Merge upstream main (05b697f6a2) into stage

.github/scripts/ci-changes.cjs

@@ -5,6 +5,8 @@
 //   node ci-changes.cjs --paths <file> --full   run every Linux job, gate only the macOS lint
 //   node ci-changes.cjs                         changed paths unknown: run everything
 //
+// scripts/check-changed.ts requires the same decisions so local runs match CI.
+//
 // Every changed path maps to workspace packages, which then pull in their
 // dependents from package.json. A path this file does not recognize runs
 // everything, so a new root file or directory can only cost minutes.
@@ -201,4 +203,6 @@ function main() {
   for (const [key, value] of Object.entries(outputs)) console.log(`${key}=${value}`);
 }
 
-main();
+module.exports = { readWorkspace, decide };
+
+if (require.main === module) main();

.github/scripts/ci-changes.d.cts

@@ -0,0 +1,27 @@
+interface WorkspacePackage {
+  readonly name: string;
+  readonly dir: string;
+  readonly hasTest: boolean;
+  readonly deps: ReadonlyArray<string>;
+}
+
+export function readWorkspace(): Array<WorkspacePackage>;
+
+export function decide(
+  files: ReadonlyArray<string> | null,
+  packages: ReadonlyArray<WorkspacePackage>,
+  full: boolean,
+): {
+  affected: Array<string>;
+  outputs: {
+    typecheck: boolean;
+    build: boolean;
+    test: boolean;
+    test_packages: string;
+    test_web: boolean;
+    test_server: boolean;
+    rust: boolean;
+    release_smoke: boolean;
+    mobile_native: boolean;
+  };
+};

.github/scripts/vercel-deployment-output.test.cjs

@@ -0,0 +1,87 @@
+const assert = require("node:assert/strict");
+const { spawnSync } = require("node:child_process");
+const { mkdtempSync, readFileSync, rmSync, existsSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+const { test } = require("node:test");
+
+const release = readFileSync(join(__dirname, "../workflows/release.yml"), "utf8");
+const preview = readFileSync(join(__dirname, "../workflows/web-preview.yml"), "utf8");
+const stepPattern =
+  /        name: (?:Build staged deployment|Deploy preview)\n        shell: bash\n        run: \|\n((?:          .*\n|\n)+)/g;
+const steps = [
+  ...Array.from(release.matchAll(stepPattern), (match, index) => [
+    index === 0 ? "hosted web" : "marketing",
+    match[1],
+  ]),
+  ...Array.from(preview.matchAll(stepPattern), (match) => ["web preview", match[1]]),
+];
+assert.equal(steps.length, 3, "Expected both release steps and the preview step");
+
+const url = "https://t3code-fixture-pinglabs.vercel.app";
+const warning = 'Error while parsing config file: "/runner/t3code/pnpm-lock.yaml"';
+
+function runStep(script, stdout, exitCode = 0) {
+  const directory = mkdtempSync(join(tmpdir(), "t3-vercel-output-"));
+  const outputFile = join(directory, "output");
+  try {
+    const result = spawnSync(
+      "bash",
+      [
+        "-c",
+        'vp() { printf "%s\\n" "$FIXTURE_STDOUT"; return "$FIXTURE_EXIT"; }\n' +
+          'curl() { printf \'{"id":"fixture-project"}\\n\'; }\n' +
+          script.replace(/^          /gm, "").replace(/\$\{\{.*?\}\}/g, "fixture"),
+      ],
+      {
+        encoding: "utf8",
+        env: {
+          PATH: process.env.PATH,
+          VERCEL_TOKEN: "fixture-token",
+          VERCEL_ORG_ID: "fixture-org",
+          VERCEL_PROJECT_ID: "fixture-project",
+          GITHUB_OUTPUT: outputFile,
+          FIXTURE_STDOUT: stdout,
+          FIXTURE_EXIT: String(exitCode),
+        },
+      },
+    );
+    assert.ifError(result.error);
+    return {
+      ...result,
+      output: existsSync(outputFile) ? readFileSync(outputFile, "utf8") : "",
+    };
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+}
+
+for (const [name, script] of steps) {
+  for (const [label, stdout] of [
+    ["plain URL", url],
+    ["lockfile warning", `${warning}\n${url}`],
+    ["trailing diagnostic", `${url}\nDone`],
+  ]) {
+    test(`${name}: saves one deployment URL after ${label}`, () => {
+      const result = runStep(script, stdout);
+      assert.equal(result.status, 0, result.stderr);
+      assert.deepEqual(
+        result.output.split("\n").filter((line) => !line.startsWith("project_id=")),
+        [`deployment_url=${url}`, ""],
+      );
+    });
+  }
+
+  for (const [label, stdout, exitCode] of [
+    ["missing URL", warning, 0],
+    ["invalid URL", "https://example.invalid/deployment", 0],
+    ["multiple URLs", `${url}\nhttps://other.vercel.app`, 0],
+    ["failed deployment", url, 1],
+  ]) {
+    test(`${name}: rejects ${label} without saving output`, () => {
+      const result = runStep(script, stdout, exitCode);
+      assert.notEqual(result.status, 0);
+      assert.equal(result.output, "");
+    });
+  }
+}

