Merge remote-tracking branch 'refs/remotes/upstream/main'

# Conflicts:
#	ROADMAP.md
#	TODO.md
#	src/cli.tsx
#	src/config.ts
#	src/mcp.ts
#	src/permission.ts
#	src/prompt.ts
#	src/session.ts
#	src/snapshot.ts
#	src/subagent.ts
#	src/tools-extra.ts
#	src/tools.ts
#	src/ui/App.tsx
#	test/mcp.test.ts
#	test/prune.test.ts
#	test/session.test.ts
#	test/tools.test.ts

.github/workflows/ci.yml

@@ -5,6 +5,10 @@ on:
     branches: [main]
   pull_request:
 
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
     runs-on: ${{ matrix.os }}
@@ -16,9 +20,22 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - uses: actions/checkout@v4
+
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.14
+
+      # bun install --frozen-lockfile re-resolves nothing but still pays the network
+      # cost of a cold store; cache the store so a no-change run skips it. Key is per
+      # OS and lockfile, so a dependency bump or a new OS each gets a fresh cache.
+      - name: Cache the bun install store
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
+
       - run: bun install --frozen-lockfile
       - run: bun run typecheck
       - run: bun test

.github/workflows/release.yml

@@ -10,6 +10,10 @@ on:
         type: boolean
         default: true
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: write
 
@@ -21,6 +25,13 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.14
+      - name: Cache the bun install store
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
       - run: bun install --frozen-lockfile
       - run: bun run typecheck
       - run: bun test
@@ -33,14 +44,25 @@ jobs:
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.14
+      - name: Cache the bun install store
+        uses: actions/cache@v4
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: |
+            bun-${{ runner.os }}-
       - run: bun install --frozen-lockfile
 
       # Bun cross-compiles every target from one host, so no build matrix is needed.
       # release.ts also fails the build when the tag and src/version.ts disagree.
       - run: bun run release
 
-      - name: Check the binary reports the right version
+      - name: Check the binaries report the right version and are non-empty
         run: |
+          for f in dist/release/shiro-linux-x64 dist/release/shiro-linux-arm64 \
+                   dist/release/shiro-darwin-x64 dist/release/shiro-darwin-arm64; do
+            [ -s "$f" ] || { echo "$f is missing or empty"; exit 1; }
+          done
           chmod +x dist/release/shiro-linux-x64
           ./dist/release/shiro-linux-x64 --version
           ./dist/release/shiro-linux-x64 --version | grep -q "$(bun -e 'console.log((await import("./src/version.ts")).VERSION)')"
@@ -61,17 +83,29 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.14
       - uses: actions/download-artifact@v4
         with:
           name: shiro-binaries
           path: dist/release
 
+      # Release body: a short summary plus the artifact inventory, so the release
+      # page reads like a hand-written one instead of the raw PR list. The changelog
+      # is the prose; scripts/make-release-notes.ts extracts the section for this tag
+      # and fails if the heading is missing, rather than publishing an empty body.
+      - name: Compose release notes
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: bun run scripts/make-release-notes.ts
+
       - name: Publish the release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           gh release create "${{ github.ref_name }}" \
             --title "shiro-neko ${{ github.ref_name }}" \
-            --generate-notes \
+            --notes-file release_notes.md \
             $([[ "${{ github.ref_name }}" == *-* ]] && echo --prerelease) \
             dist/release/*