Release batch: Browser IDE + Inference Mesh landing + bookmark removal + dependency consolidation

.github/workflows/bump-shadow-pins.yml

@@ -7,10 +7,10 @@ name: Bump Shadow Pins
 # - context-mode npm package (plugin.json + entrypoint.sh + README.md)
 # - graphify PyPI package graphifyy (plugin.json; Dockerfile reads the pin via jq,
 #   so no Dockerfile literal to bump)
-# - zoxide, yazi, lazygit, silverbullet (GitHub release binaries pinned in Dockerfile)
+# - zoxide, yazi, lazygit, silverbullet, openvscode-server (GitHub release binaries pinned in Dockerfile)
 # - bun npm package (pinned `npm install -g` literal in Dockerfile for context-mode speed)
 # - consult-llm-mcp npm package (pinned `npm install -g` literal in Dockerfile)
-# - chrome-devtools-mcp npm package (pinned `npx` literal in entrypoint.sh)
+# - chrome-devtools-mcp npm package (Dockerfile-baked npx cache + stable bin)
 # - browser-run-mcp: @modelcontextprotocol/sdk pin in
 #   preseed/agents/claude/browser-run-mcp/package.json (baked into the image; no
 #   Dockerfile literal — the job reads/bumps the package.json pin via jq)
@@ -32,7 +32,7 @@ jobs:
   context-mode:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0
@@ -195,7 +195,7 @@ jobs:
   graphify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0
@@ -306,7 +306,7 @@ jobs:
   zoxide:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0
@@ -401,7 +401,7 @@ jobs:
   yazi:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0
@@ -496,7 +496,7 @@ jobs:
   lazygit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0
@@ -591,7 +591,7 @@ jobs:
   silverbullet:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0
@@ -683,13 +683,118 @@ jobs:
           EOF
           )"
 
