feat: complete Go/Wails → C++/WebView migration

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -8,12 +8,12 @@ body:
       value: |
         Thanks for taking the time to report a bug. Fill out as much as you can — the more detail, the faster it gets fixed.
 
-        **Security issues:** please do not report them here. Use [GitHub Private Advisories](https://github.com/Command-IDE/terminal-IDE/security/advisories/new) instead.
+        **Security issues:** please do not report them here. Use [GitHub Private Advisories](https://github.com/BinderTools/binder/security/advisories/new) instead.
 
   - type: input
     id: version
     attributes:
-      label: cmdIDE Version
+      label: Binder Version
       description: Found in the window title bar or the About section of Settings.
       placeholder: "e.g. 1.2.0"
     validations:
@@ -62,7 +62,7 @@ body:
       label: Steps to Reproduce
       description: Reliable steps to trigger the bug. The more specific the better.
       placeholder: |
-        1. Open cmdIDE
+        1. Open Binder
         2. Run `/preview index.html`
         3. ...
     validations:

.github/ISSUE_TEMPLATE/config.yml

@@ -2,11 +2,11 @@ blank_issues_enabled: false
 
 contact_links:
   - name: Theme Submission
-    url: https://github.com/Command-IDE/cmdide-themes/issues/new?template=community_theme_submission.md
+    url: https://github.com/BinderTools/binder-themes/issues/new?template=community_theme_submission.md
     about: Submit a community theme — please use the themes repository for this.
   - name: Plugin SDK Questions
-    url: https://github.com/Command-IDE/terminal-IDE/discussions
+    url: https://github.com/BinderTools/binder/discussions
     about: Questions about building plugins? Start a discussion.
   - name: Security Vulnerability
-    url: https://github.com/Command-IDE/terminal-IDE/security/advisories/new
+    url: https://github.com/BinderTools/binder/security/advisories/new
     about: Report a security vulnerability privately — do not open a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -6,9 +6,9 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for suggesting an improvement. Before submitting, search [existing issues](https://github.com/Command-IDE/terminal-IDE/issues) to avoid duplicates.
+        Thanks for suggesting an improvement. Before submitting, search [existing issues](https://github.com/BinderTools/binder/issues) to avoid duplicates.
 
-        **Themes:** propose new themes in the [themes repository](https://github.com/Command-IDE/cmdide-themes) instead.
+        **Themes:** propose new themes in the [themes repository](https://github.com/BinderTools/binder-themes) instead.
 
   - type: dropdown
     id: area

.github/workflows/audit.yml

@@ -21,35 +21,51 @@ concurrency:
 
 jobs:
 
-  # ── Go vulnerability scanner ──────────────────────────────────────────────────
-  govulncheck:
-    name: Go — govulncheck
+  # ── npm audit — app frontend ──────────────────────────────────────────────────
+  npm-audit-app:
+    name: npm audit — app/frontend
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-node@v4
         with:
-          go-version-file: app/go.mod
-          cache-dependency-path: app/go.sum
+          node-version: 20
 
-      - name: Install govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - name: Install dependencies
+        run: npm ci
+        working-directory: app/frontend
 
-      - name: Run govulncheck
-        run: govulncheck ./...
-        working-directory: app
+      - name: Run npm audit
+        # Fail only on high or critical vulnerabilities
+        run: npm audit --audit-level=high
+        working-directory: app/frontend
 
-  # ── npm audit — app frontend ──────────────────────────────────────────────────
-  npm-audit-app:
-    name: npm audit — app/frontend
+  # ── Auto-fix — npm audit (app frontend) ──────────────────────────────────────
+  # When npm audit fails on a PR, run `npm audit fix`, commit any resulting
+  # lockfile changes straight to the PR's branch, and leave a comment
+  # summarizing what changed.
+  npm-audit-app-autofix:
+    name: Auto-fix — npm audit (app/frontend)
+    needs: npm-audit-app
+    if: >-
+      always() &&
+      needs.npm-audit-app.result == 'failure' &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          token: ${{ secrets.GH_PAT || github.token }}
 