.github/workflows/ci.yml

@@ -253,7 +253,7 @@ jobs:
         run: python3 -B .github/scripts/stage-preview-bundle.test.py
 
       - name: Test release checks
-        run: node --test .github/scripts/check-nightly-release.test.cjs
+        run: node --test .github/scripts/check-nightly-release.test.cjs .github/scripts/vercel-deployment-output.test.cjs
 
       - name: Finish installing browser secret helper build libraries
         timeout-minutes: 5

.github/workflows/deploy-bkt3.yml

@@ -28,7 +28,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@v6
         with:
-          version: 11.10.0
+          version: 12.14.0
 
       - name: Set up Node.js
         uses: actions/setup-node@v7

.github/workflows/deploy-expbkt3.yml

@@ -29,7 +29,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@v6
         with:
-          version: 11.10.0
+          version: 12.14.0
 
       - name: Set up Node.js
         uses: actions/setup-node@v7

.github/workflows/deploy-stage.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@v6
         with:
-          version: 11.10.0
+          version: 12.14.0
 
       - name: Set up Node.js
         uses: actions/setup-node@v7

.github/workflows/release-desktop.yml

@@ -253,18 +253,13 @@ jobs:
           if [[ "${{ inputs.version }}" =~ -nightly\.[0-9]{8}\.[0-9]+$ ]]; then brand=nightly; fi
           node scripts/apply-web-brand-assets.ts "$brand" apps/server/dist/client
 
-      # The single-executable is built with a Node that supports --build-sea
-      # (25.7+); the repo itself stays on the engines.node version. A native
-      # build injects into the runner's own Node; a Windows target downloads its
-      # node.exe.
+      # Setup Vite+ selects the exact engines.node version from package.json.
+      # Native builds embed that executable; cross-target builds download the
+      # same version for their target.
       - name: Build CLI single-executable
         if: inputs.cli_archive
         shell: bash
         env:
-          # The exact version, not a major: vp downloads it from nodejs.org/dist on
-          # the runner, and only exact versions have a dist directory. Keep in
-          # step with SEA_NODE_VERSION in apps/server/vite.config.ts.
-          VP_NODE_VERSION: "26.8.2"
           # The executable bundles the server again, so it needs the same stamp
           # as release.yml's JS bundle.
           T3CODE_TELEMETRY_CHANNEL: ${{ github.repository == 'pingdotgg/t3code' && inputs.release_channel || 'dev' }}

.github/workflows/release.yml

@@ -1072,7 +1072,7 @@ jobs:
           fi
 
           echo "Building hosted web app for $channel_name channel."
-          deployment_url="$(
+          deployment_output="$(
             vp dlx vercel@53.1.1 deploy \
               --archive=tgz \
               --prod \
@@ -1091,6 +1091,13 @@ jobs:
               --build-env "VITE_HOSTED_APP_URL=$router_url" \
               --build-env "VITE_HOSTED_APP_CHANNEL=$channel_name"
           )"
+          printf '%s\n' "$deployment_output"
+          # Vercel can print lockfile warnings to stdout before the deployment URL.
+          deployment_url="$(printf '%s\n' "$deployment_output" | grep -E '^https://[[:alnum:].-]+\.vercel\.app$')"
+          if [[ "$deployment_url" == *$'\n'* ]]; then
+            echo "Vercel returned multiple deployment URLs." >&2
+            exit 1
+          fi
           echo "Staged $deployment_url."
           echo "deployment_url=$deployment_url" >> "$GITHUB_OUTPUT"
 
