Sync with upstream pingdotgg/t3code main (ad4bb6d6fa)

.agents/skills/test-t3-app/SKILL.md

@@ -5,10 +5,10 @@ description: Test T3 Code's web and desktop UI through its built-in Browser pane
 
 # Test T3 web and desktop
 
-Use T3's built-in Browser panel for verification. If its tools are absent or
-the panel reports unavailable, explain the blocker and stop verification.
-Do not install or switch to another automation system. For native mobile
-testing, use [test-t3-mobile](../test-t3-mobile/SKILL.md).
+Use T3's built-in Browser panel for verification. Follow the recovery steps
+below before declaring it unavailable. Do not install or switch to another
+automation system. For native mobile testing, use
+[test-t3-mobile](../test-t3-mobile/SKILL.md).
 
 ## Start the app
 
@@ -21,10 +21,28 @@ Test with meaningful project and thread data. Read
 [references/sqlite-fixtures.md](references/sqlite-fixtures.md) only when
 inspecting or seeding SQLite. Stop the test server before direct fixture writes.
 
+## Drive agent turns for free
+
+Do not spend a paid model to see a turn render. `vp run dev` registers the
+`Replay (dev)` provider, which replays recorded turns with simulated streaming
+through the real adapter and orchestration. Its models are scenarios:
+`showcase` covers thinking, a plan, tool calls, an approval, and markdown.
+Press `Ctrl+Alt+Shift+R` for a picker (GNOME takes that key for screen
+recording), call `window.t3dev.replay("showcase")`
+with `preview_evaluate`, or run
+`node apps/server/src/bin.ts thread start --base-dir .t3 --provider devReplay --model showcase <project> "go"`.
+When the test needs real provider behavior, use that provider's cheapest
+model, such as Haiku for Claude or Luna for Codex.
+
 ## Use the Browser panel
 
-Call `preview_status`, then `preview_open` if the Browser panel is
-closed. Navigate to the complete startup pairing URL once with
+Call `preview_status`. If no tab can be automated, call `preview_open`, including
+when status reports `available: false` or `tabId: null`. Status can report
+unavailable simply because no tab exists yet; opening a tab needs no user action.
+Stop verification and explain the blocker only if the tools are absent or
+`preview_open` reports unavailable or fails.
+
+Navigate to the complete startup pairing URL once with
 `preview_navigate`, then use `preview_snapshot` and T3's interaction tools.
 If the token was consumed or expired, run `node apps/server/src/bin.ts pair`
 for a fresh one. Keep using the same tab.

.agents/skills/test-t3-mobile/SKILL.md

@@ -31,11 +31,21 @@ when inspecting or seeding SQLite. Stop the test server before fixture writes.
 From the checkout being tested on the selected device host, run:
 
 ```bash
-node scripts/mobile-native-client.ts ensure <ios|android> <device-id>
+vp run mobile:install <ios|android> <device-id>
 ```
 
-This reuses a matching native client or builds and installs one. Authorized
-mobile verification includes that build step unless the user prohibits it.
+This installs the dev client for the checkout's native fingerprint: from the
+device, the local cache, or the shared cache in seconds, building once only
+when no machine has that fingerprint yet (5-15 minutes, logged to the file it
+names). The device id may be omitted when exactly one device is booted. It
+prints one JSON line; on failure it names the next command. Mobile verification
+includes that step unless the user prohibits it.
+
+For a device you opened in an agent-device session elsewhere (a device pool,
+cloud, or remote host), run `vp run mobile:install <ios|android> --session <s>`
+from the directory you opened the session in. It installs the cached build into
+that session (`--abi arm64-v8a` for an ARM Android device; `--metro <url>` also
+opens it against Metro) and never builds.
 
