chore: merge upstream changes (mise, CSPRNG auth, diff fixes)

Key upstream changes integrated:
- Replace Nix flake dev env with mise (mise.toml, treefmt.toml)
- CSPRNG-based auth token generation with restricted lock-file perms
- Auto-close orphaned diffs on client disconnect (issue coder#248)
- Fallback split when Claude terminal is the only window (issue coder#231)
- Terminal paste fragmentation fix for Neovim <0.12.2
- Snacks explorer layout exclusion from editor window detection
- Close connection on malformed WebSocket frames (issue coder#258)
- ClaudeCodeCloseAllDiffs command; modernized model picker

Conflict resolutions preserve our fork's additions: live-cursor
config, unified.nvim diff provider, multi-tab singleton architecture,
and tab-scoped diff/window operations.

Author: papricasix

.claude/hooks/format.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 #
 # Claude Code Hook: Format Files
-# Triggers after Claude edits/writes files and runs nix fmt
+# Triggers after Claude edits/writes files and runs treefmt (via mise)
 #
 # Environment variables provided by Claude Code:
 # - CLAUDE_PROJECT_DIR: Path to the project directory
@@ -75,18 +75,18 @@ main() {
     exit 1
   fi
 
-  log "${YELLOW}Formatting file with nix fmt...${NC}"
+  log "${YELLOW}Formatting file with treefmt...${NC}"
 
   # Change to project directory
   cd "${CLAUDE_PROJECT_DIR}"
 
-  # Run nix fmt on the file
-  if nix fmt "$FILE_PATH" 2>/dev/null; then
+  # Run treefmt on the file
+  if mise exec -- treefmt "$FILE_PATH" 2>/dev/null; then
     log "${GREEN}✓ Successfully formatted: $FILE_PATH${NC}"
     exit 0
   else
     EXIT_CODE=$?
-    log "${RED}✗ nix fmt failed with exit code $EXIT_CODE${NC}"
+    log "${RED}✗ treefmt failed with exit code $EXIT_CODE${NC}"
     log "${RED}This indicates the file has formatting issues that need manual attention${NC}"
 
     # Don't fail the hook - just warn about formatting issues

.devcontainer/Dockerfile

@@ -1,17 +1,12 @@
 {
   "name": "claudecode.nvim Development",
-  "build": {
-    "dockerfile": "Dockerfile"
-  },
+  "image": "mcr.microsoft.com/devcontainers/base:ubuntu",
   "features": {
-    "ghcr.io/devcontainers/features/git:1": {}
+    "ghcr.io/devcontainers-extra/features/mise:1": {}
   },
   "customizations": {
     "vscode": {
-      "settings": {
-        "terminal.integrated.defaultProfile.linux": "bash"
-      },
-      "extensions": ["jnoortheen.nix-ide"]
+      "extensions": ["hverlin.mise-vscode"]
     }
   },
   "postCreateCommand": "bash .devcontainer/post-create.sh",

.devcontainer/devcontainer.json

@@ -1,31 +1,33 @@
 #!/bin/bash
+set -euo pipefail
 
-# Source Nix environment
-. /home/vscode/.nix-profile/etc/profile.d/nix.sh
-
-# Verify Nix is available
-if ! command -v nix &>/dev/null; then
-  echo "Error: Nix is not installed properly"
+# Ensure the feature-installed mise is on PATH for this script.
+export PATH="$HOME/.local/bin:/usr/local/bin:$PATH"
+if ! command -v mise &>/dev/null; then
+  echo "Error: mise is not on PATH after the devcontainer feature install" >&2
   exit 1
 fi
 
-echo "✅ Nix is installed and available"
-echo ""
-echo "📦 claudecode.nvim Development Container Ready!"
-echo ""
-echo "To enter the development shell with all dependencies, run:"
-echo "  nix develop"
+# Build deps: PUC Lua builds from source, and the test rocks compile C modules.
+sudo apt-get -o Acquire::Retries=3 update
+sudo apt-get -o Acquire::Retries=3 install -y build-essential libreadline-dev unzip
+
+# Activate mise in interactive shells (puts the toolchain + fixtures/bin on PATH).
+if ! grep -qs 'mise activate bash' "$HOME/.bashrc"; then
+  echo 'eval "$(mise activate bash)"' >>"$HOME/.bashrc"
+fi
+
 echo ""
-echo "This will provide:"
-echo "  - Neovim"
-echo "  - Lua and LuaJIT"
-echo "  - busted (test framework)"
-echo "  - luacheck (linter)"
-echo "  - stylua (formatter)"
-echo "  - All other development tools"
+echo "📦 Provisioning the claudecode.nvim development environment with mise..."
+
+mise trust
+mise install
+mise run setup
+
 echo ""
-echo "You can also run development commands directly:"
-echo "  - make        # Run full validation (format, lint, test)"
-echo "  - make test   # Run tests"
-echo "  - make check  # Run linter"
-echo "  - make format # Format code"
+echo "✅ claudecode.nvim development environment ready."
+echo "   mise run all      # full validation (format, lint, test)"
+echo "   mise run test     # run tests"
+echo "   mise run check    # lint"
+echo "   mise run format   # format"
+echo "   mise tasks        # list all tasks"

