fix: sync upstream security and quality fixes

.agents/skills/i18n-translate/SKILL.md

@@ -3,13 +3,46 @@ name: i18n-translate
 description: >-
   Complete and maintain frontend i18n translations for this project. Covers
   finding missing translation keys, detecting untranslated entries, and adding
-  translations for all supported locales (en, zh, fr, ja, ru, vi). Use when the
-  user asks to add translations, fix i18n, complete missing translations, or
-  when new UI text needs to be internationalized.
+  translations for all supported locales (en, zh, fr, ja, ru, vi). Use for any
+  task involving frontend locale files, missing translation keys, untranslated
+  UI text, `t(...)` keys, `useTranslation()`, static i18n keys, button/label/
+  toast/dialog/placeholder/validation copy, or adding/fixing even a single
+  i18n key. Use when review findings mention missing i18n, when new UI text
+  needs translation, or when the user asks to add translations, fix i18n, or
+  complete missing translations. Always load and follow this skill before
+  translating, adding locale keys, or editing frontend i18n files.
 ---
 
 # Frontend i18n Translation Workflow
 
+## Mandatory Preflight
+
+- Read this entire `SKILL.md` before any frontend i18n work, including one-key fixes.
+- Before editing locale files, confirm the source text comes from a `t(...)` key, `en.json`, existing UI copy, or an explicitly requested new UI string.
+- Use the user conversation only to understand the task target. Do not copy conversation text, review wording, or task descriptions directly into locale values.
+- Before translating each key, re-think the intended UI copy from the code and locale context instead of treating the surrounding chat as the translation source.
+
+### Hard Constraint: Locale Writes Go Through the Script
+
+- You MUST NOT edit `web/default/src/i18n/locales/*.json` directly with text-editing tools (StrReplace, Write, search-and-replace, manual JSON edits, etc.). This applies even to a single key.
+- ALL locale writes MUST go through the `add-missing-keys.mjs` script, followed by `bun run i18n:sync`. The script is the only sanctioned way to add or change locale values.
+- Why this is mandatory, not optional:
+  - Hand-editing reliably drops one or more of the six locales (`en`, `zh`, `fr`, `ja`, `ru`, `vi`), leaving keys missing in some languages.
+  - Hand-editing breaks the required alphabetical key order and introduces JSON syntax errors (trailing commas, mismatched quotes).
+  - The script writes all six files atomically with consistent sorting, so the locale set stays in sync by construction.
+- The script does not do the translation for you. You still must reason out each locale's copy and populate the script's `newKeys` object; the script only handles insertion, sorting, and writing. Do not skip the script just because the thinking happens regardless.
+
+## Scope Checklist
+
+Before editing files, treat the task as covered by this skill if it involves:
+
+- `i18n`, translation, locale files, language packs, missing keys, or untranslated text
+- `t('...')`, `useTranslation()`, `static-keys.ts`, or `locales/*.json`
+- UI copy in buttons, labels, toasts, dialogs, placeholders, validation messages, descriptions, or table/empty states
+- A review finding about missing i18n keys
+
+Do not skip this workflow because the fix is "just one key".
+
 ## Overview
 
 - Locale files: `web/default/src/i18n/locales/{en,zh,fr,ja,ru,vi}.json`
@@ -18,6 +51,16 @@ description: >-
 - Sync script: `bun run i18n:sync` (from `web/default/`)
 - All `t()` calls must have corresponding keys in every locale file
 
+## Small Fix Path
+
+For a single known missing key (still script-only, no direct JSON edits):
+
+1. Confirm the exact key at the call site and verify it is absent from all locale files.
+2. Add the key via `add-missing-keys.mjs`, populating its `newKeys` object for every supported locale: `en`, `zh`, `fr`, `ja`, `ru`, `vi`. Even one key goes through the script; do not hand-edit the JSON.
+3. The script preserves the flat `"translation"` object and keeps keys alphabetically sorted automatically.
+4. Run a targeted search for the key in code and locale files.
+5. Run `bun run i18n:sync` to normalize file order. This step is mandatory, not optional.
+
 ## Workflow
 
