Merge upstream v0.1.8-nightly.20261107.4340

.github/actions/setup-ci-deps/action.yml

@@ -13,6 +13,10 @@ inputs:
     description: Arguments for `vp install`, such as filters. Empty installs the whole workspace.
     required: false
     default: ""
+  save-pnpm-store:
+    description: Set to "false" when a concurrent job with the same install args saves the pnpm store
+    required: false
+    default: "true"
 runs:
   using: composite
   steps:
@@ -125,9 +129,11 @@ runs:
     # A filtered install that started from the current full store adds nothing
     # worth a second copy of it. A stacked PR, based on a branch other than the
     # default, saves a ~1 GB store only its own reruns can read, so it only restores.
+    # Concurrent jobs with the same install args reserve one key, so the losers
+    # compress the store for nothing; all but one pass save-pnpm-store: false.
     - name: Save pnpm store
       if: >-
-        inputs.install == 'true' &&
+        inputs.install == 'true' && inputs.save-pnpm-store == 'true' &&
         (github.event_name != 'pull_request' || github.base_ref == github.event.repository.default_branch) &&
         steps.pnpm_cache.outputs.cache-hit != 'true' &&
         (steps.pnpm_store.outputs.namespace == 'full' ||

.github/workflows/release-desktop.yml

@@ -77,6 +77,12 @@ on:
         required: false
         default: ""
         type: string
+      # Whether this job saves the workspace pnpm store. Release's two Macs
+      # install the same store on the same runner type, so only one saves it.
+      save_pnpm_store:
+        required: false
+        default: true
+        type: boolean
       version:
         required: true
         type: string
@@ -160,6 +166,7 @@ jobs:
         uses: ./.github/actions/setup-ci-deps
         with:
           install-args: --filter=@t3tools/desktop... --filter=t3... --filter=@t3tools/scripts...
+          save-pnpm-store: ${{ inputs.save_pnpm_store }}
         env:
           pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
 
@@ -408,6 +415,7 @@ jobs:
         run: command -v patchelf || { sudo apt-get update && sudo apt-get install -y patchelf; }
 
       - name: Build CLI archive
+        id: build_cli
         if: inputs.cli_archive
         shell: bash
         env:
@@ -425,25 +433,38 @@ jobs:
           AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME: ${{ secrets.AZURE_TRUSTED_SIGNING_CERTIFICATE_PROFILE_NAME }}
         run: |
           set -euo pipefail
-          if [[ "${{ inputs.platform }}" == "mac" && -n "${APPLE_API_KEY:-}" ]]; then
-            key_path="$RUNNER_TEMP/AuthKey_cli_${APPLE_API_KEY_ID}.p8"
-            printf '%s' "$APPLE_API_KEY" > "$key_path"
-            export APPLE_API_KEY="$key_path"
+          extra_args=()
+          if [[ "${{ inputs.platform }}" == "mac" ]]; then
+            if [[ -n "${APPLE_API_KEY:-}" ]]; then
+              key_dir="$(mktemp -d "$RUNNER_TEMP/t3-cli-notary.XXXXXXXX")"
+              trap 'rm -rf "$key_dir"' EXIT
+              key_path="$key_dir/AuthKey.p8"
+              (umask 077 && printf '%s' "$APPLE_API_KEY" > "$key_path")
+              export APPLE_API_KEY="$key_path"
+            fi
+            # Older release refs lack deferred notarization and still wait here.
+            cli_help="$(node scripts/build-cli-archive.ts --help)"
+            if [[ "$cli_help" == *--notary-submission-file* ]]; then
+              extra_args=(--notary-submission-file "$RUNNER_TEMP/t3-cli-notary-submission")
+              echo "deferred_notarization=true" >> "$GITHUB_OUTPUT"
+            fi
           fi
           node scripts/build-cli-archive.ts \
             --platform "${{ inputs.platform }}" \
             --arch "${{ inputs.arch }}" \
             --version "${{ inputs.version }}" \
             --resource-monitor-dir "$RUNNER_TEMP/cli-resource-monitor" \
-            --output-dir release-cli
+            --output-dir release-cli \
+            ${extra_args[@]+"${extra_args[@]}"}
 