 Start `vp run dev:client` from `apps/mobile`, or reuse a healthy Metro belonging
 to this checkout. Open its printed development-client URL with AgentDevice

.coderabbit.config.ts

@@ -26,13 +26,19 @@ export default defineConfig((ctx) => ({
         path: "apps/web/src/**/*.{tsx,css}",
         instructions: "Hold changed code to the rules in docs/internals/web-ui.md.",
       },
+      {
+        path: "**/*.test.*",
+        instructions:
+          "Hold changed tests to the rules in docs/internals/testing.md. Request tests only as those rules allow.",
+      },
     ],
   },
   knowledge_base: {
     code_guidelines: {
       filePatterns: [
         { files: "docs/internals/effect-services.md", applyTo: "{apps,packages,infra}/**/*.ts" },
         { files: "docs/internals/web-ui.md", applyTo: "apps/web/src/**/*.{tsx,css}" },
+        { files: "docs/internals/testing.md", applyTo: "{apps,packages,infra}/**/*.{ts,tsx}" },
       ],
     },
   },

.devcontainer/devcontainer.json

@@ -1,4 +1,4 @@
-// Dev container for T3 Code. Mirrors CI (ubuntu-24.04, Node 24, Rust stable)
+// Dev container for T3 Code. Mirrors CI (ubuntu-24.04, Node 26, Rust stable)
 // and the canonical setup in docs/operations/development.md: global `vp`, `vp i`.
 // Contributor doc: docs/internals/devcontainer.md
 {
@@ -8,7 +8,7 @@
     // nodeGypDependencies (default true) brings python3/make/g++, which Linux
     // needs for node-pty's node-gyp fallback (its prebuilds are mac/win only).
     "ghcr.io/devcontainers/features/node:2": {
-      "version": "24"
+      "version": "26"
     },
     // native/resource-monitor (edition 2024, needs stable >= 1.85). The server
     // degrades gracefully without the binary, but CI checks cargo fmt + test.

.gitattributes

@@ -3,6 +3,7 @@
 # Batch files need CRLF for cmd.exe to parse them reliably.
 *.cmd text eol=crlf
 *.bat text eol=crlf
-# GitHub's GraphQL schema and the operations graphqlgen writes from it.
+# GitHub's and Expo's GraphQL schemas and the operations graphqlgen writes from them.
 packages/source-control-github/schema/** linguist-generated
+apps/server/schema/** linguist-generated
 **/*.graphql.ts linguist-generated

.github/VOUCHED.td

@@ -59,6 +59,7 @@ github:myacoub91
 github:naMqe-h
 github:nateEc
 github:naveed949
+github:nexxeln
 github:nmggithub
 github:Noojuno
 github:notkainoa

.github/actions/setup-ci-deps/action.yml

@@ -1,30 +1,153 @@
 name: Setup CI dependencies
 description: Install Vite+ and the workspace dependencies from cache.
+inputs:
+  task-cache-read-token:
+    description: Read-only credential for the private maintainer task cache
+    required: false
+    default: ""
+  install:
+    description: Set to "false" to set up Vite+ only, with no pnpm store or install
+    required: false
+    default: "true"
+  install-args:
+    description: Arguments for `vp install`, such as filters. Empty installs the whole workspace.
+    required: false
+    default: ""
 runs:
   using: composite
   steps:
-    # setup-vp reuses an installed exact version, so restoring its home skips the
-    # installer download on every job.
+    # ~/.vite-plus holds vp, the Node.js runtime, and pnpm. A cache entry never
+    # updates, so the key names all three versions; otherwise a pnpm or Node.js
+    # bump makes every job download them from npm again.
     - name: Resolve Vite+ version
       id: vp
       shell: bash
       run: |
         echo "version=$(sed -nE 's/^  vite-plus: ([0-9][^ ]*)$/\1/p' pnpm-workspace.yaml)" >> "$GITHUB_OUTPUT"
+        echo "node=$(jq -r '.engines.node' package.json)" >> "$GITHUB_OUTPUT"
+        echo "pnpm=$(jq -r '.packageManager' package.json)" >> "$GITHUB_OUTPUT"
 
+    # Pinned because release-desktop.yml signs builds with this action in the job.
     - name: Cache Vite+
+      id: vp_cache
       if: steps.vp.outputs.version != ''
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
       with:
         path: ~/.vite-plus
-        key: vite-plus-home-v1-${{ runner.os }}-${{ runner.arch }}-${{ steps.vp.outputs.version }}
+        key: vite-plus-home-v2-${{ runner.os }}-${{ runner.arch }}-${{ steps.vp.outputs.version }}-node${{ steps.vp.outputs.node }}-${{ steps.vp.outputs.pnpm }}
 