@@ -1219,7 +1226,7 @@ jobs:
           )"
           export VERCEL_PROJECT_ID
 
-          deployment_url="$(
+          deployment_output="$(
             vp dlx vercel@53.1.1 deploy \
               --archive=tgz \
               --prod \
@@ -1228,6 +1235,13 @@ jobs:
               --token "$VERCEL_TOKEN" \
               --scope "${VERCEL_TEAM_SLUG:-$VERCEL_ORG_ID}"
           )"
+          printf '%s\n' "$deployment_output"
+          # Vercel can print lockfile warnings to stdout before the deployment URL.
+          deployment_url="$(printf '%s\n' "$deployment_output" | grep -E '^https://[[:alnum:].-]+\.vercel\.app$')"
+          if [[ "$deployment_url" == *$'\n'* ]]; then
+            echo "Vercel returned multiple deployment URLs." >&2
+            exit 1
+          fi
           echo "Staged $deployment_url."
           echo "deployment_url=$deployment_url" >> "$GITHUB_OUTPUT"
           echo "project_id=$VERCEL_PROJECT_ID" >> "$GITHUB_OUTPUT"

.github/workflows/web-preview.yml

@@ -77,13 +77,20 @@ jobs:
 
           vercel_scope="${VERCEL_TEAM_SLUG:-$VERCEL_ORG_ID}"
 
-          deployment_url="$(
+          deployment_output="$(
             vp dlx vercel@53.1.1 deploy \
               --archive=tgz \
               --yes \
               --token "$VERCEL_TOKEN" \
               --scope "$vercel_scope"
           )"
+          printf '%s\n' "$deployment_output"
+          # Vercel can print lockfile warnings to stdout before the deployment URL.
+          deployment_url="$(printf '%s\n' "$deployment_output" | grep -E '^https://[[:alnum:].-]+\.vercel\.app$')"
+          if [[ "$deployment_url" == *$'\n'* ]]; then
+            echo "Vercel returned multiple deployment URLs." >&2
+            exit 1
+          fi
 
           echo "Deployed $deployment_url"
           echo "deployment_url=$deployment_url" >> "$GITHUB_OUTPUT"

.pnpmfile.cjs

@@ -0,0 +1,21 @@
+// Windows WSL dev mode runs the server under Linux from the same node_modules
+// as the Windows client, so Windows installs also need Linux x64 glibc native
+// modules. Other platforms install only their own binaries; setting this
+// everywhere added ~2.2 GB of foreign binaries to every macOS install.
+// Release scripts stage their own installs with explicit architectures.
+module.exports = {
+  hooks: {
+    updateConfig(config) {
+      // oxlint-disable-next-line t3code/no-global-process-runtime -- pnpm loads this file before any Effect runtime exists.
+      if (process.platform !== "win32") return config;
+      return {
+        ...config,
+        supportedArchitectures: {
+          os: ["current", "linux"],
+          cpu: ["current", "x64"],
+          libc: ["current", "glibc"],
+        },
+      };
+    },
+  },
+};

.vercelignore

@@ -0,0 +1,2 @@
+# Vercel's default .pnp* rule also excludes pnpm's hook, whose checksum is in the lockfile.
+!/.pnpmfile.cjs

AGENTS.md

@@ -157,6 +157,7 @@ The most common defect in this repo is a change that works on the path you teste
 ## Dev servers
 
 - `vp i` installs. Worktrees get this from the t3.json setup script; if module resolution looks broken, it probably did not run.
+- Setup runs in the background. While `.t3/setup-running` names a live PID, wait for it and do not run `vp i`. It ends with `.t3/setup-done` or `.t3/setup-failed` (with the error tail). With no marker at all, setup never ran here, so run `vp i` yourself.
 - `vp run dev` starts server and web. In a worktree, state defaults to that worktree's gitignored `.t3`, which deliberately outranks an ambient `T3CODE_HOME` so you cannot land on shared state by accident. An explicit `--home-dir` still wins.
 - Ports derive from the worktree path and are stable across restarts, but read the real ones from the `[dev-runner]` line since occupied ports shift.
 - Sharing over the tailnet is three steps: run `vp run dev --share` in the background, wait for the `pairingUrl:` line in its output, then give that full URL to an unpaired browser. Do not wire up `tailscale serve` by hand, open the URL yourself, or consume the user's pairing link. A browser with the reusable dev cookie can use the bare origin. If a normal one-time token was consumed, mint a fresh one with `node apps/server/src/bin.ts pair`. It carries standard scopes, while the startup URL carries admin scopes needed for Connections settings.
@@ -168,22 +169,25 @@ The most common defect in this repo is a change that works on the path you teste
 