       - name: Smoke-test CLI archive
         if: inputs.cli_archive && inputs.verify_runner == ''
         shell: bash
         run: node scripts/smoke-cli-archive.ts --archive release-cli/* --expect-version "${{ inputs.version }}"
 
+      # macOS uploads its archive after "Await CLI notarization" instead.
       - name: Upload CLI archive
-        if: inputs.cli_archive
+        if: inputs.cli_archive && inputs.platform != 'mac'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: cli-${{ inputs.platform }}-${{ inputs.arch }}
@@ -620,6 +641,39 @@ jobs:
 
           vp run dist:desktop:artifact "${args[@]}"
 
+      # The CLI was submitted without waiting so Apple reviews it while the
+      # desktop builds. Notarization does not change the archive bytes, but
+      # nothing uploads them, so nothing publishes them, until Apple accepts.
+      # With signing configured, a missing submission id fails this step.
+      - name: Await CLI notarization
+        if: inputs.cli_archive && inputs.platform == 'mac' && steps.build_cli.outputs.deferred_notarization == 'true'
+        shell: bash
+        env:
+          APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
+          APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
+          APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
+        run: |
+          set -euo pipefail
+          if [[ -n "${APPLE_API_KEY:-}" ]]; then
+            key_dir="$(mktemp -d "$RUNNER_TEMP/t3-cli-notary.XXXXXXXX")"
+            trap 'rm -rf "$key_dir"' EXIT
+            key_path="$key_dir/AuthKey.p8"
+            (umask 077 && printf '%s' "$APPLE_API_KEY" > "$key_path")
+            export APPLE_API_KEY="$key_path"
+          fi
+          node scripts/build-cli-archive.ts await-notarization \
+            --submission-file "$RUNNER_TEMP/t3-cli-notary-submission"
+
+      - name: Upload notarized CLI archive
+        if: inputs.cli_archive && inputs.platform == 'mac'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: cli-${{ inputs.platform }}-${{ inputs.arch }}
+          path: release-cli/*
+          if-no-files-found: error
+          # The archive is already gzip or zip; deflating it again saves under 2%.
+          compression-level: 0
+
       # Warm installs only touch the store index, so new content means a fetch.
       - name: Check staged install cache for new content
         id: stage_pnpm_changed

.github/workflows/release.yml

@@ -517,6 +517,8 @@ jobs:
     if: ${{ !cancelled() && needs.preflight.result == 'success' && needs.relay_public_config.result == 'success' }}
     runs-on: blacksmith-32vcpu-ubuntu-2404
     timeout-minutes: 30
+    outputs:
+      npm_launcher_artifact_id: ${{ steps.npm_launcher.outputs.artifact-id }}
     env:
       T3CODE_CLERK_PUBLISHABLE_KEY: ${{ needs.relay_public_config.outputs.clerk_publishable_key }}
       T3CODE_CLERK_JWT_TEMPLATE: ${{ needs.relay_public_config.outputs.clerk_jwt_template }}
@@ -604,6 +606,22 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+      # publish_cli publishes this exact tarball, so the trusted publisher
+      # needs no workspace checkout or install. It is version-matched here.
+      - name: Build the npm launcher
+        run: node scripts/build-npm-launcher.ts --version "${{ needs.preflight.outputs.version }}" --output-dir npm-packages
+
+      # GitHub allows a failed-jobs rerun for 30 days. publish_cli downloads
+      # this upload by its ID, which a publish_cli-only rerun keeps.
+      - name: Upload the npm launcher
+        id: npm_launcher
+        uses: actions/upload-artifact@v7
+        with:
+          name: npm-launcher
+          path: npm-packages/t3.tgz
+          if-no-files-found: error
+          retention-days: 30
+
   # One job per platform and architecture (see release-desktop.yml), each
   # gated only on the JS bundle. Windows targets build on Linux and run their
   # native checks on a Windows runner of their own architecture.
@@ -635,6 +653,8 @@ jobs:
       resource_key: darwin-arm64
       cli_archive: true
       launch_check: true
+      # desktop_mac_x64 saves the shared pnpm store; this job finishes last.
+      save_pnpm_store: false
 
