fix(youtrack): drop greeting, mention and timezone config; fix work-item date

[BrainerVirus]

What it does

Slice S7 from docs/workit-next/plan.md: tooling, CI and release refresh. Five focused commits:

1. build(deps): zod 4.5.4 → 4.6.5, @modelcontextprotocol/sdk 1.30.0 → 1.32.0, @opencode-ai/plugin 1.18.30 → 1.18.34 (the support-matrix current and CI env move with it; the 1.18.30 floor stays), oxlint 1.86.0, oxfmt 0.71.0, knip 6.39.0, @semantic-release/npm 13.2.0 and /github 12.0.10. All pins stay exact.
   • conventional-changelog-conventionalcommits goes to 9.3.1, not 10.x. 10.x needs conventional-changelog-writer@9. @semantic-release/release-notes-generator 14.1.1 (the latest) still ships writer@8, so 10.x fails with a "Missing helper" error at render time. I checked this by rendering notes through the generator: 9.3.1 produces the same output as 8.0.0.
   • schema-depth.test.ts passes on zod 4.6.5 with no changes.
2. chore(lint): adds .oxlintrc.json and .oxfmtrc.json, which now hold the list of paths to lint and format. The scripts are just oxlint, oxlint --fix, oxfmt and oxfmt --check. This drops the 4× duplicated path list and adds scripts/ and packages/*/scripts, which were not checked before.
   • Rule categories: correctness = error, suspicious and perf = warn, with denyWarnings on.
   • Type-aware linting uses oxlint-tsgolint 7.0.2003. It bundles typescript-go, so it works with TS 7, and the whole repo lints in about 2 s.
   • Most findings are fixed in code:
     • sort/reverse → toSorted/toReversed (tsconfig target is now ES2023)
     • no-shadow renames, including locals that shadowed the path module
     • filter()[0] → find/findLast
     • unbound methods wrapped in arrows
     • unnecessary awaits, assertions and conversions removed
   • The rules turned off each have a reason written in the config. Globally: no-await-in-loop, consistent-function-scoping, no-unsafe-type-assertion (about 1k casts at JSON boundaries; to tighten later), no-base-to-string (tsgolint does not honor checkUnknown yet) and consistent-return. In tests only: await-thenable (bun-types types .resolves/.rejects as void) and unbound-method.
3. chore(hooks): lefthook, opt-in with bun run hooks:install.
   • pre-commit runs oxfmt and oxlint on staged files in parallel: about 0.8 s.
   • commit-msg runs commitlint with the conventional config: about 0.5 s.
   • no_auto_install: true is set because hooks are shared by every worktree of a clone.
4. chore(ci): react-doctor is now a pinned devDependency (0.9.14). The two obsolete probe workflows are deleted (details under CI notes).
5. chore(ci): CI restructure and a release that waits for CI (see below).

CI and release

• fast checks: one install, then lint, format, knip, typecheck, react-doctor, actionlint and zizmor run in parallel inside one step. Each gate prints its own log section with its exit code and duration.
• test (ubuntu-latest): one build, then a plain bun test. Every test directory runs. I confirmed that test/workit-codex, test/workit-mcp, test/opencode-v2 and test/acceptance were not in any CI job before.
• test (macos-latest) / test (windows-latest): test/workit-core and test/artifacts, same as before.
• Before → after:
  • typecheck: 6 jobs → 1
  • builds: 5 → 3 (one per OS)
  • jobs: 12 → 4, plus the release job
  • The candidate job is gone: it repeated phase-0-candidate, which test/artifacts already runs.
  • The artifacts job's ref: head_ref checkout is no longer needed: the phase-9 test already handles a detached HEAD.
• Hardening:
  • Actions are pinned to commit SHAs.
  • persist-credentials: false everywhere.
  • permissions: {} at the top level, with only what each job needs added per job.
  • PR runs cancel superseded runs. Runs on main are grouped per commit and never cancelled.
• Release (release.yml):
  • It is now a reusable workflow, called from the release job in ci.yml. That job only runs after fast, test and portability pass for the same commit on main.
  • Secrets are passed by name, not with inherit.
  • The job has a concurrency group with cancel-in-progress: false, so two merges cannot race on tags.
  • It runs bun run release, which uses the pinned semantic-release devDependency instead of an unpinned npx download.
  • npm provenance: id-token: write plus NPM_CONFIG_PROVENANCE=true. npm publish still authenticates with NPM_TOKEN; provenance only adds the OIDC attestation. The repo is public and every package's repository.url matches it.

Measured (local, Node 24.20.0, bun 1.4.1)

Gate	Time
fast job gates, run in parallel (same script as CI)	4.6 s wall (lint 4.6 s, typecheck 4.6 s, react-doctor 4.1 s, knip 3.7 s, zizmor 0.5 s, format 0.3 s, actionlint 0.06 s)
oxlint with types, whole repo, run alone	~2.3 s
lefthook pre-commit / commit-msg	0.8 s / 0.5 s
full bun test	1570 pass / 2 fail, 161 s

The 2 local failures are environmental:

• AR-14: the inner bun test picks up the sibling worktree ../s0-docs, which has no node_modules. This also fails on main in this layout.
• Pi stock-supervisor smoke: a metadata.lock timeout under full-suite load. It passes when its file runs alone (3/3). This is the lock contention that S1 fixes.

Also: actionlint reports nothing, and zizmor 1.30.1 (--offline) reports no findings. One finding is ignored on purpose: zizmor suggests the $/ self-repository syntax, which actionlint 1.7.12 rejects. The ignore comment explains this.