 An empty database is a bad test. Seed your worktree's `.t3` with a copy of real data instead of pointing at live state:
 
-- Run `vp run migrate-dev-db` with your dev server stopped. It rebuilds `<worktree>/.t3/userdata/statev2.sqlite` from a read-only snapshot of `~/.t3/userdata/statev2.sqlite`, the developer's real data. It keeps recent projects and their stopped threads, and drops scheduled tasks, pending work, and auth sessions, so your dev server never runs the developer's agents. Raise `--projects` and `--threads-per-project` for more data.
+- The first `vp run dev` in a worktree does this for you when its database is missing. `--no-seed` or `T3CODE_DEV_SEED=0` skips it.
+- Run `vp run migrate-dev-db` with your dev server stopped to refresh. It rebuilds `<worktree>/.t3/userdata/statev2.sqlite` from a read-only snapshot of `~/.t3/userdata/statev2.sqlite`, the developer's real data. It keeps recent projects and their stopped threads, and drops scheduled tasks, pending work, and auth sessions, so your dev server never runs the developer's agents. Raise `--projects` and `--threads-per-project` for more data.
 - Refresh `statev2.sqlite`, not `state.sqlite`. The server copies the V1 `state.sqlite` only when `statev2.sqlite` is missing.
 - Bring `secrets` and `settings.json` only if the flow under test needs them.
 - Copy in, never symlink. Data flows one way: into your sandbox, never back out.
 
 ## Verifying
 
-- Smallest proof that the change works. `vp test run <files>` for the tests you touched (`-t "<name>"` in big files), `vp lint <files>`, and `vp run typecheck` in the package you changed. Not `npx tsc`; it is 3x slower than tsc-rs.
-- Run `vp run knip:check` (about 35 s) when you add, remove, or rename exports, files, or dependencies.
+- Before you push, run `vp run check:changed`. It runs CI's fast checks for changed files: format, lint, knip, typecheck of affected packages and dependents, and tests beside changes. CI still runs the full test suites.
+- While you iterate, run `vp test run <files>`. For big files, add `-t "<name>"`.
+- Do not use `npx tsc`. Use `vp run typecheck`; it uses tsc-rs, which is 3x faster.
 - Run `node -e` snippets from `apps/server` or the owning package. `effect` does not resolve from the repo root.
 - Test meaningful logic or observable behavior. Do not render components to static markup to assert props or attributes, or add tests that merely assert callback wiring or mirror the implementation.
 - **Do not run repo-wide checks.** No `vp check`, no `vp run -r test`, no `vp run -r typecheck` unless I ask. CI owns the full suite.
   - In the Beknown fork this is a hard rule, not a preference: the dev server is shared by both T3 Code deployments, every agent session, branch databases, and self-hosted runners, and full-suite runs have OOM-crashed it. Never run a repo-wide build either — deployments install GitHub-built artifacts, so nothing needs building here.
   - The loop is: push the branch, open the PR, watch CI remotely with `gh pr checks <n> --watch` and `gh run view <id> --log-failed`, then push fixes from this box. The fork's deploy workflows run on GitHub-hosted `ubuntu-latest`, so they are real offload.
   - Check headroom with `free -g` and `uptime` before anything long. Under ~6G available or load above ~12, move the work to CI instead.
 - Backend behavior changes ship with focused tests for that behavior.
+- Proof for a bug fix depends on the bug. Logic, data, state, and protocol bugs get a failing test first (the fewest that fail on `main` for that reason, in the module's existing test file), then the fix. Purely visual bugs (spacing, colour, alignment, a layout shift) get before/after captures as their proof and no test: do not add UI tests for nitpicks, and do not ask for one in review when a capture already shows it. A server-only fix with no visible surface ships the test plus a short runtime transcript.
 - The server is event-sourced, and side effects run after the command commits. In tests, drain the effect worker (`OrchestrationEffectWorkerV2.drain`) or await the specific persisted event or `Deferred` that marks the milestone. Never wait on sleeps or polling. A test that needs a timeout to pass is wrong. Concretely:
   - `it.effect` runs on a `TestClock`; `Effect.sleep` only advances through `TestClock.adjust`. `it.live` is wall-clock and only for subprocess or network fixtures.
   - No `yieldNow` or `sleep` polling loops. Await the `Deferred`, take from the `Queue`, or drain the worker.
@@ -258,7 +262,7 @@ Architecture and its constraints: `docs/internals/overview.md`. Glossary: `docs/
 - `packages/contracts` - Effect/Schema contracts plus small derived helpers. No heavy runtime logic.
 - `packages/shared` - shared runtime utils, subpath exports, no barrel.
 - `packages/client-runtime` - client code shared by web and mobile.
-- `.repos/` - vendored read-only references. Prefer their patterns over invented ones. Never edit or import from them. Sync with `vpr sync:repos` when bumping the matching dependency.
+- `.repos/` - vendored read-only references. Prefer their patterns over invented ones. Never edit or import from them. Sync with `vpr sync:repos` when bumping the matching dependency. If it is missing (sparse checkout), read a file with `git show origin/main:.repos/<path>`.
 