 ### Step 1: Run sync and read report
@@ -153,7 +196,7 @@ for (const locale of locales) {
 
 ### Step 4: Add translations
 
-Create `web/default/scripts/add-missing-keys.mjs` with this structure:
+This script is the ONLY sanctioned way to write locale values. You MUST NOT bypass it by hand-filling the JSON files. Create `web/default/scripts/add-missing-keys.mjs` with this exact structure:
 
 ```javascript
 import fs from 'node:fs/promises'
@@ -224,6 +267,20 @@ Delete temporary scripts after completion.
 
 ## Translation Guidelines
 
+### Source Text Rules
+
+- Reconsider every key's UI meaning before translating: component location, user action, placeholder variables, button/label/toast/dialog/validation context, and whether the copy is a noun, command, status, or full sentence.
+- Prefer the English key or `en` value as the source text. Use the call site only to clarify meaning, tone, and constraints.
+- Do not copy chat messages, review comments, issue descriptions, or task wording as translation text.
+- If the source text is unclear, inspect the code and locale files first. Ask the user for exact source copy only when the intended UI text remains ambiguous.
+
+### Length and Layout Awareness
+
+- Consider whether translated text may overflow the UI before choosing final wording, especially for buttons, table headers, menu items, labels, toasts, dialog titles, tabs, badges, and empty states.
+- For languages that often expand relative to English, especially French, Russian, and Vietnamese, prefer natural but compact wording.
+- Do not sacrifice meaning just to shorten text. When the call site has limited space, choose the shortest clear translation that preserves the UI intent.
+- For interpolated variables, counts, model names, provider names, quotas, and dates, consider the longest realistic rendered text, not only the translation string itself.
+
 | Language | Code | Notes |
 |----------|------|-------|
 | English | en | Base locale, key = value |
@@ -252,3 +309,4 @@ Delete temporary scripts after completion.
 4. Always run `bun run i18n:sync` as the final step
 5. Delete temporary scripts after completion
 6. The `{{variable}}` placeholders in keys must be preserved in all translations
+7. NEVER edit `locales/*.json` directly. Any non-script write to a locale file (StrReplace, Write, manual JSON edit) is non-compliant, including single-key fixes.

.agents/skills/shadcn-ui/SKILL.md

@@ -72,8 +72,8 @@ Vendored: [`vendor/shadcn/mcp.md`](./vendor/shadcn/mcp.md). Live docs: [MCP Serv
 
 1. **Project detection** — Applies when `components.json` exists (here: `web/default/components.json`).
 2. **Context injection** — Use `shadcn info --json` as ground truth for imports and APIs.
-3. **Pattern enforcement** — Follow rules in [`vendor/shadcn/SKILL.md`](./vendor/shadcn/SKILL.md) and [`vendor/shadcn/rules/`](./vendor/shadcn/rules/).
-4. **Component discovery** — `shadcn docs`, `shadcn search`, MCP, or registries — see vendored SKILL + MCP doc.
+3. **Pattern enforcement** — Use [`vendor/shadcn/rules/`](./vendor/shadcn/rules/) for concrete markup checks; the complete official workflow reference is listed below for deeper CLI, registry, and preset questions.
+4. **Component discovery** — `shadcn docs`, `shadcn search`, MCP, or registries — see the official workflow reference and MCP doc when deeper context is needed.
 
 ---
 
@@ -88,11 +88,11 @@ Vendored: [`vendor/shadcn/mcp.md`](./vendor/shadcn/mcp.md). Live docs: [MCP Serv
 
 ## Vendored upstream bundle (deep rules)
 
-Snapshot from [shadcn-ui/ui `skills/shadcn`](https://github.com/shadcn-ui/ui/tree/main/skills/shadcn); revision note in [`vendor/shadcn/UPSTREAM.txt`](./vendor/shadcn/UPSTREAM.txt).
+Snapshot from [shadcn-ui/ui `skills/shadcn`](https://github.com/shadcn-ui/ui/tree/main/skills/shadcn); revision note in [`vendor/shadcn/UPSTREAM.txt`](./vendor/shadcn/UPSTREAM.txt). The upstream workflow is stored as a reference file, with its original skill frontmatter removed, so the vendored copy is not discovered as a second local skill.
 
 | Doc | Path |
 | --- | --- |
