vanedaltro · Nov 5, 2026 · Nov 5, 2026
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,68 @@
+name: Bug report
+description: Something does not work as documented
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. For a security problem, don't file an issue: see SECURITY.md.
+        Remove API keys, tokens and private paths from anything you paste.
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What you did, what you expected, and what happened instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. cyber ...
+        2. ...
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Output of `cyber --version`, or the commit you built.
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - macOS
+        - Linux
+        - Windows
+        - Other
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Where
+      multiple: true
+      options:
+        - TUI
+        - cyber exec / CLI
+        - Web dashboard
+        - Server API / SDK
+        - Sandbox / permissions
+        - MCP / plugins / hooks / skills
+        - Install / upgrade
+        - Other
+  - type: input
+    id: model
+    attributes:
+      label: Provider and model
+      placeholder: openai/gpt-6.1-sol, anthropic/claude-..., a local model through Ollama, ...
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs and output
+      description: Relevant output, `cyber doctor`, or log lines (`cyber --print-logs ...`).
+      render: text
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/CyberdyneCorp/cybercode-cli/security/advisories/new
+    about: Report security problems privately, not as a public issue.
+  - name: Feature reference
+    url: https://github.com/CyberdyneCorp/cybercode-cli/blob/main/docs/features.md
+    about: What is available today and what remains.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,30 @@
+name: Feature request
+description: Suggest a new capability or an improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What are you trying to do, and what gets in the way today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you'd like
+      description: The behavior you have in mind. Commands, keys or config you'd expect are welcome.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives and workarounds
+      description: What you use today, or how another tool handles it.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Checks
+      options:
+        - label: I searched the existing issues, docs/features.md and ROADMAP.md.
+          required: true
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
@@ -0,0 +1,14 @@
+## Summary
+
+<!-- What changed and why. Link the issue or OpenSpec change. -->
+
+## How it was tested
+
+<!-- Tests added or run, and anything checked by hand. -->
+
+## Checklist
+
+- [ ] Bug fixes include a regression test that fails without the fix.
+- [ ] Docs (`docs/`, `README.md`) and specs (`openspec/`) are updated for changed behavior.
+- [ ] Generated files are current (OpenAPI, TypeScript SDK, `docs/cli.md`, `ROADMAP.md` inventory) when routes, CLI help or specs changed.
+- [ ] `just lint` and the relevant tests pass locally.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,34 @@
+# Changelog
+
+All notable changes to Cyber Code are recorded here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Before 1.0, a minor version may change behavior or configuration; such changes are listed under **Changed**.
+
+[`docs/features.md`](docs/features.md) is the detailed reference for what each area does and what remains.
+
+## [Unreleased]
+
+The first release is in preparation. It will contain:
+
+### Added
+
+- **Agent core:** durable Sessions with steer and queue input, interrupt, retry with error classification, compaction and Context Epochs, on SQLite with backup, restore and retention.
+- **Models:** OpenAI Responses, Anthropic Messages and OpenAI-compatible endpoints (including local servers such as Ollama), a models.dev catalog with an offline snapshot, usage and cost. Sign in with a ChatGPT Plus/Pro or GitHub Copilot subscription instead of an API key.
+- **Reliability:** retry of interrupted streams before any tool runs, and unattended runs that wait for a subscription usage limit to reset.
+- **Tools:** read, write, edit, `apply_patch`, bash (with background commands), glob, grep, web fetch and search, todo, question and skills, with output budgets.
+- **Safety:** permission rules and modes (`default`, `plan`, `accept-edits`, `auto`, `dont-ask`, `bypass`), workspace trust, a sandbox on macOS and Linux (preview on Windows), secrets redacted from tool output, and framing of untrusted content against prompt injection.
+- **Recovery:** Git snapshots, rewind of code, conversation or both, and staged undo/redo.
+- **Surfaces:** a terminal UI, `cyber exec` for scripts and CI, a local web dashboard, an OpenAPI server with a TypeScript SDK, and an MCP server mode.
+- **TUI:** command palette, themes, sidebar, file explorer, binary viewer and editor, rewind, Ctrl+R prompt history search, sound alerts, mouse support, accessibility and `NO_COLOR` modes.
+- **Extensibility:** MCP (stdio and HTTP, OAuth, tool search, resources and prompts), skills and custom commands, hooks, plugins, output styles, memory, code intelligence through LSP, and import of Claude Code, Codex and OpenCode settings.
+- **Orchestration:** subagents with worktree isolation, workflows with verified solve and integration queues, goals, session loops, and messaging between Sessions on one machine and between your own machines (direct peers).
+- **Languages:** the TUI in English, Brazilian Portuguese, Spanish and French, with model replies in the chosen language (`language`, `/language`).
+- **Install:** signed release archives for 8 targets, `install.sh`, verified `cyber upgrade` and `cyber uninstall`.
+
+### Experimental (off by default)
+
+- Agent teams, the self-hosted project collaboration hub, and native computer use on macOS.
+
+### Known limits
+
+- Windows is a preview: sandboxed shells cannot start yet ([#9](https://github.com/CyberdyneCorp/cybercode-cli/issues/9)).
