chore: sync upstream main and port the embedded runtime to provider-core

.coderabbit.config.ts

@@ -1,15 +1,13 @@
 import { defineConfig, type CodeRabbitContext } from "@coderabbitai/config";
 
-// Org members and collaborators merge their own pull requests. On anyone else's, CodeRabbit
-// requests changes until its comments are resolved, then approves.
 const UNGATED_AUTHORS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 const isGated = ({ pr }: CodeRabbitContext) => !UNGATED_AUTHORS.has(pr?.authorAssociation ?? "");
 
 export default defineConfig((ctx) => ({
   reviews: {
     high_level_summary: false,
     review_status: false,
-    request_changes_workflow: isGated(ctx),
+    request_changes_workflow: false,
     allow_author_approval: !isGated(ctx),
     auto_review: {
       enabled: true,
@@ -18,11 +16,7 @@ export default defineConfig((ctx) => ({
       docstrings: { mode: "off" },
       override_requested_reviewers_only: isGated(ctx),
     },
-    path_filters: [
-      // Vendored read-only reference checkouts of upstream Effect and Alchemy
-      // (see scripts/lib/reference-repos.ts). Nothing imports from them.
-      "!.repos/**",
-    ],
+    path_filters: ["!.repos/**"],
     path_instructions: [
       {
         path: "{apps,packages,infra}/**/*.ts",

.gitattributes

@@ -3,3 +3,6 @@
 # Batch files need CRLF for cmd.exe to parse them reliably.
 *.cmd text eol=crlf
 *.bat text eol=crlf
+# GitHub's GraphQL schema and the operations graphqlgen writes from it.
+packages/source-control-github/schema/** linguist-generated
+**/*.graphql.ts linguist-generated

.github/ISSUE_TEMPLATE/via-triage.yml

@@ -37,7 +37,7 @@ body:
     id: version
     attributes:
       label: Version
-      description: Installed t3 version or commit.
+      description: Version the bug happened on (not the `t3 triage` CLI version), or unknown.
       placeholder: 0.0.33
     validations:
       required: true

.github/VOUCHED.td

@@ -16,6 +16,7 @@ github:aoright
 github:arhxam
 github:bil0000
 github:binbandit
+github:bompus
 github:Brechard
 github:btsouth
 github:cestercian
@@ -52,6 +53,7 @@ github:mackinleysmith
 github:maria-rcks
 github:MatthewFeroz
 github:maxwellyoung
+github:mweinbach
 github:mwolson
 github:myacoub91
 github:naMqe-h

.github/actions/ci-changes/action.yml

@@ -0,0 +1,63 @@
+name: CI changes
+description: Decide which CI jobs a change needs. See .github/scripts/ci-changes.cjs.
+outputs:
+  typecheck:
+    value: ${{ steps.detect.outputs.typecheck }}
+  build:
+    value: ${{ steps.detect.outputs.build }}
+  test:
+    value: ${{ steps.detect.outputs.test }}
+  test_packages:
+    value: ${{ steps.detect.outputs.test_packages }}
+  test_web:
+    value: ${{ steps.detect.outputs.test_web }}
+  test_server:
+    value: ${{ steps.detect.outputs.test_server }}
+  rust:
+    value: ${{ steps.detect.outputs.rust }}
+  release_smoke:
+    value: ${{ steps.detect.outputs.release_smoke }}
+  mobile_native:
+    value: ${{ steps.detect.outputs.mobile_native }}
+runs:
+  using: composite
+  steps:
+    - id: detect
+      shell: bash
+      env:
+        EVENT_NAME: ${{ github.event_name }}
+        BEFORE_SHA: ${{ github.event.before }}
+      run: |
+        set -uo pipefail
+
+        decide() {
+          node .github/scripts/ci-changes.cjs "$@" | tee -a "$GITHUB_OUTPUT"
+          exit "${PIPESTATUS[0]}"
+        }
+
+        fail_open() {
+          echo "$* Running every job."
+          decide
+        }
+
+        # Reads the change from git rather than the REST API: every job that
+        # runs this shares the repository's 1,000 requests/hour GITHUB_TOKEN quota.
+        if [[ "$EVENT_NAME" == pull_request ]]; then
+          # A pull request checks out GitHub's merge commit with fetch-depth: 2,
+          # so its first parent is the base branch and the diff is the PR's change.
+          base=HEAD^1
+          mode=()
+        else
+          base=$BEFORE_SHA
+          git fetch --quiet --no-tags --depth=1 --filter=blob:none origin "$base" \
+            || fail_open "Could not fetch ${base}."
+          # main keeps a full run as the backstop for anything the gate misses.
+          mode=(--full)
+        fi
+
+        # --no-renames lists a rename as its old and new path: renaming a file out
+        # of a package changes that package just like editing it. It also keeps
+        # git from fetching file contents to score renames.
+        git diff --name-only --no-renames "$base" HEAD > "$RUNNER_TEMP/changed-paths" \
+          || fail_open "Could not diff against ${base}."
+        decide --paths "$RUNNER_TEMP/changed-paths" "${mode[@]}"