       - uses: actions/setup-node@v4
         with:
@@ -59,14 +75,101 @@ jobs:
         run: npm ci
         working-directory: app/frontend
 
-      - name: Run npm audit
-        # Fail only on high or critical vulnerabilities
-        run: npm audit --audit-level=high
+      - name: npm audit fix
+        run: npm audit fix --force
+        working-directory: app/frontend
+        continue-on-error: true
+
+      - name: Verify build
+        id: build
+        run: npm run build
         working-directory: app/frontend
+        continue-on-error: true
+
+      - name: Commit fixes
+        id: commit
+        run: |
+          if git diff --quiet -- app/frontend/package-lock.json app/frontend/package.json; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if [ "${{ steps.build.outcome }}" != "success" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "build_failed=true" >> "$GITHUB_OUTPUT"
+            git diff -- app/frontend/package-lock.json app/frontend/package.json > /tmp/audit-app-diff.patch
+            git checkout -- app/frontend/package-lock.json app/frontend/package.json
+            exit 0
+          fi
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+          git diff -- app/frontend/package-lock.json app/frontend/package.json > /tmp/audit-app-diff.patch
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add app/frontend/package-lock.json app/frontend/package.json
+          git commit -m "fix(deps): npm audit fix for app/frontend"
+          for i in 1 2 3 4 5; do
+            git push origin HEAD:${{ github.event.pull_request.head.ref }} && break
+            echo "Push rejected, rebasing onto latest remote ref (attempt $i)..."
+            git fetch origin ${{ github.event.pull_request.head.ref }}
+            git rebase origin/${{ github.event.pull_request.head.ref }}
+            sleep $((i * 3))
+          done
+
+      - name: Comment on PR
+        if: steps.commit.outputs.changed == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            let diff = fs.readFileSync('/tmp/audit-app-diff.patch', 'utf8');
+            const limit = 50000;
+            if (diff.length > limit) {
+              diff = diff.slice(0, limit) + '\n... (diff truncated)';
+            }
+
+            const body =
+              `## 📦 Auto-fixed npm audit issues — app/frontend\n\n` +
+              "The `npm audit — app/frontend` check failed, so `npm audit fix --force` was run " +
+              "(this may include major-version upgrades), the build was verified, and the " +
+              "result committed directly to this branch:\n\n" +
+              "```diff\n" + diff + "\n```\n\n" +
+              "Please double-check anything that depends on the upgraded package(s) still behaves as expected.";
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              body,
+            });
+
+      - name: Comment on PR (build failed)
+        if: steps.commit.outputs.build_failed == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            let diff = fs.readFileSync('/tmp/audit-app-diff.patch', 'utf8');
+            const limit = 50000;
+            if (diff.length > limit) {
+              diff = diff.slice(0, limit) + '\n... (diff truncated)';
+            }
+
+            const body =
+              `## ⚠️ npm audit fix for app/frontend needs manual attention\n\n` +
+              "The `npm audit — app/frontend` check failed, so `npm audit fix --force` was run, " +
+              "but the resulting build failed, so no changes were committed. The fix likely " +
+              "requires manual code changes to work with the upgraded package(s):\n\n" +
+              "```diff\n" + diff + "\n```";
 
-  # ── npm audit — installer frontend ───────────────────────────────────────────
-  npm-audit-installer:
-    name: npm audit — installer/frontend
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              body,
+            });
+
+  # ── npm audit — setup frontend ───────────────────────────────────────────────
+  npm-audit-setup:
+    name: npm audit — setup/frontend
     runs-on: ubuntu-latest
     timeout-minutes: 10
 
@@ -79,11 +182,132 @@ jobs:
 
       - name: Install dependencies
         run: npm ci
-        working-directory: installer/frontend
+        working-directory: setup/windows/frontend
 