-| Full official skill body | [`vendor/shadcn/SKILL.md`](./vendor/shadcn/SKILL.md) |
+| Official shadcn/ui workflow reference | [`vendor/shadcn/official-shadcn-ui-workflow.md`](./vendor/shadcn/official-shadcn-ui-workflow.md) |
 | CLI reference | [`vendor/shadcn/cli.md`](./vendor/shadcn/cli.md) |
 | Theming / customization | [`vendor/shadcn/customization.md`](./vendor/shadcn/customization.md) |
 | MCP | [`vendor/shadcn/mcp.md`](./vendor/shadcn/mcp.md) |
@@ -102,4 +102,4 @@ Snapshot from [shadcn-ui/ui `skills/shadcn`](https://github.com/shadcn-ui/ui/tre
 | Styling | [`vendor/shadcn/rules/styling.md`](./vendor/shadcn/rules/styling.md) |
 | Base vs Radix | [`vendor/shadcn/rules/base-vs-radix.md`](./vendor/shadcn/rules/base-vs-radix.md) |
 
-**Workflow:** Prefer this **root** `SKILL.md` for repo paths (`web/default`, Bun). Read **`vendor/shadcn/SKILL.md`** for the complete upstream workflow, patterns, and CLI quick reference. Use **`vendor/shadcn/rules/*.md`** when validating concrete markup.
+**Workflow:** Prefer this **root** `SKILL.md` for repo paths (`web/default`, Bun). Read **`vendor/shadcn/official-shadcn-ui-workflow.md`** only when you need the complete official component, registry, or preset workflow. Use **`vendor/shadcn/rules/*.md`** when validating concrete markup.

.agents/skills/shadcn-ui/vendor/shadcn/UPSTREAM.txt

@@ -1,3 +1,4 @@
 Source: https://github.com/shadcn-ui/ui/tree/56161142f1b83f612462772d18883807b5f0d601/skills/shadcn
 Branch: main
 Fetched: 2026-04-29
+Local file note: upstream SKILL.md is stored as official-shadcn-ui-workflow.md with its original frontmatter removed to avoid exposing the vendored copy as a separate local skill.

.agents/skills/shadcn-ui/vendor/shadcn/cli.md

@@ -121,7 +121,7 @@ npx shadcn@latest add button --diff globals.css
 
 #### Smart Merge from Upstream
 
-See [Updating Components in SKILL.md](./SKILL.md#updating-components) for the full workflow.
+See [Updating Components in official-shadcn-ui-workflow.md](./official-shadcn-ui-workflow.md#updating-components) for the full workflow.
 
 ### `search` — Search registries
 
@@ -270,7 +270,7 @@ Three ways to specify a preset via `--preset`:
 Ask the user first: **overwrite**, **merge**, or **skip** existing components?
 
 - **Overwrite / Re-install** → `npx shadcn@latest apply --preset <code>`. Overwrites all detected component files with the new preset styles. Use when the user hasn't customized components.
-- **Merge** → `npx shadcn@latest init --preset <code> --force --no-reinstall`, then run `npx shadcn@latest info` to get the list of installed components and use the [smart merge workflow](./SKILL.md#updating-components) to update them one by one, preserving local changes. Use when the user has customized components.
+- **Merge** → `npx shadcn@latest init --preset <code> --force --no-reinstall`, then run `npx shadcn@latest info` to get the list of installed components and use the [smart merge workflow](./official-shadcn-ui-workflow.md#updating-components) to update them one by one, preserving local changes. Use when the user has customized components.
 - **Skip** → `npx shadcn@latest init --preset <code> --force --no-reinstall`. Only updates config and CSS variables, leaves existing components as-is.
 
 Always run preset commands inside the user's project directory. `apply` only works in an existing project with a `components.json` file. The CLI automatically preserves the current base (`base` vs `radix`) from `components.json`. If you must use a scratch/temp directory (e.g. for `--dry-run` comparisons), pass `--base <current-base>` explicitly — preset codes do not encode the base.

.agents/skills/shadcn-ui/vendor/shadcn/customization.md

@@ -206,4 +206,4 @@ npx shadcn@latest add button --dry-run        # see all affected files
 npx shadcn@latest add button --diff button.tsx # see the diff for a specific file
 ```
 
-See [Updating Components in SKILL.md](./SKILL.md#updating-components) for the full smart merge workflow.
+See [Updating Components in official-shadcn-ui-workflow.md](./official-shadcn-ui-workflow.md#updating-components) for the full smart merge workflow.

