file: this module is also bundled into the desktop's
+// Node sidecar, whose build fails on any Bun-only runtime API.
 export async function rewriteMcpEntry(origin: string, server: string, entry: ConfigMCPV1.Info): Promise<boolean> {
-  const file = Bun.file(origin)
-  if (!(await file.exists())) return false
-  const text = await file.text()
+  if (!(await Filesystem.exists(origin))) return false
+  const text = await Filesystem.readText(origin)
   const parsed = parse(text) as { mcp?: Record<string, unknown> } | undefined
   if (!parsed || typeof parsed !== "object" || !parsed.mcp || !(server in parsed.mcp)) return false
   const edits = modify(text, ["mcp", server], structuredClone(entry), {
     formattingOptions: { tabSize: 2, insertSpaces: true },
   })
-  await Bun.file(origin).write(applyEdits(text, edits))
+  await Filesystem.write(origin, applyEdits(text, edits))
   return true
 }