+  openvscode-server:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: develop
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Compare Dockerfile pin against latest GitHub release
+        id: ver
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          CURRENT=$(grep -oP 'OPENVSCODE_VERSION="\K[^"]+' Dockerfile)
+          TAG=$(gh api repos/gitpod-io/openvscode-server/releases/latest --jq .tag_name)
+          LATEST="${TAG#openvscode-server-v}"
+          VERSION_RE='^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$'
+          if [[ ! "$CURRENT" =~ $VERSION_RE ]] || [[ ! "$LATEST" =~ $VERSION_RE ]]; then
+            echo "Invalid OpenVSCode version: current=$CURRENT latest=$LATEST" >&2
+            exit 1
+          fi
+          echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
+          echo "latest=$LATEST" >> "$GITHUB_OUTPUT"
+          if [ "$CURRENT" = "$LATEST" ]; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Already on $LATEST, nothing to do."
+          else
+            echo "Bumping $CURRENT -> $LATEST"
+          fi
+
+      - name: Skip if a branch for this version already exists
+        if: steps.ver.outputs.skip != 'true'
+        id: branch
+        env:
+          LATEST: ${{ steps.ver.outputs.latest }}
+        run: |
+          BRANCH="bump/openvscode-server-$LATEST"
+          if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
+            echo "Branch $BRANCH already exists, skipping."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Apply bump
+        if: steps.ver.outputs.skip != 'true' && steps.branch.outputs.skip != 'true'
+        run: |
+          set -euo pipefail
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+          git checkout -B "$BRANCH"
+
+          node <<'NODE'
+          const fs = require('node:fs');
+          const lat = process.env.LAT;
+          let content = fs.readFileSync('Dockerfile', 'utf-8');
+          content = content.replace(/OPENVSCODE_VERSION="[^"]+"/, `OPENVSCODE_VERSION="${lat}"`);
+          content = content.replace(/OPENVSCODE_SHA256="[^"]+"/, `OPENVSCODE_SHA256="NEEDS_UPDATE_SEE_PR_BODY"`);
+          fs.writeFileSync('Dockerfile', content);
+          NODE
+
+          git add Dockerfile
+          if git diff --cached --quiet; then
+            echo "Nothing changed - aborting."
+            exit 1
+          fi
+          git commit -m "chore(deps): bump openvscode-server $CUR -> $LAT"
+          git push -u origin "$BRANCH"
+        env:
+          BRANCH: ${{ steps.branch.outputs.branch }}
+          CUR: ${{ steps.ver.outputs.current }}
+          LAT: ${{ steps.ver.outputs.latest }}
+
+      - name: Open PR
+        if: steps.ver.outputs.skip != 'true' && steps.branch.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BRANCH: ${{ steps.branch.outputs.branch }}
+          CUR: ${{ steps.ver.outputs.current }}
+          LAT: ${{ steps.ver.outputs.latest }}
+        run: |
+          set -euo pipefail
+          gh pr create \
+            --base develop \
+            --head "$BRANCH" \
+            --title "chore(deps): bump openvscode-server $CUR -> $LAT" \
+            --body "$(cat <<EOF
+          Auto-generated bump of \`openvscode-server\` (the browser IDE, REQ-IDE-001) from \`$CUR\` to \`$LAT\`.
+
+          The version is pinned in \`Dockerfile\` with a SHA256 checksum - Dependabot can't see it, so \`bump-shadow-pins.yml\` opens this PR weekly.
+
+          **Action required before merge:** update \`OPENVSCODE_SHA256\` in Dockerfile with the linux-x64 asset digest:
+          \`\`\`bash
+          gh api repos/gitpod-io/openvscode-server/releases/tags/openvscode-server-v${LAT} \\
+            --jq '.assets[] | select(.name | endswith("linux-x64.tar.gz")) | .digest'
+          \`\`\`
+
+          ## Test plan
+          - [ ] Update \`OPENVSCODE_SHA256\` in Dockerfile (strip the \`sha256:\` prefix)
+          - [ ] CI green (Docker build verifies the checksum + --version smoke)
+          EOF
+          )"
+
   bun:
     # Bun is installed globally as a pinned npm package because context-mode
     # autodetects it for faster ctx_execute/ctx_batch_execute subprocess starts.
     # The Dockerfile literal is invisible to Dependabot, so this job tracks it.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0
@@ -795,7 +900,7 @@ jobs:
     # graphify-native.ts extension.)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0
@@ -940,7 +1045,7 @@ jobs:
     # by impeccable.style and must be copied into both runtimes together.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0
@@ -1033,7 +1138,7 @@ jobs:
     # Dependabot, so this job bumps it weekly.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0
@@ -1128,12 +1233,12 @@ jobs:
 
   chrome-devtools-mcp:
     # chrome-devtools-mcp is the interactive Browser Run MCP server Claude Code
-    # and Pi use (Pi through pi-mcp-adapter). It is pinned as `npx -y
-    # chrome-devtools-mcp@X` literals in entrypoint.sh for both agents; those
-    # literals are invisible to Dependabot, so this job bumps them weekly.
+    # and Pi use (Pi through pi-mcp-adapter). It is baked into the Docker image
+    # as an npx cache + stable bin path; the Dockerfile version env is invisible
+    # to Dependabot, so this job bumps it weekly.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0
@@ -1143,11 +1248,11 @@ jobs:
         with:
           node-version: 22
 
-      - name: Diff entrypoint pin against npm latest
+      - name: Diff Dockerfile pin against npm latest
         id: ver
         run: |
           set -euo pipefail
-          CURRENT=$(grep -oP 'chrome-devtools-mcp@\K[0-9][0-9.]*' entrypoint.sh | head -n1)
+          CURRENT=$(grep -oP 'CHROME_DEVTOOLS_MCP_VERSION=\K[0-9][0-9.]*' Dockerfile | head -n1)
           LATEST=$(npm view chrome-devtools-mcp version)
           echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
           echo "latest=$LATEST" >> "$GITHUB_OUTPUT"
@@ -1182,13 +1287,13 @@ jobs:
           const fs = require('node:fs');
           const cur = process.env.CUR;
           const lat = process.env.LAT;
-          const file = 'entrypoint.sh';
+          const file = 'Dockerfile';
           const before = fs.readFileSync(file, 'utf-8');
-          const after = before.replaceAll(`chrome-devtools-mcp@${cur}`, `chrome-devtools-mcp@${lat}`);
+          const after = before.replaceAll(`CHROME_DEVTOOLS_MCP_VERSION=${cur}`, `CHROME_DEVTOOLS_MCP_VERSION=${lat}`);
           if (before !== after) { fs.writeFileSync(file, after); console.log(`updated ${file}`); }
           NODE
 