.agents/skills/shadcn-ui/vendor/shadcn/SKILL.md → .agents/skills/shadcn-ui/vendor/shadcn/official-shadcn-ui-workflow.md

@@ -1,9 +1,6 @@
----
-name: shadcn
-description: Manages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI. Provides project context, component docs, and usage examples. Applies when working with shadcn/ui, component registries, presets, --preset codes, or any project with a components.json file. Also triggers for "shadcn init", "create an app with --preset", or "switch to --preset".
-user-invocable: false
-allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
----
+# Official shadcn/ui Workflow Reference
+
+Vendored from the upstream shadcn/ui skill. The original skill frontmatter is intentionally removed so this file stays a reference document instead of being discovered as a separate local skill.
 
 # shadcn/ui
 

.agents/skills/vercel-react-best-practices/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: vercel-react-best-practices
+description: React and Next.js performance optimization guidelines from Vercel Engineering. Use when writing, reviewing, or refactoring React/Next.js code involving components, Next.js pages, Server Components, Server Actions, data fetching, bundle size, rendering behavior, or performance improvements.
+---
+
+# Vercel React Best Practices
+
+Use this skill for React and Next.js performance work. The full Vercel guide is stored in `references/full-guide.md`; do not read the whole file by default.
+
+## Workflow
+
+1. Identify the relevant performance area from the task or code under review.
+2. Search `references/full-guide.md` for the matching section or rule heading.
+3. Read only the relevant section before changing or reviewing code.
+4. Prioritize higher-impact categories before lower-impact micro-optimizations.
+
+## Priority Order
+
+1. Eliminating waterfalls: sequential async work, API route chains, missing `Promise.all`, Suspense boundaries.
+2. Bundle size optimization: barrel imports, heavy client modules, dynamic imports, deferred third-party libraries.
+3. Server-side performance: Server Actions auth, RSC serialization, per-request deduplication, cross-request caching, `after()`.
+4. Client-side data fetching: SWR deduplication, global listeners, passive scroll listeners, localStorage schema.
+5. Re-render optimization: derived state, effect dependencies, memo boundaries, functional state updates, transitions, refs.
+6. Rendering performance: hydration mismatches, long lists, static JSX, SVG precision, resource hints, script loading.
+7. JavaScript performance: repeated lookups, array passes, storage reads, layout thrashing, sort/min-max choices.
+8. Advanced patterns: one-time initialization, stable callback refs, effect events.
+
+## Reference
+
+- Full compiled guide: `references/full-guide.md`
+- Original project: https://github.com/vercel-labs/agent-skills/tree/main/skills/react-best-practices

.github/workflows/release.yml

@@ -43,7 +43,7 @@ jobs:
           CI: ""
         run: |
           cd web
-          bun install --frozen-lockfile
+          bun install --filter ./classic --frozen-lockfile
           cd classic
           VITE_REACT_APP_VERSION=$VERSION bun run build
           cd ../..
@@ -103,7 +103,7 @@ jobs:
           CI: ""
         run: |
           cd web
-          bun install --frozen-lockfile
+          bun install --filter ./classic --frozen-lockfile
           cd classic
           VITE_REACT_APP_VERSION=$VERSION bun run build
           cd ../..
@@ -160,7 +160,7 @@ jobs:
           CI: ""
         run: |
           cd web
-          bun install --frozen-lockfile
+          bun install --filter ./classic --frozen-lockfile
           cd classic
           VITE_REACT_APP_VERSION=$VERSION bun run build
           cd ../..