+    # setup-vp always runs the installer, which fetches vp from npm even when
+    # this exact version is installed. A cache hit already has everything, so
+    # skip setup-vp and do its remaining work here. This keeps npm outages from
+    # failing jobs.
+    - name: Use cached Vite+
+      if: steps.vp_cache.outputs.cache-hit == 'true'
+      shell: bash
+      run: |
+        echo "$HOME/.vite-plus/bin" >> "$GITHUB_PATH"
+        "$HOME/.vite-plus/bin/vp" env use "${{ steps.vp.outputs.node }}"
+
+    # vp gives each Node.js download attempt 10 minutes by default, so one
+    # stalled stream holds the job that long. It retries 3 times and resumes
+    # partial bytes, so a shorter limit costs a slow download only a retry.
+    - name: Setup Vite+
+      if: steps.vp_cache.outputs.cache-hit != 'true'
+      uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
+      env:
+        VP_DOWNLOAD_TIMEOUT: "120"
+      with:
+        node-version-file: package.json
+        cache: false
+        run-install: false
+
+    # A shared key lets whichever install saves first, often a small filtered
+    # one, become every job's store. Each set of install args gets its own.
+    - name: Resolve pnpm store
+      id: pnpm_store
+      if: inputs.install == 'true'
+      shell: bash
+      env:
+        INSTALL_ARGS: ${{ inputs.install-args }}
+      run: |
+        echo "path=$(vp pm cache dir)" >> "$GITHUB_OUTPUT"
+        metadata_dir="${pnpm_config_cache_dir:-$RUNNER_TEMP/pnpm-metadata}"
+        echo "pnpm_config_cache_dir=$metadata_dir" >> "$GITHUB_ENV"
+        echo "verified=$metadata_dir/lockfile-verified.jsonl" >> "$GITHUB_OUTPUT"
+        if [[ -z "$INSTALL_ARGS" ]]; then
+          echo "namespace=full" >> "$GITHUB_OUTPUT"
+        else
+          echo "namespace=filtered-$(printf '%s' "$INSTALL_ARGS" | cksum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+        fi
+
+    # Filtered installs prefer the current full store, which holds every package,
+    # over an older store of their own.
     # The pnpm store stays a cache tarball on the runner's own disk. A store on a
     # Blacksmith sticky disk mounts in under a second, but pnpm then copies every
     # package across filesystems instead of hard-linking it: install took 28-49s
     # against 9s plus an 11s restore.
-    - name: Setup Vite+
-      uses: voidzero-dev/setup-vp@v1
+    - name: Restore pnpm store
+      id: pnpm_cache
+      if: inputs.install == 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
       with:
-        node-version-file: package.json
-        cache: true
-        run-install: true
+        path: ${{ steps.pnpm_store.outputs.path }}
+        key: pnpm-${{ steps.pnpm_store.outputs.namespace }}-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
+        restore-keys: |
+          pnpm-full-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
+          pnpm-${{ steps.pnpm_store.outputs.namespace }}-v1-${{ runner.os }}-${{ runner.arch }}-
+          pnpm-full-v1-${{ runner.os }}-${{ runner.arch }}-
+
+    # pnpm accepts an earlier pass for the same lockfile and policy at any age, so
+    # a cached record skips fetching registry metadata for every package.
+    - name: Restore lockfile verification
+      id: pnpm_verified
+      if: inputs.install == 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: ${{ steps.pnpm_store.outputs.verified }}
+        key: pnpm-verified-v1-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
+
+    - name: Install dependencies
+      if: inputs.install == 'true'
+      shell: bash
+      env:
+        INSTALL_ARGS: ${{ inputs.install-args }}
+      # Unquoted so each filter is its own argument.
+      run: vp install $INSTALL_ARGS
+
+    - name: Save lockfile verification
+      if: inputs.install == 'true' && steps.pnpm_verified.outputs.cache-hit != 'true'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: ${{ steps.pnpm_store.outputs.verified }}
+        key: ${{ steps.pnpm_verified.outputs.cache-primary-key }}
+
+    # A filtered install that started from the current full store adds nothing
+    # worth a second copy of it.
+    - name: Save pnpm store
+      if: >-
+        inputs.install == 'true' &&
+        steps.pnpm_cache.outputs.cache-hit != 'true' &&
+        (steps.pnpm_store.outputs.namespace == 'full' ||
+          steps.pnpm_cache.outputs.cache-matched-key != format('pnpm-full-v1-{0}-{1}-{2}', runner.os, runner.arch, hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json')))
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: ${{ steps.pnpm_store.outputs.path }}
+        key: ${{ steps.pnpm_cache.outputs.cache-primary-key }}
+
+    - name: Enable shared task cache
+      if: >-
+        github.repository == 'pingdotgg/t3code' &&
+        (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+        hashFiles('.task-cache.json') != '' &&
+        inputs.task-cache-read-token != ''
+      shell: bash
+      env:
+        T3_TASK_CACHE_READ_TOKEN: ${{ inputs.task-cache-read-token }}
+      run: |
+        node infra/task-cache/scripts/install-ci.ts
+        if [[ ( "$GITHUB_EVENT_NAME" == pull_request && "$GITHUB_BASE_REF" == main ) || ( "$GITHUB_EVENT_NAME" == push && "$GITHUB_REF" == refs/heads/main ) ]]; then
+          echo 'VP_REMOTE_CACHE=read-write' >> "$GITHUB_ENV"
+        else
+          echo 'VP_REMOTE_CACHE=read' >> "$GITHUB_ENV"
+        fi

