chore: import upstream snapshot with attribution

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,74 @@
+name: Bug report
+description: Report a bug or unexpected behavior
+title: "[bug] "
+labels: [bug]
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Describe the bug
+      description: A clear, concise description of what's wrong.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: The minimum sequence that triggers the bug.
+      placeholder: |
+        1.
+        2.
+        3.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What you expected to happen.
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What actually happened. Include error messages, screenshots, or log excerpts.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: MagenticLite version
+      description: Output of `magentic-ui --version`.
+      placeholder: 0.2.0
+    validations:
+      required: true
+  - type: dropdown
+    id: os
+    attributes:
+      label: Operating system
+      options:
+        - Linux
+        - macOS
+        - Windows
+        - Windows (WSL)
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: python
+    attributes:
+      label: Python version
+      placeholder: "3.12"
+    validations:
+      required: true
+  - type: input
+    id: model
+    attributes:
+      label: Model client / provider
+      description: Which orchestrator / web-surfer model you're running.
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Config snippets (with secrets redacted), recent changes, workarounds tried.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question or discussion
+    url: https://github.com/microsoft/magentic-ui/discussions
+    about: For usage questions and general discussion, please use Discussions instead of an issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,29 @@
+name: Feature request
+description: Suggest a new feature or improvement
+title: "[feature] "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem does this solve?
+      description: Describe the use case or pain point. What are you trying to do?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: How would you like it to work? UI, API, or behavior.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Other approaches you thought about and why they're not ideal.
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Mockups, links to similar projects, related issues.

.github/dependabot.yml

@@ -0,0 +1,79 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/" # project root (where pyproject.toml and uv.lock live)
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "npm"
+    directory: "/frontend"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    # Suppress major-version PRs for packages that need to track an external baseline.
+    ignore:
+      # Keep @types/node on the current Node major (24) to match the runtime baseline
+      # declared in package.json (>=24); bump it manually when we intentionally raise
+      # that baseline to a new major.
+      - dependency-name: "@types/node"
+        update-types: ["version-update:semver-major"]
+      # TypeScript majors often introduce stricter narrowing across the whole project.
+      # Bump manually when we're ready to handle the fallout.
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
+      # Vite 8 swaps the bundler/transform stack to Rolldown + Oxc. Wait for the
+      # ecosystem (vitest, @tailwindcss/vite, @vitejs/plugin-react) to stabilize
+      # — re-evaluate around vite 8.2 or when we hit a feature we need.
+      - dependency-name: "vite"
+        update-types: ["version-update:semver-major"]
+      # @vitejs/plugin-react v6 drops Vite 7 support; bump in lockstep with vite.
+      - dependency-name: "@vitejs/plugin-react"
+        update-types: ["version-update:semver-major"]
+      # ESLint 10 majors can ripple through plugins (typescript-eslint,
+      # eslint-plugin-react, etc.); bump manually once peer deps are aligned.
+      - dependency-name: "eslint"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@eslint/js"
+        update-types: ["version-update:semver-major"]
+      # Test/build tooling that we intentionally pin to its current major to
+      # avoid noisy PRs without real benefit:
+      # - jsdom: vitest's environment; follow vitest's recommended version
+      # - globals: ESLint plugin support; staying on 16.x is fine
+      # - rollup-plugin-visualizer: dev-only build analyzer
+      - dependency-name: "jsdom"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "globals"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "rollup-plugin-visualizer"
+        update-types: ["version-update:semver-major"]
+      # Project doesn't use Redux — package will be removed from package.json
+      # in a separate PR. Suppress all updates in the meantime.
+      - dependency-name: "@redux-devtools/extension"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
+    # Group routine version bumps so we don't drown in PRs.
+    # Security updates always open as standalone PRs regardless of grouping.
+    groups:
+      frontend-dev-dependencies:
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"
+      frontend-prod-dependencies:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+      # Quiet down dev-only major bumps (vite, jsdom, rollup plugins, etc.)
+      # into a single weekly PR. Prod majors stay standalone for individual review.
+      frontend-dev-majors:
+        dependency-type: "development"
+        update-types:
+          - "major"

.github/pull_request_template.md

@@ -0,0 +1,27 @@
+## Related Issue
+
+<!-- Link the related issue, e.g., Fixes #123 -->
+
+## Summary
+
+<!-- Briefly explain what this PR does and why. -->
+
+## Changes
+
+<!-- List the key changes in this PR. -->
+
+- ...
+
+## How to Verify
+
+<!-- Steps for reviewers to test or validate this change. -->
+
+1. ...
+2. ...
+3. ...
+
+## Checklist
+
+- [ ] Tests added or updated (if applicable)
+- [ ] Documentation updated (if needed)
+- [ ] Verified using the steps above