   desktop_mac_x64:
     name: Desktop macOS x64
@@ -806,6 +826,24 @@ jobs:
         with:
           install-args: --filter=@t3tools/scripts...
 
+      # Overlaps the artifact downloads. The wait below ends it before any
+      # workspace script runs, so the Play key lives only in this process.
+      # `exec` lets the runner's stop signals reach node directly.
+      - id: android_apk
+        name: Download nightly Android APK
+        if: needs.preflight.outputs.release_channel == 'nightly'
+        background: true
+        continue-on-error: true
+        timeout-minutes: 5
+        env:
+          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
+          PACKAGE_NAME: com.t3tools.t3code
+          APK_OUTPUT_DIR: ${{ runner.temp }}/android-apk
+        run: |
+          if [ -n "$GOOGLE_PLAY_SERVICE_ACCOUNT_JSON" ]; then
+            exec node .github/scripts/mirror-play-apk.cjs
+          fi
+
       - name: Download all desktop artifacts
         uses: actions/download-artifact@v8
         with:
@@ -820,18 +858,6 @@ jobs:
           merge-multiple: true
           path: release-assets
 
-      - name: Download internal Android APK for Nightly
-        if: needs.preflight.outputs.release_channel == 'nightly'
-        continue-on-error: true
-        env:
-          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
-          PACKAGE_NAME: com.t3tools.t3code
-          APK_OUTPUT_DIR: release-assets
-        run: |
-          if [ -n "$GOOGLE_PLAY_SERVICE_ACCOUNT_JSON" ]; then
-            node .github/scripts/mirror-play-apk.cjs
-          fi
-
       # Installers verify archives against this file, so it is written from the
       # signed bytes that get uploaded, never from an earlier stage.
       - name: Write CLI archive checksums
@@ -848,6 +874,10 @@ jobs:
           sha256sum "${archives[@]}" > SHA256SUMS
           cat SHA256SUMS
 
+      # Always runs, even after a failed step, and keeps that failure.
+      - name: Wait for nightly Android APK
+        wait: android_apk
+
       # The desktop build omits the publish config for preview versions, so
       # electron-builder emits no updater manifests for them. Refuse to publish
       # if one shows up anyway: a `latest*.yml` or `nightly*.yml` on a preview
@@ -913,10 +943,13 @@ jobs:
               echo 'release-assets/*.yml'
             fi
             echo 'release-assets/*.tar.gz'
-            # Only list APKs when Play has a processed internal build available.
-            for apk in release-assets/*.apk; do
-              [[ -f "$apk" ]] && echo "$apk"
-            done
+            # A failed or timed-out fetch can leave partial bytes, so list the APK
+            # only when this attempt's fetch succeeded and Play had one ready.
+            if [[ "${{ steps.android_apk.outcome }}" == "success" ]]; then
+              for apk in "$RUNNER_TEMP"/android-apk/*.apk; do
+                [[ -f "$apk" ]] && echo "$apk"
+              done
+            fi
             echo 'release-assets/SHA256SUMS'
             echo 'EOF'
           } >> "$GITHUB_OUTPUT"
@@ -1010,34 +1043,65 @@ jobs:
   # nothing resolves unless asked for by name.
   publish_cli:
     name: Publish CLI to npm
-    needs: [preflight, release]
+    needs: [preflight, build_bundle, release]
     if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.release.result == 'success' }}
     runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 15
     permissions:
       contents: read
       id-token: write
     steps:
+      # Only what setup-ci-deps reads to install the project's Node and npm.
       - name: Checkout
         uses: actions/checkout@v6
         with:
           ref: ${{ needs.preflight.outputs.ref }}
           sparse-checkout: |
-            /*
-            !/.repos/
+            /.github/actions/setup-ci-deps/
+            /package.json
+            /pnpm-workspace.yaml
           sparse-checkout-cone-mode: false
 