CI notes / action needed

• ⚠️ Branch protection still requires the old job names (check (workit-core) (…), check (workit-opencode), check (workit-cursor), check (workit-cli), check (shared)). Those jobs no longer exist, so this PR and the automated manifest-sync PRs will wait on checks that never report. Before merging, change the required checks to fast checks, test (ubuntu-latest), test (macos-latest), test (windows-latest). I did not change repository settings.
• The old react-doctor gate did nothing. Since 0.9.x, npx react-doctor@latest prints "React Doctor is not installed in this project" and exits 0. As a pinned devDependency it now runs the real scan. It currently reports warnings only, no errors.
• bun run check (not plain bun test) puts node_modules/.bin first on PATH. That bin folder contains the npm that @semantic-release/npm pulls in, so 2 packed-CLI tests fail to resolve the npm CLI when run that way. This already happens on main. CI calls bun test directly, so it is not affected. Follow-up for the test helpers.
• Deleted sync-token-probe.yml: its own note said to delete it once the token was stable. The last probe passed on 2026-08-28, and RELEASE_SYNC_TOKEN opened manifest-sync PR chore(release): sync manifests to v2.1.0 #147.
• Deleted windows-inner-suite-probe.yml: it runs handoff.test.ts and sdd.test.ts, which no longer exist.

Quality gates

• Tests, typecheck, lint, formatting and isolated release-candidate checks pass locally (Node 24). The exceptions are the environmental failures listed above.
• CONTRIBUTING describes the new checks, hooks and release flow.
• No host behavior changes. The source edits are lint fixes that keep behavior the same.

Checklist

• Existing scoped settings and local/version pins are preserved. The OpenCode floor stays 1.18.30. Pi, ink and @openclaw/fs-safe are not bumped.
• No user-facing behavior change. semantic-release will cut a patch because product paths changed (dependency bumps).

Review follow-ups (ac3307f)

• No organization defaults.
  • Missing baseUrl now gives createUrl: null and an error that names youtrack.json.
  • With no meetingIssue, meetings mode asks for one instead of using a built-in issue.
  • Meeting work-item text comes from the entry's workItemText, else meetingWorkItemText in youtrack.json, else Meetings.
  • Existing configs that set these keep working.
• Greeting template removed. The bundled greeting.md template and the "greeting" template name are gone. buildDraft no longer takes greeting and the bundled template no longer has {{greetingSection}}. A user template that still has that placeholder, or any other unknown one, renders it as empty.
• Numeric dateMs. localDate is now the UTC calendar day of the epoch, so it round-trips (tested in 5 timezones).
• Effective timezone is visible.
  • youTrackWorkDateMs returns timezoneSource.
  • context() returns workTimezone: { timezone, source }.
  • Resolved youtrack.update, youtrack.meeting and youtrack.time actions include workDate: { localDate, timezone, timezoneSource }. Since 000327b this sits beside the approval descriptor, not inside it (see the next section).
  • This is documented in the README and AGENTS.md.
• New source-scan guard. It replaces the list of hand-picked strings. It fails on any real *.youtrack.cloud host (example. hosts are allowed) or any quoted issue-id literal used as a ?? / || fallback in packages/*/src.
• Verification after this commit:
  • lint, format:check, typecheck and knip all exit 0.
  • Full bun test on Node 24.20.0: 1570 pass, 9 fail.
    • 6 also fail on origin/main on this machine: 5 Pi/Codex packed-launcher tests and AR-14.
    • The other 3 are timeout-sensitive tests that failed during a run with machine load around 9. Their files pass when rerun alone (cursor-install-invariants and external-action: 35 pass, 0 fail).
• packages/workit-opencode/src/tools/youtrack.ts and tools/templates.ts were not edited. They still compile without a shim. normalizeContext also accepts the legacy { data } envelope those tools use.

Second review follow-up (000327b)

• workDate moved out of the hashed descriptor. In ac3307f it sat inside descriptorPayload.resolved, which externalActionDescriptor hashes. So an action approved under one process timezone did not match when it ran under another. Old approvals could never match either. It is now ResolvedExternalAction.workDate, next to the descriptor and display only. workit action --preview shows it.
• New tests in youtrack-descriptor-tz.test.ts. Each phase runs in its own process with TZ set.
  • The descriptor is identical under Santiago, Tokyo and UTC, and contains no workDate.
  • A youtrack.time action approved under Santiago runs under UTC and succeeds.
  • A youtrack.update in the old shape (no workDate) still matches.
  • All 3 fail on ac3307f with approved external action target changed before execution and pass now.
• Tighter guard.
  • Project keys must be 2+ characters.
  • Standard identifiers such as UTF-8 and SHA-256 are excluded.
  • Issue ids in issue fields (meetingIssue: "ABC-12") are now flagged.
  • Hard-coded IANA region zones used as a fallback or timezone: value are flagged.
  • Matching and non-matching examples are both tested.
• Verification after this commit (Node 24.20.0):
  • lint, format:check, typecheck and knip all exit 0.
  • Full bun test: 1577 pass, 6 fail. The 6 are the same environment-dependent tests that also fail on origin/main on this machine (5 Pi/Codex packed-launcher tests and AR-14).

🤖 Generated with Claude Code

[github-actions]

🎉 This PR is included in version 2.1.3 🎉

The release is available on:

• v2.1.3
• GitHub release

Your semantic-release bot 📦🚀