.github/workflows/checks.yaml

@@ -0,0 +1,195 @@
+name: Checks (magui2.0)
+
+on:
+  push:
+    branches:
+      - main
+      - 'release/**'
+  pull_request:
+    branches:
+      - main
+      - 'release/**'
+  schedule:
+    - cron: "0 3 * * 1" # Every Monday at 03:00 UTC
+
+permissions:
+  contents: read
+
+jobs:
+  # Python checks
+  python-format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          version: "0.7.11"
+      - uses: actions/setup-python@v5
+        with:
+          python-version-file: ".python-version"
+      - run: uv sync --all-extras
+        working-directory: .
+      - name: Run format check
+        run: |
+          source .venv/bin/activate
+          poe fmt --check
+
+  python-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          version: "0.7.11"
+      - uses: actions/setup-python@v5
+        with:
+          python-version-file: ".python-version"
+      - run: uv sync --all-extras
+        working-directory: .
+      - name: Run lint
+        run: |
+          source .venv/bin/activate
+          poe lint
+
+  python-pyright:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          version: "0.7.11"
+      - uses: actions/setup-python@v5
+        with:
+          python-version-file: ".python-version"
+      - run: uv sync --all-extras
+        working-directory: .
+      - name: Run pyright
+        run: |
+          source .venv/bin/activate
+          poe pyright
+
+  python-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          version: "0.7.11"
+      - uses: actions/setup-python@v5
+        with:
+          python-version-file: ".python-version"
+      - run: uv sync --all-extras
+        working-directory: .
+      - name: Get Playwright version
+        id: playwright-version
+        run: |
+          source .venv/bin/activate
+          echo "version=$(playwright --version | awk '{print $2}')" >> "$GITHUB_OUTPUT"
+      - name: Cache Playwright browsers
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ steps.playwright-version.outputs.version }}
+      - name: Install Playwright browsers
+        run: |
+          source .venv/bin/activate
+          playwright install --with-deps
+      - name: Run tests
+        run: |
+          source .venv/bin/activate
+          pytest tests --cov=src --cov-report=xml --cov-report=term-missing
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-magentic-ui
+          path: coverage.xml
+
+  # Frontend checks
+  frontend-format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm install -g pnpm@10.24.0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: "pnpm"
+          cache-dependency-path: "frontend/pnpm-lock.yaml"
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: frontend
+      - name: Format check
+        run: pnpm run format:check
+        working-directory: frontend
+
+  frontend-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm install -g pnpm@10.24.0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: "pnpm"
+          cache-dependency-path: "frontend/pnpm-lock.yaml"
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: frontend
+      - name: Lint
+        run: pnpm run lint
+        working-directory: frontend
+
+  frontend-typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm install -g pnpm@10.24.0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: "pnpm"
+          cache-dependency-path: "frontend/pnpm-lock.yaml"
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: frontend
+      - name: Type check
+        run: pnpm run type-check
+        working-directory: frontend
+
+  frontend-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - run: npm install -g pnpm@10.24.0
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+          cache: "pnpm"
+          cache-dependency-path: "frontend/pnpm-lock.yaml"
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+        working-directory: frontend
+      - name: Test
+        run: pnpm run test:run
+        working-directory: frontend
+# Turn on this step after open source.
+#   codecov:
+#     runs-on: ubuntu-latest
+#     needs: [python-test]
+#     steps:
+#       - uses: actions/checkout@v7
+#       - uses: actions/download-artifact@v4
+#         with:
+#           name: coverage-magentic-ui
+#           path: ./
+#       - uses: codecov/codecov-action@v5
+#         with:
+#           files: coverage.xml
+#           flags: unittests
+#           name: codecov-umbrella
+#           fail_ci_if_error: true
+#           token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/codeql.yml

@@ -0,0 +1,102 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main", "release/**" ]
+  pull_request:
+    branches: [ "main", "release/**" ]
+  schedule:
+    - cron: '34 1 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: javascript-typescript
+          build-mode: none
+        - language: python
+          build-mode: none
+        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
+        # Use `c-cpp` to analyze code written in C, C++ or both
+        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v7
+
+    # Add any setup steps before running the `github/codeql-action/init` action.
+    # This includes steps like installing compilers or runtimes (`actions/setup-node`
+    # or others). This is typically only required for manual builds.
+    # - name: Setup runtime (example)
+    #   uses: actions/setup-example@v1
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    # If the analyze step fails for one of the languages you are analyzing with
+    # "We were unable to automatically build your code", modify the matrix above
+    # to set the build mode to "manual" for that language. Then modify this step
+    # to build your code.
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    - if: matrix.build-mode == 'manual'
+      shell: bash
+      run: |
+        echo 'If you are using a "manual" build mode for one or more of the' \
+          'languages you are analyzing, replace this with the commands to build' \
+          'your code, for example:'
+        echo '  make bootstrap'
+        echo '  make release'
+        exit 1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/release.yml

@@ -0,0 +1,76 @@
+name: Build & Release Wheel
+
+on:
+  workflow_dispatch:
+    inputs:
+      create_release:
+        description: "Create a GitHub Release with the wheel"
+        type: boolean
+        default: false
+      overwrite_existing:
+        description: "Overwrite existing release with same version tag"
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v6
+        with:
+          version: 10
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: pnpm install --frozen-lockfile
+
+      - name: Build frontend
+        working-directory: frontend
+        run: pnpm build
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Build wheel
+        run: |
+          pip install build
+          python -m build --wheel
+
+      - name: Create GitHub Release
+        if: ${{ inputs.create_release }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          VERSION=$(python -c "exec(open('src/magentic_ui/version.py').read()); print(VERSION)")
+          TAG="v$VERSION"
+          # Mark as prerelease when the version has an alpha/beta/rc suffix.
+          PRERELEASE_FLAG=""
+          if [[ "$VERSION" =~ (a|b|rc)[0-9]+$ ]]; then
+            PRERELEASE_FLAG="--prerelease"
+          fi
+          # Check if release already exists
+          if gh release view "$TAG" >/dev/null 2>&1; then
+            if [ "${{ inputs.overwrite_existing }}" != "true" ]; then
+              echo "::error::Release $TAG already exists. Bump version in version.py or enable 'Overwrite existing release'."
+              exit 1
+            fi
+            echo "Overwriting existing release $TAG..."
+            gh release delete "$TAG" --yes --cleanup-tag
+          fi
+          gh release create "$TAG" dist/*.whl \
+            --generate-notes \
+            $PRERELEASE_FLAG