-          git add entrypoint.sh
+          git add Dockerfile
           if git diff --cached --quiet; then
             echo "Nothing changed (replacement found nothing) - aborting."
             exit 1
@@ -1210,10 +1315,10 @@ jobs:
           BODY=$(cat <<EOF
           Auto-generated bump of \`chrome-devtools-mcp\` from \`$CUR\` to \`$LAT\`.
 
-          The version is pinned as \`npx -y chrome-devtools-mcp@X\` literals in \`entrypoint.sh\` for Claude Code and Pi's bridged interactive Browser Run surface, so Dependabot can't see it - \`bump-shadow-pins.yml\` opens this PR weekly.
+          The version is pinned as \`CHROME_DEVTOOLS_MCP_VERSION\` in \`Dockerfile\`, which bakes an npx cache plus stable bin path for Claude Code and Pi's bridged interactive Browser Run surface. Dependabot can't see that Dockerfile env pin, so \`bump-shadow-pins.yml\` opens this PR weekly.
 
           Files updated:
-          - \`entrypoint.sh\` (\`chrome-devtools-mcp@$CUR\` -> \`@$LAT\`)
+          - \`Dockerfile\` (\`CHROME_DEVTOOLS_MCP_VERSION=$CUR\` -> \`$LAT\`)
 
           ## Test plan
           - [ ] CI green
@@ -1233,7 +1338,7 @@ jobs:
     # reads the Pi package.json), so this job bumps it weekly.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: develop
           fetch-depth: 0

.github/workflows/codeql.yml

@@ -23,20 +23,20 @@ jobs:
       contents: read
       security-events: write
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
         with:
           languages: javascript-typescript
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4

.github/workflows/deploy-dockerhub.yml

@@ -68,22 +68,22 @@ jobs:
           echo "::error::Production deploys are only allowed from main. Got branch: ${{ github.ref }}"
           exit 1
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '22'
 
       - name: Cache root node_modules
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache-root
         with:
           path: node_modules
           key: root-${{ hashFiles('package-lock.json') }}
           restore-keys: root-
 
       - name: Cache web-ui node_modules
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache-webui
         with:
           path: web-ui/node_modules
@@ -253,7 +253,7 @@ jobs:
       # docker-container driver (provisioned by setup-buildx-action) does
       # and is what unlocks --cache-from / --cache-to against the
       # built-in GitHub Actions cache service. No extra registry creds.
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build container image
         id: docker-build

.github/workflows/deploy.yml

@@ -91,7 +91,7 @@ jobs:
       # pull_request event (not push) and are filtered out before checkout.
       # Scorecard scores the pattern 0 unconditionally because it cannot read
       # the job `if:` guards. See the rationale at lines 54-64 (prior alert #34).
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # On workflow_run: pin to the SHA whose PR Checks just ended
           # green. Without this, actions/checkout falls back to default-
@@ -106,23 +106,23 @@ jobs:
           node-version: '22'
 
       - name: Cache root node_modules
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache-root
         with:
           path: node_modules
           key: root-${{ hashFiles('package-lock.json') }}
           restore-keys: root-
 
       - name: Cache web-ui node_modules
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache-webui
         with:
           path: web-ui/node_modules
           key: webui-${{ hashFiles('web-ui/package-lock.json') }}
           restore-keys: webui-
 
       - name: Cache landing node_modules
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache-landing
         with:
           path: landing/node_modules
@@ -308,7 +308,7 @@ jobs:
       # docker-container driver (provisioned by setup-buildx-action) does
       # and is what unlocks --cache-from / --cache-to against the
       # built-in GitHub Actions cache service. No extra registry creds.
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build container image
         id: docker-build