finished the work?

.agents/skills/lint-creator/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: lint-creator
+description: An auxiliary skill to add more dylints to `tooling/lints`
+disable-model-invocation: false
+---
+
+# Lint RULES
+
+1. Every lint MUST have accompanying `ui` tests
+2. `ui` tests MUST be in the `ui` folder
+3. Every lint MUST be in a separate module
+4. Every lint MUST have negative `ui` tests
+5. Lints should be as simple as possible.
+6. Reporting is fine if it's simple, it does not need to be elaborate or lengthy code.
+7. Do NOT suggest how to fix the lint, only flag it.
+8. Do NOT make lints machine applicable.
+9. Detect if lints are redundant vs clippy's capabilities.

.cloudflare/docs-proxy/src/worker.js

@@ -1,6 +1,11 @@
 export default {
   async fetch(request, _env, _ctx) {
     const url = new URL(request.url);
+    const acceptHeader = request.headers.get("Accept") || "";
+    const wantsMarkdown = acceptHeader
+      .split(",")
+      .map((mediaType) => mediaType.split(";")[0].trim().toLowerCase())
+      .includes("text/markdown");
 
     if (url.pathname === "/docs/nightly") {
       url.hostname = "docs-nightly.pages.dev";
@@ -18,6 +23,14 @@ export default {
       url.hostname = "docs-anw.pages.dev";
     }
 
+    if (url.pathname === "/docs.md") {
+      url.pathname = "/docs/getting-started.md";
+    }
+
+    if (wantsMarkdown) {
+      url.pathname = markdownPathFor(url.pathname);
+    }
+
     let res = await fetch(url, request);
 
     if (res.status === 404) {
@@ -27,3 +40,31 @@ export default {
     return res;
   },
 };
+
+function markdownPathFor(pathname) {
+  if (pathname === "/docs" || pathname === "/docs/") {
+    return "/docs/getting-started.md";
+  }
+
+  if (pathname.endsWith("/index.md")) {
+    return pathname.replace(/\/index\.md$/, "/getting-started.md");
+  }
+
+  if (pathname.endsWith(".md")) {
+    return pathname;
+  }
+
+  if (pathname.endsWith(".html")) {
+    return pathname.replace(/\.html$/, ".md");
+  }
+
+  if (pathname.split("/").pop().includes(".")) {
+    return pathname;
+  }
+
+  if (pathname.endsWith("/")) {
+    return `${pathname}getting-started.md`;
+  }
+
+  return `${pathname}.md`;
+}

.github/CODEOWNERS.hold

@@ -304,7 +304,6 @@
 /crates/picker/ @zed-industries/ui-team
 /crates/refineable/ @zed-industries/ui-team
 /crates/story/ @zed-industries/ui-team
-/crates/storybook/ @zed-industries/ui-team
 /crates/svg_preview/ @zed-industries/ui-team
 /crates/tab_switcher/ @zed-industries/ui-team
 /crates/theme/ @zed-industries/ui-team

.github/workflows/after_release.yml

@@ -22,6 +22,8 @@ on:
         description: body
         type: string
         default: ''
+permissions:
+  contents: read
 jobs:
   rebuild_releases_page:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')

.github/workflows/autofix_pr.yml

@@ -13,9 +13,14 @@ on:
         description: run_clippy
         type: boolean
         default: 'true'
+permissions:
+  contents: read
 jobs:
   run_autofix:
     runs-on: namespace-profile-16x32-ubuntu-2204
+    permissions:
+      contents: read
+      pull-requests: read
     env:
       CC: clang
       CXX: clang++
@@ -43,7 +48,7 @@ jobs:
     - name: steps::download_wasi_sdk
       run: ./script/download-wasi-sdk
     - name: steps::setup_pnpm
-      uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2
+      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320
       with:
         version: '9'
     - name: autofix_pr::run_autofix::install_cargo_machete

.github/workflows/bump_collab_staging.yml

@@ -5,10 +5,15 @@ on:
     # Fire every day at 16:00 UTC (At the start of the US workday)
     - cron: "0 16 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   update-collab-staging-tag:
     if: github.repository_owner == 'zed-industries'
     runs-on: namespace-profile-2x4-ubuntu-2404
+    permissions:
+      contents: write
     steps:
       - name: Checkout repository
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

.github/workflows/bump_patch_version.yml

@@ -8,10 +8,14 @@ on:
         description: Branch name to run on
         required: true
         type: string
+permissions:
+  contents: read
 jobs:
   run_bump_patch_version:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')
     runs-on: namespace-profile-16x32-ubuntu-2204
+    permissions:
+      contents: write
     steps:
     - id: generate-token
       name: steps::authenticate_as_zippy

.github/workflows/bump_zed_version.yml

@@ -8,6 +8,8 @@ on:
         description: 'Which channels to bump: all, main, preview, or stable'
         type: string
         default: all
+permissions:
+  contents: read
 jobs:
   resolve_versions:
     if: github.repository_owner == 'zed-industries'
@@ -86,6 +88,9 @@ jobs:
     - resolve_versions
     if: inputs.target == 'all' || inputs.target == 'main'
     runs-on: namespace-profile-16x32-ubuntu-2204
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
     - id: generate-token
       name: steps::authenticate_as_zippy
@@ -127,6 +132,8 @@ jobs:
     - resolve_versions
     if: inputs.target == 'all' || inputs.target == 'preview'
     runs-on: namespace-profile-16x32-ubuntu-2204
+    permissions:
+      contents: write
     steps:
     - id: generate-token
       name: steps::authenticate_as_zippy
@@ -180,6 +187,8 @@ jobs:
     - resolve_versions
     if: inputs.target == 'all' || inputs.target == 'stable'
     runs-on: namespace-profile-16x32-ubuntu-2204
+    permissions:
+      contents: write
     steps:
     - id: generate-token
       name: steps::authenticate_as_zippy