.github/actions/setup-ci-deps/action.yml

@@ -0,0 +1,30 @@
+name: Setup CI dependencies
+description: Install Vite+ and the workspace dependencies from cache.
+runs:
+  using: composite
+  steps:
+    # setup-vp reuses an installed exact version, so restoring its home skips the
+    # installer download on every job.
+    - name: Resolve Vite+ version
+      id: vp
+      shell: bash
+      run: |
+        echo "version=$(sed -nE 's/^  vite-plus: ([0-9][^ ]*)$/\1/p' pnpm-workspace.yaml)" >> "$GITHUB_OUTPUT"
+
+    - name: Cache Vite+
+      if: steps.vp.outputs.version != ''
+      uses: actions/cache@v6
+      with:
+        path: ~/.vite-plus
+        key: vite-plus-home-v1-${{ runner.os }}-${{ runner.arch }}-${{ steps.vp.outputs.version }}
+
+    # The pnpm store stays a cache tarball on the runner's own disk. A store on a
+    # Blacksmith sticky disk mounts in under a second, but pnpm then copies every
+    # package across filesystems instead of hard-linking it: install took 28-49s
+    # against 9s plus an 11s restore.
+    - name: Setup Vite+
+      uses: voidzero-dev/setup-vp@v1
+      with:
+        node-version-file: package.json
+        cache: true
+        run-install: true

.github/scripts/check-nightly-release.cjs

@@ -40,7 +40,6 @@ async function assertReleaseSource({ github, context, releaseChannel }) {
 
 const isNightlyTag = (tag) => /^v.*-nightly\./.test(tag) || tag.startsWith("nightly-v");
 
-// Newest published nightly by publication time, or undefined when none exists.
 async function findLatestNightly({ github, context }) {
   const releases = await github.paginate(github.rest.repos.listReleases, {
     ...context.repo,
@@ -51,7 +50,6 @@ async function findLatestNightly({ github, context }) {
     .sort((a, b) => Date.parse(b.published_at) - Date.parse(a.published_at))[0];
 }
 
-// Runs after the workflow acquires the nightly concurrency lock.
 async function shouldReleaseNightly({ github, context, core, now = Date.now() }) {
   const lastNightly = await findLatestNightly({ github, context });
 
@@ -81,17 +79,13 @@ async function shouldReleaseNightly({ github, context, core, now = Date.now() })
   return true;
 }
 
-// Stable releases build the commit the latest nightly shipped, so the stable
-// build is one nightly users already ran. Returns the nightly tag, its commit,
-// and the stable version that nightly was a preview of.
 async function resolveLatestNightlyCommit({ github, context, core }) {
   const lastNightly = await findLatestNightly({ github, context });
   if (!lastNightly) {
     throw new Error("No published nightly found. Stable releases build the latest nightly commit.");
   }
 
   const tag = lastNightly.tag_name;
-  // repos.getCommit dereferences annotated tags, so this is the commit either way.
   const { data: commit } = await github.rest.repos.getCommit({ ...context.repo, ref: tag });
   const version = /^(?:nightly-)?v(\d+\.\d+\.\d+)-nightly\./.exec(tag)?.[1];
   if (!version) {