.devcontainer/post-create.sh

@@ -0,0 +1,82 @@
+name: Release Notes
+
+on:
+  release:
+    types:
+      - published
+
+permissions:
+  contents: write
+
+jobs:
+  release-notes:
+    name: release-notes
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate release inputs
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+
+          : "${ANTHROPIC_API_KEY:?ANTHROPIC_API_KEY secret is required}"
+          : "${GITHUB_TOKEN:?GITHUB_TOKEN is required}"
+          : "${RELEASE_TAG:?release tag is required}"
+
+          case "$RELEASE_TAG" in
+            v*) ;;
+            *)
+              echo "release tag must start with 'v': $RELEASE_TAG" >&2
+              exit 1
+              ;;
+          esac
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+          persist-credentials: false
+
+      # install_args installs only communique (pinned in mise.toml), not the
+      # full dev toolchain. cache: false avoids zizmor's cache-poisoning finding
+      # on this publish workflow (caching saves little on a release-only job).
+      - name: Set up mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        with:
+          install_args: communique
+          cache: false
+
+      - name: Resolve previous release ref
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+
+          release_commit="$(git rev-parse --verify "${RELEASE_TAG}^{commit}")"
+          : "${release_commit:?release commit is required}"
+
+          if previous_ref="$(git describe --tags --abbrev=0 --match 'v[0-9]*.[0-9]*.[0-9]*' --exclude '*-*' "${release_commit}^" 2>/dev/null)"; then
+            echo "Previous release tag: $previous_ref"
+          else
+            previous_ref="$(git rev-list --max-parents=0 "$release_commit" | head -n 1)"
+            : "${previous_ref:?previous release ref is required}"
+            echo "No previous release tag found; using root commit: $previous_ref"
+          fi
+
+          echo "PREVIOUS_RELEASE_REF=$previous_ref" >> "$GITHUB_ENV"
+
+      - name: Generate GitHub release notes
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          set -euo pipefail
+
+          : "${PREVIOUS_RELEASE_REF:?previous release ref is required}"
+
+          communique generate "$RELEASE_TAG" "$PREVIOUS_RELEASE_REF" \
+            --github-release --repo "${{ github.repository }}"

.envrc

@@ -16,11 +16,11 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
+  # Unit/component tests run under LuaJIT with a mocked vim global (busted), so
+  # they do not need a real Neovim binary — hence no neovim-version matrix here.
+  # Real-Neovim coverage lives in the integration-tests job below.
   unit-tests:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        neovim-version: ["stable", "nightly"]
 
     steps:
       - name: Checkout
@@ -29,38 +29,38 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Nix
-        uses: nixbuild/nix-quick-install-action@5bb6a3b3abe66fd09bbf250dce8ada94f856a703 # v30
+      # Build deps: PUC Lua builds from source, and the test rocks compile C modules.
+      - name: Install build dependencies
+        run: |
+          sudo apt-get -o Acquire::Retries=3 update
+          sudo apt-get -o Acquire::Retries=3 install -y build-essential libreadline-dev unzip
 
-      - uses: nix-community/cache-nix-action@135667ec418502fa5a3598af6fb9eb733888ce6a # v6.1.3
-        with:
-          primary-key: nix-claudecode-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-claudecode-${{ runner.os }}-
-          gc-max-store-size-linux: 2G
-          purge: true
-          purge-prefixes: nix-claudecode-${{ runner.os }}-
-          purge-created: 0
-          purge-primary-key: never
+      - name: Set up mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
 
-      - name: Setup Neovim
-        uses: rhysd/action-setup-vim@8e931b9954b19d4203d5caa5ff5521f3bc21dcc7 # v1.4.2
+      # Cache the rock tree (rebuilt from luarocks.org otherwise); a miss just rebuilds.
+      - name: Cache Lua test rocks
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
-          neovim: true
-          version: ${{ matrix.neovim-version }}
+          path: .luarocks
+          key: luarocks-${{ runner.os }}-${{ hashFiles('mise.toml') }}
+
+      - name: Install Lua test rocks
+        run: mise run setup
 
-      - name: Run Luacheck
-        run: nix develop .#ci -c make check
+      - name: Run luacheck
+        run: mise run check
 
       - name: Run tests
-        run: nix develop .#ci -c make test
+        run: mise run test
 
       - name: Check formatting
-        run: nix flake check
+        run: mise run format-check
 
       - name: Generate coverage report
         run: |
           if [ -f "luacov.stats.out" ]; then
-            nix develop .#ci -c luacov
+            mise exec -- luacov
 
             echo "Creating lcov.info from luacov.report.out"
             {
@@ -134,19 +134,8 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Nix
-        uses: nixbuild/nix-quick-install-action@5bb6a3b3abe66fd09bbf250dce8ada94f856a703 # v30
-
-      - uses: nix-community/cache-nix-action@135667ec418502fa5a3598af6fb9eb733888ce6a # v6.1.3
-        with:
-          primary-key: nix-claudecode-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
-          restore-prefixes-first-match: nix-claudecode-${{ runner.os }}-
-          gc-max-store-size-linux: 2G
-          purge: true
-          purge-prefixes: nix-claudecode-${{ runner.os }}-
-          purge-created: 0
-          purge-primary-key: never
-
+      # Neovim here comes from action-setup-vim (matrix-driven), independent of
+      # the mise.toml neovim pin used for local dev.
       - name: Setup Neovim
         uses: rhysd/action-setup-vim@8e931b9954b19d4203d5caa5ff5521f3bc21dcc7 # v1.4.2
         with:
@@ -159,4 +148,4 @@ jobs:
           ln -s "$(pwd)" ~/.local/share/nvim/site/pack/vendor/start/claudecode.nvim
 
       - name: Run integration tests
-        run: nix develop .#ci -c ./scripts/run_integration_tests_individually.sh
+        run: ./scripts/run_integration_tests_individually.sh

.github/workflows/claude.yml

@@ -6,6 +6,9 @@ luac.out
 *.zip
 *.tar.gz
 
+# Project-local Lua rock tree built by `mise run setup`
+/.luarocks/
+
 # Object files
 *.o
 *.os