CLI auth (PAT/device) + direct-to-org-database data plane

.github/workflows/publish-vscode-extension.yml

@@ -0,0 +1,72 @@
+name: Publish VS Code Extension
+
+# Publishes the autter VS Code extension (agent-support/vscode) to the
+# Open VSX Registry and, if a token is configured, the VS Code Marketplace.
+#
+# Triggers:
+#   - pushing a tag matching `vscode-v*` (e.g. vscode-v0.1.23)
+#   - manual run via the Actions tab (workflow_dispatch)
+#
+# Required repository secrets:
+#   OVSX_PAT  - Open VSX access token (https://open-vsx.org user settings)
+#   VSCE_PAT  - VS Code Marketplace PAT (optional; Marketplace step is skipped if unset)
+
+on:
+  push:
+    tags:
+      - "vscode-v*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: agent-support/vscode
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: agent-support/vscode/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      # When triggered by a `vscode-v<x.y.z>` tag, the tag is the source of truth
+      # for the version. Sync package.json to it so the packaged/published .vsix
+      # can't drift from the tag (e.g. tag vscode-v0.1.23 must publish 0.1.23).
+      - name: Sync version to tag
+        if: startsWith(github.ref, 'refs/tags/vscode-v')
+        run: |
+          VERSION="${GITHUB_REF_NAME#vscode-v}"
+          echo "Setting extension version to $VERSION (from tag $GITHUB_REF_NAME)"
+          npm version "$VERSION" --no-git-tag-version --allow-same-version
+
+      - name: Package extension (.vsix)
+        run: npm run package
+
+      - name: Publish to Open VSX
+        env:
+          OVSX_PAT: ${{ secrets.OVSX_PAT }}
+        run: npx ovsx publish *.vsix -p "$OVSX_PAT"
+
+      - name: Publish to VS Code Marketplace
+        if: ${{ secrets.VSCE_PAT != '' }}
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+        run: npx vsce publish --packagePath *.vsix -p "$VSCE_PAT"
+
+      - name: Upload .vsix artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: autter-vscode-vsix
+          path: agent-support/vscode/*.vsix
+          if-no-files-found: warn

AGENTS.md

@@ -34,7 +34,7 @@ cargo insta accept                       # accept all pending snapshots
 
 Before opening a PR, make sure to run `task lint` and `task fmt` and resolve any formatting/lint issues as they will fail in CI.
 
-When opening a PR, make sure to monitor the ubuntu-based CI jobs first. They are the fastest (roughly 15mins) and if they fail, you should quickly iterate based on those failures and update the PR -- iterating there until those jobs are all green. Additionally, while you're checking on the ubuntu-based jobs, our automated PR review bot, Devin, should have had time to leave feedback. Make sure to read all of Devin's PR review feedback commits and address them. Address them means review, understand, evaluate, and fix if necessary or comment with your thoughts if you don't the feedback is a real issue. Once the lint, fmt, and Ubuntu-based tests have passed and you have addressed all Devin PR review feedback, you can stop monitoring CI for the Mac (~35mins) and Windows (up to 3.5 hours) checks unless the user has explicitly asked for you to wait for those or you're working on a specific OS-based bug.
+When opening a PR, make sure to monitor the ubuntu-based CI jobs first. They are the fastest (roughly 15mins) and if they fail, you should quickly iterate based on those failures and update the PR -- iterating there until those jobs are all green. Once the lint, fmt, and Ubuntu-based tests have passed, you can stop monitoring CI for the Mac (~35mins) and Windows (up to 3.5 hours) checks unless the user has explicitly asked for you to wait for those or you're working on a specific OS-based bug.
 
 ## Architecture