+- Package managers (Homebrew, npm, Scoop, WinGet, AUR, Nix) are not published yet, and binaries are not notarized for macOS or signed for Windows.
+- The hosted Relay, remote control, session sharing and IDE clients are planned, not built.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -0,0 +1,85 @@
+# Contributing to Cyber Code
+
+Thanks for your interest. This guide covers how to build the project, what a pull request needs, and how changes are specified.
+
+By contributing, you agree that your contributions are licensed under the [Apache License 2.0](LICENSE), the project's license (section 5 of the license).
+
+## Before you start
+
+- **Bugs and small fixes:** open a pull request directly, or an issue first if you're not sure it's a bug.
+- **New features and larger changes:** open an issue to discuss the idea first. Medium and large features, and any change touching security, permissions, authentication, billing or data models, need an [OpenSpec](#specs-with-openspec) change before the code.
+- **Security problems:** don't open an issue. Follow [SECURITY.md](SECURITY.md).
+
+## Development setup
+
+You need:
+
+- **Rust 1.89+** (edition 2024). SQLite is bundled.
+- **Linux:** `bubblewrap` for the sandbox (`sudo apt install bubblewrap`).
+- **Node.js 22** for the web dashboard (`web/`), the TypeScript SDK (`sdk/typescript/`) and the OpenSpec CLI.
+- **[just](https://github.com/casey/just)** (optional) for the task shortcuts below.
+- **Python 3** for the spec and SDK scripts.
+
+```bash
+git clone https://github.com/CyberdyneCorp/cybercode-cli
+cd cybercode-cli
+cargo build --locked -p cyber-cli
+./target/debug/cyber --version
+```
+
+Run `just` to list the tasks. The common ones:
+
+| Task | Command |
+|---|---|
+| Format | `just fmt` |
+| Lint (fmt check + clippy, warnings are errors) | `just lint` |
+| Rust tests | `just test`, or `just test -p cyber-server` |
+| Specs (OpenSpec validation, spec lint, roadmap inventory) | `just specs` |
+| TypeScript SDK | `just sdk-test` |
+| Everything CI checks | `just ci` |
+| Linux tests in Docker | `just test-linux` |
+
+Some tests start the sandbox helper. Build it once with `cargo build -p cyber-sandbox --bins` before running the whole suite. CI uses [nextest](https://nexte.st/): `cargo nextest run --workspace --profile ci`.
+
+## What CI checks
+
+A pull request must pass:
+
+- `cargo fmt --check` and `cargo clippy --workspace --all-targets -- -D warnings`. Clippy also enforces a cognitive-complexity limit per function; split a function that exceeds it rather than silencing the lint.
+- The Rust tests on macOS, Linux and Windows. Tests that need Unix (bash, PTYs) are gated with `#[cfg(unix)]`, together with any helpers and imports only they use.
+- **Generated files are current:**
+  - `sdk/openapi.json`: run `UPDATE_OPENAPI=1 cargo test -p cyber-server openapi_document_is_current` after changing an HTTP route.
+  - The TypeScript SDK: `python3 scripts/generate_sdk.py`.
+  - `docs/cli.md`: `just docs-cli` after changing CLI flags or help text.
+  - The requirement inventory in `ROADMAP.md`: `python3 scripts/spec_inventory.py` after changing specs.
+- `openspec validate --all --strict` and `python3 scripts/spec_lint.py`.
+- The web dashboard and SDK builds and tests.
+
+## Pull requests
+
+- **One topic per pull request.** Separate refactors from behavior changes when you can.
+- **Describe it.** The body says what changed, why, and how you tested it. The template has the sections.
+- **Bug fixes come with a regression test** in the same pull request: one that fails before the fix and passes after.
+- **Update the docs** (`docs/`, `README.md`) and the specs (`openspec/`) when behavior changes.
+- **Keep code simple to read and extend.** Match the naming, comment density and idioms of the code around it.
+- **Commit messages** are short and technical: what changed and why, in the imperative (`tui: search prompt history with Ctrl+R`).
+
+## Specs with OpenSpec
+
+Requirements live in [`openspec/specs/`](openspec/specs), one folder per capability, written as `SHALL` statements with scenarios. Changes are proposed in [`openspec/changes/`](openspec/changes):
+
+```bash
+npx -y @fission-ai/openspec@1.13.2 new change add-my-feature
+# write proposal.md, design.md (when needed), tasks.md and specs/<capability>/spec.md deltas
+npx -y @fission-ai/openspec@1.13.2 validate add-my-feature --strict
+```
+
+A spec is a product contract, not proof of implementation. [`docs/features.md`](docs/features.md) records what is actually available.
+
+## Clean-room rule
+
+Cyber Code is written independently. Do not copy code, prompts, grammars or documentation text from other coding agents or their products, including when their license would allow it. Studying their public behavior and documentation is fine; write our own implementation and words.
+
+## Code of conduct
+
+Be respectful and constructive. Harassment or personal attacks are not tolerated in issues, pull requests or any project space. Maintainers may remove content or block participants who don't follow this.