.github/scripts/check-nightly-release.test.cjs

@@ -61,12 +61,6 @@ for (const releaseChannel of ["stable", "nightly"]) {
     );
     assert.equal(calls.length, 0);
   });
-
-  test(`allows a manual ${releaseChannel} release from main`, async () => {
-    const { options, calls } = releaseSourceFixture();
-    await assertReleaseSource({ ...options, releaseChannel });
-    assert.equal(calls[0].basehead, "candidate...main");
-  });
 }
 
 for (const comparisonStatus of ["behind", "diverged"]) {
@@ -79,13 +73,6 @@ for (const comparisonStatus of ["behind", "diverged"]) {
   });
 }
 
-test("accepts a release commit already contained in main", async () => {
-  for (const comparisonStatus of ["ahead", "identical"]) {
-    const { options } = releaseSourceFixture({ comparisonStatus, eventName: "push" });
-    await assertCommitOnDefaultBranch({ ...options, sha: "release-commit" });
-  }
-});
-
 function fixture({ releases = [nightly(7)], comparisonStatus = "ahead" } = {}) {
   const calls = [];
   return {
@@ -119,26 +106,6 @@ test("releases the first nightly when no nightly is published", async () => {
   assert.equal(await shouldReleaseNightly(options), true);
 });
 
-test("waits six hours after publication, including manual nightlies", async () => {
-  for (const age of [0, 3, 6 - 1 / 3600]) {
-    const { options, calls } = fixture({ releases: [nightly(age)] });
-    assert.equal(await shouldReleaseNightly(options), false);
-    assert.equal(calls.length, 0);
-  }
-});
-
-test("releases new commits at six hours and after an idle period", async () => {
-  for (const age of [6, 7, 24]) {
-    const { options } = fixture({ releases: [nightly(age)] });
-    assert.equal(await shouldReleaseNightly(options), true);
-  }
-});
-
-test("skips unchanged commits after the gap", async () => {
-  const { options } = fixture({ comparisonStatus: "identical" });
-  assert.equal(await shouldReleaseNightly(options), false);
-});
-
 test("uses publication time, not release order or the tagged commit date", async () => {
   const { options } = fixture({
     releases: [nightly(10), nightly(1), nightly(20, { tag_name: "nightly-v0.9.0" })],
@@ -153,13 +120,6 @@ test("ignores stable releases and drafts when checking the gap", async () => {
   assert.equal(await shouldReleaseNightly(options), true);
 });
 
-test("compares against the published tag, including legacy nightly tags", async () => {
-  const tag = "nightly-v0.9.0";
-  const { options, calls } = fixture({ releases: [nightly(7, { tag_name: tag })] });
-  assert.equal(await shouldReleaseNightly(options), true);
-  assert.equal(calls[0].basehead, `${tag}...new`);
-});
-
 test("fails instead of releasing when GitHub cannot supply release state", async () => {
   const { options } = fixture();
   options.github.paginate = async () => {
@@ -211,8 +171,3 @@ test("stable releases derive the version from legacy nightly tags", async () =>
   });
   assert.equal((await resolveLatestNightlyCommit(options)).version, "0.9.0");
 });
-
-test("stable releases fail without a published nightly", async () => {
-  const { options } = nightlyCommitFixture({ releases: [nightly(0, { tag_name: "v1.0.0" })] });
-  await assert.rejects(resolveLatestNightlyCommit(options), /No published nightly/);
-});