.github/scripts/ci-changes.cjs

@@ -0,0 +1,203 @@
+// Decides which CI jobs a change needs. Prints `key=value` lines for
+// $GITHUB_OUTPUT; a job runs unless its key is "false".
+//
+//   node ci-changes.cjs --paths <file>          gate by the listed paths
+//   node ci-changes.cjs --paths <file> --full   run every Linux job, gate only the macOS lint
+//   node ci-changes.cjs                         changed paths unknown: run everything
+//
+// Every changed path maps to workspace packages, which then pull in their
+// dependents from package.json. A path this file does not recognize runs
+// everything, so a new root file or directory can only cost minutes.
+const fs = require("node:fs");
+const path = require("node:path");
+
+const root = path.resolve(__dirname, "../..");
+
+// Never read by a build, typecheck, or test. Lint still formats them.
+const INERT = [
+  /^docs\//,
+  /^\.(agents|cursor|vscode|devcontainer|macroscope|repos)\//,
+  /^[^/]+\.md$/,
+  /^LICENSE$/,
+];
+
+// Run everything: the root vite.config.ts loads the first as setup for every
+// package's tests, and the vendored mobile tarballs are installed dependencies.
+const RUNS_EVERYTHING = [
+  /^packages\/shared\/src\/(HostProcess|testing\/longTempDir)\.ts$/,
+  /^apps\/mobile\/deps\//,
+];
+
+// Paths outside a package, or files inside one that other packages read
+// through relative imports rather than a package.json dependency.
+const EXTRA_OWNERS = [
+  // Vite configs and tsconfigs of these apps import scripts/lib directly.
+  [/^scripts\/lib\//, ["@t3tools/desktop", "@t3tools/mobile", "@t3tools/web", "t3"]],
+  // scripts/build-desktop-artifact.ts reads the GNOME extension manifest.
+  [/^apps\/desktop\/gnome-extension\//, ["@t3tools/scripts"]],
+  [/^native\/browser-secret\//, ["@t3tools/desktop"]],
+  [/^native\/libghostty-vt\//, ["@t3tools/web"]],
+];
+const RUST = /^native\/(resource-monitor|kde-snap-shot|hyprland-snap-shot)\//;
+
+// Tests that read another package's files without declaring it. The scripts
+// tests read app manifests, assets, and sources (cursor-sdk-packaging,
+// third-party-licenses, brand-assets, build-desktop-artifact).
+const TEST_ONLY_DEPS = {
+  "@t3tools/provider-pi": ["@t3tools/client-runtime"],
+  "@t3tools/scripts": [
+    "@t3tools/desktop",
+    "@t3tools/mobile",
+    "@t3tools/web",
+    "t3",
+    "@t3tools/provider-cursor",
+  ],
+};
+// Declared dependencies that only feed a build step: the server bundles the
+// built web app (apps/server/vite.config.ts) but never imports it.
+const BUILD_ONLY_DEPS = { t3: ["@t3tools/web"] };
+
+// Sources scripts/mobile-native-static-check.ts lints, plus the tool and rule
+// configuration that decides how it lints them, plus the root package.json
+// that defines the lint:mobile command.
+const MOBILE_NATIVE =
+  /^apps\/mobile\/.*\.(swift|kt|kts)$|^apps\/mobile\/(\.swiftlint\.yml|detekt\.yml|\.editorconfig|Brewfile)$|^scripts\/mobile-native-static-check\.ts$|^package\.json$|^\.github\/workflows\/ci\.yml$|^\.github\/scripts\/ci-changes\.cjs$|^\.github\/actions\/ci-changes\//;
+
+// Jobs that test every package except these, which have jobs of their own.
+const OWN_TEST_JOB = new Set(["t3", "@t3tools/web", "@t3tools/monorepo"]);
+
+function readWorkspace() {
+  const patterns = [];
+  let inPackages = false;
+  for (const line of fs.readFileSync(path.join(root, "pnpm-workspace.yaml"), "utf8").split("\n")) {
+    if (/^\S/.test(line)) inPackages = line.startsWith("packages:");
+    const entry = inPackages && line.match(/^\s+-\s+["']?([^"'\s]+)/);
+    if (entry) patterns.push(entry[1]);
+  }
+
+  const dirs = patterns.flatMap((pattern) => {
+    if (!pattern.endsWith("/*")) return [pattern];
+    const parent = pattern.slice(0, -2);
+    return fs.readdirSync(path.join(root, parent)).map((name) => `${parent}/${name}`);
+  });
+
+  const packages = [];
+  for (const dir of dirs) {
+    const manifestPath = path.join(root, dir, "package.json");