-      - name: Setup dependencies
+      - name: Setup Node.js
         uses: ./.github/actions/setup-ci-deps
         with:
-          install-args: --filter=t3... --filter=@t3tools/scripts...
+          install: "false"
 
-      - name: Build the npm launcher
-        run: node scripts/build-npm-launcher.ts --version "${{ needs.preflight.outputs.version }}" --output-dir npm-packages
+      # Bind to build_bundle's exact upload: a name lookup takes the newest
+      # same-name artifact, and an empty ID downloads every artifact in the
+      # run. A later same-name upload hides this ID, so the download fails.
+      - name: Check the npm launcher artifact ID
+        env:
+          ARTIFACT_ID: ${{ needs.build_bundle.outputs.npm_launcher_artifact_id }}
+        run: |
+          if [[ ! "$ARTIFACT_ID" =~ ^[1-9][0-9]*$ ]]; then
+            echo "::error::build_bundle gave no valid npm-launcher artifact ID: '$ARTIFACT_ID'." >&2
+            exit 1
+          fi
+
+      - name: Download the npm launcher
+        uses: actions/download-artifact@v8
+        with:
+          artifact-ids: ${{ needs.build_bundle.outputs.npm_launcher_artifact_id }}
+          path: npm-packages
+          digest-mismatch: error
+
+      - name: Check the npm launcher version
+        env:
+          RELEASE_VERSION: ${{ needs.preflight.outputs.version }}
+        run: |
+          built="$(tar -xzOf npm-packages/t3.tgz package/package.json | jq -r .version)"
+          if [[ "$built" != "$RELEASE_VERSION" ]]; then
+            echo "::error::npm-launcher holds t3@$built, expected t3@$RELEASE_VERSION." >&2
+            exit 1
+          fi
 
       - name: Publish the npm launcher
+        env:
+          DIST_TAG: ${{ needs.preflight.outputs.cli_dist_tag }}
         run: |
-          if ! node apps/server/scripts/cli.ts publish --packages-dir npm-packages --tag "${{ needs.preflight.outputs.cli_dist_tag }}" --provenance --verbose; then
+          # The ./ keeps npm from reading the path as a GitHub owner/repo spec.
+          if ! npm publish --access public --tag "$DIST_TAG" --provenance ./npm-packages/t3.tgz; then
             echo "::error::npm publish failed. Make sure package t3 has a trusted publisher registered for .github/workflows/release.yml (see docs/operations/release.md)." >&2
             exit 1
           fi

apps/desktop/src/app/DesktopAppIdentity.test.ts

@@ -42,6 +42,7 @@ const layerElectronApp = (calls: ElectronAppCalls) =>
     metadata: Effect.die("unexpected metadata read"),
     name: Effect.succeed("T3 Code"),
     systemLocale: Effect.succeed("en-US"),
+    preferredSystemLanguages: Effect.succeed(["en-US"]),
     whenReady: Effect.void,
     requestSingleInstanceLock: Effect.succeed(true),
     quit: Effect.void,

apps/desktop/src/app/DesktopLifecycle.test.ts

@@ -39,6 +39,7 @@ function layerElectronApp(
     metadata: Effect.die("unexpected metadata read"),
     name: Effect.succeed("T3 Code"),
     systemLocale: Effect.succeed("en-US"),
+    preferredSystemLanguages: Effect.succeed(["en-US"]),
     whenReady: Effect.void,
     requestSingleInstanceLock: Effect.succeed(true),
     quit,