 ## Taste
 

apps/desktop/package.json

@@ -7,7 +7,6 @@
   "scripts": {
     "ensure:electron": "node scripts/ensure-electron-runtime.mjs",
     "start": "node scripts/start-electron.mjs",
-    "typecheck": "tsc-rs --noEmit",
     "test": "vp test run --passWithNoTests",
     "smoke-test": "node scripts/smoke-test.mjs"
   },

apps/desktop/vite.config.ts

@@ -63,6 +63,11 @@ export default defineConfig({
         dependsOn: ["t3#build"],
         cache: false,
       },
+      // tsc-rs rewrites the tsbuildinfo it reads, which keeps a task out of the cache.
+      typecheck: {
+        command: "tsc-rs --noEmit",
+        cache: { input: [{ auto: true }, "!*.tsbuildinfo"] },
+      },
     },
   },
   pack: [
@@ -165,6 +170,9 @@ export default defineConfig({
     // The Windows lane runs workspace suites concurrently; filesystem-heavy
     // desktop integration tests can exceed Vitest's 5 second default there.
     testTimeout: 15_000,
-    setupFiles: ["../../packages/shared/src/testing/longTempDir.ts"],
+    setupFiles: [
+      "../../packages/shared/src/testing/longTempDir.ts",
+      "../../packages/shared/src/testing/providerEnv.ts",
+    ],
   },
 });

apps/marketing/astro.config.mjs

@@ -1,5 +1,11 @@
 import { defineConfig } from "astro/config";
 
+// Astro loads env with an empty prefix, and under `vp run` Vite+'s loadEnv then reports every
+// variable to the task cache. Any env difference (TERM, VP_RAW_SUBCOMMAND, an agent's session
+// vars) would rerun `astro check`. Without the runner client, loadEnv reads process.env directly;
+// file tracking does not use this client.
+delete process.env.VP_RUN_NODE_CLIENT_PATH;
+
 export default defineConfig({
   site: "https://t3.codes",
   server: {

apps/marketing/package.json

@@ -7,8 +7,7 @@
     "stage:install-scripts": "node scripts/stage-install-scripts.mjs",
     "dev": "node scripts/stage-install-scripts.mjs && astro dev",
     "build": "node scripts/stage-install-scripts.mjs && astro build",
-    "preview": "astro preview",
-    "typecheck": "astro check"
+    "preview": "astro preview"
   },
   "dependencies": {
     "@t3tools/shared": "workspace:*",

apps/marketing/vite.config.ts

@@ -0,0 +1,15 @@
+import { defineConfig } from "vite-plus";
+
+// Astro reads astro.config.mjs. This file only configures `vp run` tasks.
+export default defineConfig({
+  run: {
+    tasks: {
+      // `astro check` regenerates .astro/*.d.ts and then reads them, which
+      // keeps a task out of the cache. Its real inputs are tracked as usual.
+      typecheck: {
+        command: "astro check",
+        cache: { input: [{ auto: true }, "!.astro/**"] },
+      },
+    },
+  },
+});