+    if (!fs.existsSync(manifestPath)) continue;
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+    const deps = {
+      ...manifest.dependencies,
+      ...manifest.devDependencies,
+      ...manifest.peerDependencies,
+    };
+    packages.push({
+      name: manifest.name,
+      dir,
+      hasTest: Boolean(manifest.scripts?.test),
+      deps: Object.keys(deps).filter(
+        (dep) =>
+          String(deps[dep]).startsWith("workspace:") &&
+          !BUILD_ONLY_DEPS[manifest.name]?.includes(dep),
+      ),
+    });
+  }
+  return packages;
+}
+
+// Returns the packages a path touches, [] for an inert path, or null when the
+// path is not understood and everything must run.
+function ownersOf(file, packages) {
+  if (INERT.some((pattern) => pattern.test(file))) return [];
+  // A manifest can change dependencies or versions other packages read.
+  if (path.posix.basename(file) === "package.json") return null;
+  if (RUNS_EVERYTHING.some((pattern) => pattern.test(file))) return null;
+  // scripts/build-desktop-artifact.test.ts reads the crates' sources.
+  if (RUST.test(file)) return ["@t3tools/scripts"];
+
+  const extra = EXTRA_OWNERS.flatMap(([pattern, names]) => (pattern.test(file) ? names : []));
+  const owner = packages
+    .filter((pkg) => file.startsWith(`${pkg.dir}/`))
+    .sort((a, b) => b.dir.length - a.dir.length)[0];
+  if (owner) return [owner.name, ...extra];
+  return extra.length > 0 ? extra : null;
+}
+
+function decide(files, packages, full) {
+  const all = new Set(packages.map((pkg) => pkg.name));
+  let affected = new Set();
+  let everything = full || files === null;
+  let rust = false;
+
+  for (const file of files ?? []) {
+    if (RUST.test(file)) rust = true;
+    const owners = ownersOf(file, packages);
+    if (owners === null) {
+      everything = true;
+      console.error(`Runs everything: ${file}`);
+    } else {
+      for (const owner of owners) affected.add(owner);
+    }
+  }
+
+  // Release smoke reads scripts/ itself, not what the scripts tests read.
+  let scriptsChanged = everything;
+  if (everything) {
+    affected = all;
+  } else {
+    // Add dependents until nothing changes.
+    let grew = true;
+    while (grew) {
+      grew = false;
+      for (const pkg of packages) {
+        if (!affected.has(pkg.name) && pkg.deps.some((dep) => affected.has(dep))) {
+          affected.add(pkg.name);
+          grew = true;
+        }
+      }
+    }
+    scriptsChanged = affected.has("@t3tools/scripts");
+    for (const [name, deps] of Object.entries(TEST_ONLY_DEPS)) {
+      if (deps.some((dep) => affected.has(dep))) affected.add(name);
+    }
+  }
+
+  const tested = packages.filter(
+    (pkg) => pkg.hasTest && !OWN_TEST_JOB.has(pkg.name) && affected.has(pkg.name),
+  );
+  const has = (name) => affected.has(name);
+
+  return {
+    affected: [...affected].sort(),
+    outputs: {
+      typecheck: affected.size > 0,
+      build: has("@t3tools/desktop") || has("t3") || has("@t3tools/web"),
+      test: tested.length > 0,
+      // Empty means every package the Test job covers.
+      test_packages: everything ? "" : tested.map((pkg) => pkg.name).join(" "),
+      test_web: has("@t3tools/web"),
+      test_server: has("t3"),
+      rust: everything || rust,
+      release_smoke: scriptsChanged,
+      mobile_native: files === null || files.some((file) => MOBILE_NATIVE.test(file)),
+    },
+  };
+}
+
+function main() {
+  const args = process.argv.slice(2);
+  const pathsIndex = args.indexOf("--paths");
+  const files =
+    pathsIndex === -1
+      ? null
+      : fs
+          .readFileSync(args[pathsIndex + 1], "utf8")
+          .split("\n")
+          .filter(Boolean);
+  const { affected, outputs } = decide(files, readWorkspace(), args.includes("--full"));
+
+  console.error(`Affected packages: ${affected.join(", ") || "none"}`);
+  for (const [key, value] of Object.entries(outputs)) console.log(`${key}=${value}`);
+}
+
+main();