.github/workflows/cherry_pick.yml

@@ -21,14 +21,12 @@ on:
         description: pr_number
         required: true
         type: string
+permissions:
+  contents: read
 jobs:
   run_cherry_pick:
     runs-on: namespace-profile-2x4-ubuntu-2404
     steps:
-    - name: steps::checkout_repo
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
-      with:
-        clean: false
     - id: generate-token
       name: steps::authenticate_as_zippy
       uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859
@@ -38,6 +36,11 @@ jobs:
         permission-contents: write
         permission-workflows: write
         permission-pull-requests: write
+    - name: steps::checkout_repo
+      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+      with:
+        clean: false
+        token: ${{ steps.generate-token.outputs.token }}
     - name: cherry_pick::run_cherry_pick::cherry_pick
       run: ./script/cherry-pick "$BRANCH" "$COMMIT" "$CHANNEL"
       env:

.github/workflows/comment_on_potential_duplicate_issues.yml

@@ -14,6 +14,8 @@ concurrency:
   group: potential-duplicate-check-${{ github.event.issue.number || inputs.issue_number }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   identify-duplicates:
     # For manual testing, allow running on any branch; for automatic runs, only on main repo

.github/workflows/community_close_stale_issues.yml

@@ -13,10 +13,15 @@ on:
         type: number
         default: 1000
 
+permissions:
+  contents: read
+
 jobs:
   stale:
     if: github.repository_owner == 'zed-industries'
     runs-on: namespace-profile-2x4-ubuntu-2404
+    permissions:
+      issues: write
     steps:
       - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10
         with:

.github/workflows/community_update_all_top_ranking_issues.yml

@@ -5,10 +5,16 @@ on:
     - cron: "0 */12 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   update_top_ranking_issues:
     runs-on: namespace-profile-2x4-ubuntu-2404
     if: github.repository == 'zed-industries/zed'
+    permissions:
+      contents: read
+      issues: write
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Set up uv

.github/workflows/community_update_weekly_top_ranking_issues.yml

@@ -5,10 +5,16 @@ on:
     - cron: "0 15 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   update_top_ranking_issues:
     runs-on: namespace-profile-2x4-ubuntu-2404
     if: github.repository == 'zed-industries/zed'
+    permissions:
+      contents: read
+      issues: write
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Set up uv

.github/workflows/compliance_check.yml

@@ -7,6 +7,8 @@ on:
   schedule:
   - cron: 30 17 * * 2
   workflow_dispatch: {}
+permissions:
+  contents: read
 jobs:
   scheduled_compliance_check:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')

.github/workflows/congrats.yml

@@ -4,6 +4,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   check-author:
     if: ${{ github.repository_owner == 'zed-industries' }}

.github/workflows/danger.yml

@@ -11,6 +11,8 @@ on:
     - edited
     branches:
     - main
+permissions:
+  contents: read
 jobs:
   danger:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')
@@ -21,7 +23,7 @@ jobs:
       with:
         clean: false
     - name: steps::setup_pnpm
-      uses: pnpm/action-setup@fe02b34f77f8bc703788d5817da081398fad5dd2
+      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320
       with:
         version: '9'
     - name: steps::setup_node

.github/workflows/deploy_collab.yml

@@ -7,6 +7,8 @@ on:
   push:
     tags:
     - collab-production
+permissions:
+  contents: read
 jobs:
   style:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')

.github/workflows/deploy_docs.yml

@@ -35,6 +35,8 @@ on:
         description: Git ref to checkout and deploy. Defaults to event SHA when omitted.
         type: string
         default: ''
+permissions:
+  contents: read
 jobs:
   deploy_docs:
     if: github.repository_owner == 'zed-industries'

.github/workflows/deploy_nightly_docs.yml

@@ -5,6 +5,7 @@ on:
   push:
     branches:
     - main
+permissions: {}
 jobs:
   deploy_docs:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')

.github/workflows/docs_suggestions.yml

@@ -42,6 +42,10 @@ on:
           - immediate
         default: batch
 
+# Both jobs below declare their own `permissions:` blocks, so no job uses this
+# top-level default. Least privilege therefore grants nothing here.
+permissions: {}
+
 env:
   DROID_MODEL: claude-sonnet-4-5-20250929
   SUGGESTIONS_BRANCH: docs/suggestions-pending

.github/workflows/extension_auto_bump.yml

@@ -10,6 +10,8 @@ on:
     - '!extensions/test-extension/**'
     - '!extensions/workflows/**'
     - '!extensions/*.md'
+permissions:
+  contents: read
 jobs:
   detect_changed_extensions:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')

.github/workflows/extension_bump.yml

@@ -28,6 +28,8 @@ on:
       app-secret:
         description: The app secret for the corresponding app ID
         required: true
+permissions:
+  contents: read
 jobs:
   check_version_changed:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')

.github/workflows/extension_tests.yml

@@ -15,6 +15,8 @@ on:
         description: working-directory
         type: string
         default: .
+permissions:
+  contents: read
 jobs:
   orchestrate:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')