       - name: Run npm audit
         run: npm audit --audit-level=high
-        working-directory: installer/frontend
+        working-directory: setup/windows/frontend
+
+  # ── Auto-fix — npm audit (setup frontend) ────────────────────────────────────
+  npm-audit-setup-autofix:
+    name: Auto-fix — npm audit (setup/frontend)
+    needs: npm-audit-setup
+    if: >-
+      always() &&
+      needs.npm-audit-setup.result == 'failure' &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          token: ${{ secrets.GH_PAT || github.token }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install dependencies
+        run: npm ci
+        working-directory: setup/windows/frontend
+
+      - name: npm audit fix
+        run: npm audit fix --force
+        working-directory: setup/windows/frontend
+        continue-on-error: true
+
+      - name: Verify build
+        id: build
+        run: npm run build
+        working-directory: setup/windows/frontend
+        continue-on-error: true
+
+      - name: Commit fixes
+        id: commit
+        run: |
+          if git diff --quiet -- setup/windows/frontend/package-lock.json setup/windows/frontend/package.json; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if [ "${{ steps.build.outcome }}" != "success" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+            echo "build_failed=true" >> "$GITHUB_OUTPUT"
+            git diff -- setup/windows/frontend/package-lock.json setup/windows/frontend/package.json > /tmp/audit-setup-diff.patch
+            git checkout -- setup/windows/frontend/package-lock.json setup/windows/frontend/package.json
+            exit 0
+          fi
+          echo "changed=true" >> "$GITHUB_OUTPUT"
+          git diff -- setup/windows/frontend/package-lock.json setup/windows/frontend/package.json > /tmp/audit-setup-diff.patch
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add setup/windows/frontend/package-lock.json setup/windows/frontend/package.json
+          git commit -m "fix(deps): npm audit fix for setup/frontend"
+          for i in 1 2 3 4 5; do
+            git push origin HEAD:${{ github.event.pull_request.head.ref }} && break
+            echo "Push rejected, rebasing onto latest remote ref (attempt $i)..."
+            git fetch origin ${{ github.event.pull_request.head.ref }}
+            git rebase origin/${{ github.event.pull_request.head.ref }}
+            sleep $((i * 3))
+          done
+
+      - name: Comment on PR
+        if: steps.commit.outputs.changed == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            let diff = fs.readFileSync('/tmp/audit-setup-diff.patch', 'utf8');
+            const limit = 50000;
+            if (diff.length > limit) {
+              diff = diff.slice(0, limit) + '\n... (diff truncated)';
+            }
+
+            const body =
+              `## 📦 Auto-fixed npm audit issues — setup/frontend\n\n` +
+              "The `npm audit — setup/frontend` check failed, so `npm audit fix --force` was run " +
+              "(this may include major-version upgrades), the build was verified, and the " +
+              "result committed directly to this branch:\n\n" +
+              "```diff\n" + diff + "\n```\n\n" +
+              "Please double-check anything that depends on the upgraded package(s) still behaves as expected.";
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              body,
+            });
+
+      - name: Comment on PR (build failed)
+        if: steps.commit.outputs.build_failed == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            let diff = fs.readFileSync('/tmp/audit-setup-diff.patch', 'utf8');
+            const limit = 50000;
+            if (diff.length > limit) {
+              diff = diff.slice(0, limit) + '\n... (diff truncated)';
+            }
+
+            const body =
+              `## ⚠️ npm audit fix for setup/frontend needs manual attention\n\n` +
+              "The `npm audit — setup/frontend` check failed, so `npm audit fix --force` was run, " +
+              "but the resulting build failed, so no changes were committed. The fix likely " +
+              "requires manual code changes to work with the upgraded package(s):\n\n" +
+              "```diff\n" + diff + "\n```";
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              body,
+            });
 
   # ── Secret / credential scanning ─────────────────────────────────────────────
   gitleaks:
@@ -118,18 +342,15 @@ jobs:
             --redact
 
   # ── OSV vulnerability scan (cross-ecosystem) ──────────────────────────────────
+  # Uses the reusable workflow format required by osv-scanner-action v2+
   osv-scan:
     name: OSV — cross-ecosystem vulnerability scan
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Run OSV-Scanner
-        uses: google/osv-scanner-action@v2
-        with:
-          scan-args: |-
-            --recursive
-            --skip-git
-            .
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8
+    with:
+      scan-args: |-
+        --recursive
+        --skip-git
+    permissions:
+      security-events: write
+      contents: read
+      actions: read