chore: sync public mirror from internal

.repository-projection.json

@@ -3,11 +3,11 @@
   "projection": "deixic-code",
   "projectionSchemaVersion": 1,
   "sourceRepository": "dx-corp/mono",
-  "sourceSha": "73a8f29245de08bc9f819da2fe05c2bf98e0e069",
+  "sourceSha": "7ecee9b80257e93dd5ef17507266fa3268d6c407",
   "destinationRepository": "dx-corp/code",
-  "priorProjectedBase": "fc3948a803dadacca5e0ab2ebed6eb571a80af7d",
+  "priorProjectedBase": "da7411a5369075e2e38262a54ce8cae42629f260",
   "definitionDigest": "cb9d429542ebb0a2de9b42a7aad60d9d8696a648ceba47c30f05c0b285ca0db7",
   "toolDigest": "f6d8b2a0b6f867d1db845a086635357eed196054b6a47f0695e49fdde616d6e6",
-  "contentDigest": "ea1fbe3360c4bf405b4ede36d83c96bef235822a2db1ceec660462208518e3f3",
+  "contentDigest": "2813efeb2fb9cae2d6ce2552d6c0f953c76911942cd8b48a97c7115c5ee92b7e",
   "publicationEligible": true
 }

deny.toml

@@ -24,6 +24,7 @@ targets = []
 
 [advisories]
 ignore = [
+    { id = "RUSTSEC-2024-0449", reason = "unsafe-libyaml 0.2.11 unmaintained (repository archived), pulled in by serde_yaml_ng 0.10.0 (production). No known vulnerability; no maintained serde_yaml_ng release drops it yet. expires: 2026-10-26" },
     # --- Unmaintained crates (no known vulnerability) ---
     { id = "RUSTSEC-2025-0141", reason = "bincode 1.3.3 unmaintained; pulled in by syntect (production, tui-rs syntax highlighting). No upstream fix / maintained fork adopted by syntect yet. expires: 2026-10-23" },
     { id = "RUSTSEC-2025-0057", reason = "fxhash 0.2.1 unmaintained; pulled in transitively via criterion's fxprof-processed-profile (dev-dependency / benchmarks only, not in the shipped binary). expires: 2026-10-23" },

packages/ambient-agent-rs/Cargo.toml

@@ -14,6 +14,7 @@ name = "ambient"
 path = "src/main.rs"
 
 [dependencies]
+rustls.workspace = true
 maestro-ai.workspace = true
 maestro-runtime-contracts.workspace = true
 # Async runtime

packages/ambient-agent-rs/src/main.rs

@@ -134,6 +134,7 @@ enum Commands {
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
+    let _ = rustls::crypto::ring::default_provider().install_default();
     let cli = Cli::parse();
 
     // Setup logging

packages/maestro-rs/Cargo.toml

@@ -25,6 +25,7 @@ default = []
 test-support = ["maestro-tui/test-support"]
 
 [dependencies]
+rustls.workspace = true
 anyhow.workspace = true
 ctor.workspace = true
 maestro-runtime-gateway.workspace = true

packages/maestro-rs/src/main.rs

@@ -26,6 +26,7 @@ fn sync_command_output(command: &Command) -> Option<&'static str> {
 }
 
 fn main() -> Result<()> {
+    let _ = rustls::crypto::ring::default_provider().install_default();
     let raw_args = std::env::args_os().collect::<Vec<_>>();
     if raw_args.get(1).and_then(|value| value.to_str()) == Some("native-code-effect") {
         std::process::exit(native_effect::run(&raw_args)?);

packages/runtime-gateway-rs/Cargo.toml

@@ -10,6 +10,7 @@ name = "maestro-runtime-gateway"
 path = "src/main.rs"
 
 [dependencies]
+rustls.workspace = true
 anyhow.workspace = true
 base64.workspace = true
 chrono.workspace = true

packages/runtime-gateway-rs/src/main.rs

@@ -5,6 +5,7 @@ use std::{env, process};
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
+    let _ = rustls::crypto::ring::default_provider().install_default();
     match parse_cli_action(env::args().skip(1)) {
         Ok(CliAction::Serve) => serve(RuntimeGatewayConfig::from_env()).await,
         Ok(CliAction::Help) => {

packages/tui-rs/AGENTS.md

@@ -156,7 +156,7 @@ All widgets implement ratatui's `Widget` trait.
 - **`reader.rs`**: Parses JSONL session files
 - **`writer.rs`**: Writes session entries
 
-### `terminal/` - Terminal Setup
+### `products/maestro/packages/tui-kit-rs/src/terminal/` - Terminal Setup
 - **`setup.rs`**: Raw mode, alternate screen, mouse capture
 - **`history.rs`**: Scrollback buffer management
 

packages/tui-rs/src/bin/hosted_runner_conformance_fixture.rs

@@ -1,4 +1,5 @@
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
+    let _ = rustls::crypto::ring::default_provider().install_default();
     maestro_tui::hosted_runner_conformance::run().await
 }

packages/tui-rs/src/bin/maestro_hosted_runner.rs

@@ -3,5 +3,6 @@ use maestro_tui::hosted_runner_cli::run_hosted_runner_cli_from_env;
 
 #[tokio::main]
 async fn main() -> Result<()> {
+    let _ = rustls::crypto::ring::default_provider().install_default();
     run_hosted_runner_cli_from_env(std::env::args_os()).await
 }

packages/tui-rs/src/main.rs

@@ -7,6 +7,7 @@ use anyhow::Result;
 const TOKIO_WORKER_STACK_BYTES: usize = 8 * 1024 * 1024;
 
 fn main() -> Result<()> {
+    let _ = rustls::crypto::ring::default_provider().install_default();
     tokio::runtime::Builder::new_multi_thread()
         .enable_all()
         .thread_stack_size(TOKIO_WORKER_STACK_BYTES)