apps/desktop/src/electron/ElectronApp.ts

@@ -46,6 +46,7 @@ export class ElectronApp extends Context.Service<
     readonly name: Effect.Effect<string>;
     /** Packaged builds ship only en-US; app.getLocale() and Intl defaults do not reflect the OS locale. */
     readonly systemLocale: Effect.Effect<string>;
+    readonly preferredSystemLanguages: Effect.Effect<ReadonlyArray<string>>;
     readonly whenReady: Effect.Effect<void, ElectronAppWhenReadyError>;
     readonly requestSingleInstanceLock: Effect.Effect<boolean>;
     readonly quit: Effect.Effect<void>;
@@ -155,6 +156,7 @@ export const make = ElectronApp.of({
     }
     return toSystemLocaleTag(identifier, hourCycle);
   }),
+  preferredSystemLanguages: Effect.sync(() => Electron.app.getPreferredSystemLanguages()),
   whenReady: Effect.gen(function* () {
     const isPackaged = Electron.app.isPackaged;
     yield* Effect.tryPromise({

apps/desktop/src/ipc/DesktopIpcHandlers.ts

@@ -6,6 +6,7 @@ import { installNotificationBadge } from "./methods/notificationBadge.ts";
 import { getClientSettings, setClientSettings } from "./methods/clientSettings.ts";
 import { getConnectionCatalog, setConnectionCatalog } from "./methods/connectionCatalog.ts";
 import {
+  getHostEnvironmentId,
   getLocalEnvironmentEnabled,
   setLocalEnvironmentEnabled,
 } from "./methods/localEnvironment.ts";
@@ -38,6 +39,7 @@ import {
   getLocalEnvironmentBearerToken,
   installRelayTelemetryEnabled,
   getSystemLocale,
+  getPreferredSystemLanguages,
   getWindowFullscreenState,
   openExternal,
   readMedia,
@@ -94,10 +96,12 @@ export const installDesktopIpcHandlers = Effect.fn("desktop.ipc.installHandlers"
   yield* ipc.handleSync(getAppBranding);
   yield* installRelayTelemetryEnabled();
   yield* ipc.handleSync(getSystemLocale);
+  yield* ipc.handleSync(getPreferredSystemLanguages);
   yield* ipc.handleSync(getWindowFullscreenState);
   yield* ipc.handleSync(getLocalEnvironmentBootstraps);
   yield* ipc.handleSync(getLocalEnvironmentEnabled);
   yield* ipc.handle(setLocalEnvironmentEnabled);
+  yield* ipc.handle(getHostEnvironmentId);
   yield* ipc.handle(getLocalEnvironmentBearerToken);
 
   yield* ipc.handle(getClientSettings);

apps/desktop/src/ipc/channels.ts

@@ -34,9 +34,11 @@ export const CLI_COMMAND_UNINSTALL_CHANNEL = "desktop:cli-command-uninstall";
 export const GET_APP_BRANDING_CHANNEL = "desktop:get-app-branding";
 export const GET_RELAY_TELEMETRY_ENABLED_CHANNEL = "desktop:get-relay-telemetry-enabled";
 export const GET_SYSTEM_LOCALE_CHANNEL = "desktop:get-system-locale";
+export const GET_PREFERRED_SYSTEM_LANGUAGES_CHANNEL = "desktop:get-preferred-system-languages";
 export const GET_LOCAL_ENVIRONMENT_BOOTSTRAPS_CHANNEL = "desktop:get-local-environment-bootstraps";
 export const GET_LOCAL_ENVIRONMENT_ENABLED_CHANNEL = "desktop:get-local-environment-enabled";
 export const SET_LOCAL_ENVIRONMENT_ENABLED_CHANNEL = "desktop:set-local-environment-enabled";
+export const GET_HOST_ENVIRONMENT_ID_CHANNEL = "desktop:get-host-environment-id";
 export const GET_LOCAL_ENVIRONMENT_BEARER_TOKEN_CHANNEL =
   "desktop:get-local-environment-bearer-token";
 export const GET_CLIENT_SETTINGS_CHANNEL = "desktop:get-client-settings";