feat(cli): one shared framework source per machine, user scope and session telemetry

.github/dependabot.yml

@@ -29,6 +29,14 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    # devDependencies batch into one PR instead of one per package — the CLI's
+    # Windows job alone runs ~8 min, and an unrelated bump should not pay for it once
+    # per dependency.
+    groups:
+      npm-dev-dependencies:
+        dependency-type: "development"
+        patterns:
+          - "*"
     commit-message:
       prefix: "chore"
       include: "scope"
@@ -42,6 +50,29 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    groups:
+      npm-dev-dependencies:
+        dependency-type: "development"
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "npm"
+    directory: "kanban"
+    target-branch: "next"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      npm-dev-dependencies:
+        dependency-type: "development"
+        patterns:
+          - "*"
     commit-message:
       prefix: "chore"
       include: "scope"

.github/rulesets/main.json

@@ -20,7 +20,8 @@
         "dismiss_stale_reviews_on_push": false,
         "require_code_owner_review": true,
         "require_last_push_approval": false,
-        "required_review_thread_resolution": true
+        "required_review_thread_resolution": true,
+        "require_extra_approval_for_unattributed_changes": true
       }
     },
     {
@@ -29,7 +30,8 @@
         "strict_required_status_checks_policy": false,
         "required_status_checks": [
           {"context": "lefthook (framework-local checks)"},
-          {"context": "Commitlint"}
+          {"context": "Commitlint"},
+          {"context": "cli / gate"}
         ]
       }
     },

.github/rulesets/next.json

@@ -20,7 +20,8 @@
         "dismiss_stale_reviews_on_push": false,
         "require_code_owner_review": false,
         "require_last_push_approval": false,
-        "required_review_thread_resolution": false
+        "required_review_thread_resolution": false,
+        "require_extra_approval_for_unattributed_changes": true
       }
     },
     {
@@ -29,7 +30,8 @@
         "strict_required_status_checks_policy": false,
         "required_status_checks": [
           {"context": "lefthook (framework-local checks)"},
-          {"context": "Commitlint"}
+          {"context": "Commitlint"},
+          {"context": "cli / gate"}
         ]
       }
     },

.github/workflows/back-merge.yml

@@ -1,16 +1,12 @@
 name: Back-merge
 
-# After a release on main, fold main's changelog, manifest and version bumps
-# back into next so the two branches do not drift.
+# After a release on main, fold main's changelog, manifest and version bumps back into next.
 #
-# This stays a plain merge because promote.yml lands as a merge commit: main and
-# next share a real merge base, so the only thing left to reconcile here is the
-# release commit itself. Conflict -> open a PR for a human. Any other failure ->
-# open a tracking issue so the drift is never silent.
+# A plain merge, because promote.yml lands as a merge commit: main and next share a real
+# merge base, so only the release commit is left to reconcile. Conflict opens a PR instead.
 #
-# A release can publish several tags at once (umbrella, plugins, cli), firing
-# this workflow once per tag. The first run folds main in; the rest find main
-# already merged and exit, instead of each opening its own duplicate PR.
+# A release can publish several tags at once, firing this once per tag: the first run folds
+# main in, the rest find it already merged rather than each opening a duplicate PR.
 
 on:
   release:
@@ -56,10 +52,8 @@ jobs:
             exit 0
           fi
 
-          # `ci:` on purpose. The type is absent from release-please's
-          # changelog-sections, so this plumbing commit never surfaces in a
-          # released changelog, while commitlint still accepts it as the tip of
-          # a later promote PR.
+          # `ci:` on purpose: the type is absent from release-please's changelog-sections,
+          # so this plumbing commit never surfaces in a changelog, and commitlint accepts it.
           if git merge --no-ff -m "ci: back-merge main into next" origin/main; then
             git push origin next
           else
@@ -72,8 +66,7 @@ jobs:
               --body "Automated back-merge hit conflicts. Resolve manually, then **merge with a merge commit, not a squash**: the second parent is what keeps a shared merge base between \`main\` and \`next\`, and a squash puts the next back-merge back into conflict."
           fi
 
-      # Never let a back-merge fail silently: a rejected push or any other error
-      # opens a tracking issue so a human resyncs main into next.
+      # A rejected push, or any other error, must not leave next drifting silently.
       - name: Open tracking issue on failure
         if: failure()
         env: