fork: update .gitattributes and FORK_CHANGES.md for merge-commit strategy

- Add merge=ours protection for domain override files (installation,
  server, oauth-provider) that upstream also modifies
- Protect .gitattributes and AGENTS.md from upstream overwrites
- Reorganize .gitattributes with clearer section comments
- Update merge cheat sheet in FORK_CHANGES.md to document the new
  tag-based merge workflow, feature branch --no-ff merges, and
  cherry-pick strategy for urgent fixes

Author: manno23

.gitattributes

@@ -1,34 +1,45 @@
-# Fork merge drivers
+# Fork merge drivers — used with `git merge <upstream-tag>` strategy
 # Files marked merge=ours always keep the fork's version during upstream merges.
 # Requires: git config merge.ours.driver true
+#
+# Strategy: we merge upstream release tags onto main. These rules prevent
+# conflicts on fork-owned files. Files that don't exist upstream are listed
+# for documentation purposes (they won't conflict but are clearly fork-only).
 
-# Fork-owned session management (not in upstream)
+# --- Fork-only packages (no upstream equivalent) ---
 packages/cloudsession/** merge=ours
+packages/worker-test/** merge=ours
 
-# Fork environment config
-packages/opencode/.env.example merge=ours
+# --- Fork infrastructure overlaying upstream packages ---
 
-# Fork web infrastructure (SolidJS+Hono rewrite, not upstream Astro)
+# Web: SolidJS+Hono rewrite (upstream uses Astro SSR)
 packages/web/wrangler.jsonc merge=ours
 packages/web/vite.config.ts merge=ours
 packages/web/src/worker.ts merge=ours
 packages/web/README.md merge=ours
 
-# Fork function worker config
+# Function: Cloudflare Workers deployment
 packages/function/wrangler.jsonc merge=ours
 packages/function/docs/** merge=ours
 
-# Fork worker-test package (not in upstream)
-packages/worker-test/** merge=ours
-
-# Fork gitignore has extra entries for cloudflare/fork files
-.gitignore merge=ours
-
-# Fork divergence documentation
-FORK_CHANGES.md merge=ours
+# --- Fork-modified opencode core files ---
 
-# Fork network filter (blocks upstream domains, allows fork domains)
+# Network filter (blocks upstream domains, allows fork domains)
 packages/opencode/src/util/network.ts merge=ours
 
-# Fork share implementation
+# Share implementation (capnweb RPC rewrite)
 packages/opencode/src/share/** merge=ours
+
+# Fork environment config
+packages/opencode/.env.example merge=ours
+
+# Domain overrides in these files (opencode.ai -> j9xym.com)
+packages/opencode/src/installation/index.ts merge=ours
+packages/opencode/src/server/server.ts merge=ours
+packages/opencode/src/mcp/oauth-provider.ts merge=ours
+
+# --- Root config files ---
+.gitignore merge=ours
+.gitattributes merge=ours
+AGENTS.md merge=ours
+FORK_CHANGES.md merge=ours

FORK_CHANGES.md

@@ -140,16 +140,24 @@ git config rerere.autoupdate true
 # Register ours merge driver (keeps fork version for marked files)
 git config merge.ours.driver true
 
-# Standard merge from upstream
-git fetch upstream
-git merge upstream/dev
+# --- Upstream sync: merge release tags ---
+git fetch upstream --tags
+git checkout dev && git merge --ff-only upstream/dev   # keep dev as clean mirror
+git checkout main && git merge v1.2.XX -m "upstream: sync to v1.2.XX"
 
-# For "deleted by us" conflicts (SST files, disabled workflows):
+# --- For "deleted by us" conflicts (SST files, disabled workflows):
 git rm <file>
 
-# After merge, always regenerate lockfile:
+# --- After merge, always regenerate lockfile:
 bun install
 
-# Typecheck (excludes console/enterprise packages):
+# --- Feature branches: merge with --no-ff ---
+git checkout main
+git merge --no-ff feat/my-feature -m "feat: description"
+
+# --- Urgent upstream fix between releases:
+git cherry-pick <upstream-commit-hash>
+
+# --- Typecheck (excludes console/enterprise packages):
 bun run typecheck
 ```