chore(sync): absorb upstream main through fe219c4de1

.agents/skills/test-t3-app/SKILL.md

@@ -21,6 +21,19 @@ Test with meaningful project and thread data. Read
 [references/sqlite-fixtures.md](references/sqlite-fixtures.md) only when
 inspecting or seeding SQLite. Stop the test server before direct fixture writes.
 
+## Drive agent turns for free
+
+Do not spend a paid model to see a turn render. `vp run dev` registers the
+`Replay (dev)` provider, which replays recorded turns with simulated streaming
+through the real adapter and orchestration. Its models are scenarios:
+`showcase` covers thinking, a plan, tool calls, an approval, and markdown.
+Press `Ctrl+Alt+Shift+R` for a picker (GNOME takes that key for screen
+recording), call `window.t3dev.replay("showcase")`
+with `preview_evaluate`, or run
+`node apps/server/src/bin.ts thread start --base-dir .t3 --provider devReplay --model showcase <project> "go"`.
+When the test needs real provider behavior, use that provider's cheapest
+model, such as Haiku for Claude or Luna for Codex.
+
 ## Use the Browser panel
 
 Call `preview_status`, then `preview_open` if the Browser panel is

.agents/skills/test-t3-mobile/SKILL.md

@@ -31,11 +31,21 @@ when inspecting or seeding SQLite. Stop the test server before fixture writes.
 From the checkout being tested on the selected device host, run:
 
 ```bash
-node scripts/mobile-native-client.ts ensure <ios|android> <device-id>
+vp run mobile:install <ios|android> <device-id>
 ```
 
-This reuses a matching native client or builds and installs one. Authorized
-mobile verification includes that build step unless the user prohibits it.
+This installs the dev client for the checkout's native fingerprint: from the
+device, the local cache, or the shared cache in seconds, building once only
+when no machine has that fingerprint yet (5-15 minutes, logged to the file it
+names). The device id may be omitted when exactly one device is booted. It
+prints one JSON line; on failure it names the next command. Mobile verification
+includes that step unless the user prohibits it.
+
+For a device you opened in an agent-device session elsewhere (a device pool,
+cloud, or remote host), run `vp run mobile:install <ios|android> --session <s>`
+from the directory you opened the session in. It installs the cached build into
+that session (`--abi arm64-v8a` for an ARM Android device; `--metro <url>` also
+opens it against Metro) and never builds.
 
 Start `vp run dev:client` from `apps/mobile`, or reuse a healthy Metro belonging
 to this checkout. Open its printed development-client URL with AgentDevice

.coderabbit.config.ts

@@ -26,13 +26,19 @@ export default defineConfig((ctx) => ({
         path: "apps/web/src/**/*.{tsx,css}",
         instructions: "Hold changed code to the rules in docs/internals/web-ui.md.",
       },
+      {
+        path: "**/*.test.*",
+        instructions:
+          "Hold changed tests to the rules in docs/internals/testing.md. Request tests only as those rules allow.",
+      },
     ],
   },
   knowledge_base: {
     code_guidelines: {
       filePatterns: [
         { files: "docs/internals/effect-services.md", applyTo: "{apps,packages,infra}/**/*.ts" },
         { files: "docs/internals/web-ui.md", applyTo: "apps/web/src/**/*.{tsx,css}" },
+        { files: "docs/internals/testing.md", applyTo: "{apps,packages,infra}/**/*.{ts,tsx}" },
       ],
     },
   },

.devcontainer/devcontainer.json

@@ -1,4 +1,4 @@
-// Dev container for T3 Code. Mirrors CI (ubuntu-24.04, Node 24, Rust stable)
+// Dev container for T3 Code. Mirrors CI (ubuntu-24.04, Node 26, Rust stable)
 // and the canonical setup in docs/operations/development.md: global `vp`, `vp i`.
 // Contributor doc: docs/internals/devcontainer.md
 {
@@ -8,7 +8,7 @@
     // nodeGypDependencies (default true) brings python3/make/g++, which Linux
     // needs for node-pty's node-gyp fallback (its prebuilds are mac/win only).
     "ghcr.io/devcontainers/features/node:2": {
-      "version": "24"
+      "version": "26"
     },
     // native/resource-monitor (edition 2024, needs stable >= 1.85). The server
     // degrades gracefully without the binary, but CI checks cargo fmt + test.

.fork/lint-deferred.mjs

@@ -16,17 +16,34 @@ export const DEFERRED_LINT_SCOPE = [
   // The fork owns this file's Sidebar() body, which still memoizes by hand.
   "apps/web/src/components/Sidebar.tsx",
   "apps/web/src/components/sidebar/SidebarChrome.tsx",
+  // Fork-owned code outside apps/web/src, deferred alongside it since the 2026-10-28 sync.
+  ".fork/**",
+  "apps/web/fork/**",
+  "apps/desktop/src/fork/**",
+  "apps/desktop/src/preview/DesignSource*.ts",
+  "apps/desktop/src/app/Desktop*Fork*.test.ts",
+  "apps/server/src/**/fork*.ts",
+  "apps/server/src/git/resolveBootstrapThreadBranch.ts",
+  "apps/server/src/scheduledTasks/githubPrTrigger.ts",
+  "packages/contracts/src/scheduledTaskRuns.ts",
+  "packages/shared/src/forkDesignProps.ts",
 ];
 
 /** `[oxlint plugin/rule, baseline]` — the baseline is the most warnings allowed. */
 export const DEFERRED_LINT_RULES = [
-  ["react/exhaustive-effect-dependencies", 3],
+  ["react/exhaustive-effect-dependencies", 4],
   ["react/memo-dependencies", 12],
-  ["react/refs", 18],
-  ["react/set-state-in-effect", 4],
+  ["react/refs", 15],
+  ["react/set-state-in-effect", 5],
   ["t3code/no-manual-memo", 131],
   ["t3code/no-outset-state-indicators", 12],
   // Section dividers in the vendored design-mode engine, kept verbatim for re-syncs.
-  ["t3code/no-low-value-comments", 6],
+  ["t3code/no-low-value-comments", 876],
   ["t3code/no-raw-resize-observer", 4],
+  // Upstream rules new in the 2026-10-28 sync; fork code predates them.
+  ["react/preserve-manual-memoization", 2],
+  ["t3code/no-em-dash-copy", 87],
+  ["t3code/no-unreasoned-state-sync", 39],
+  ["t3code/require-disposable-render", 16],
+  ["t3code/no-frame-waits-in-browser-tests", 1],
 ];

.fork/notes/FORK-DATA-ISOLATION-HANDOFF.md

@@ -350,7 +350,7 @@ test as a follow-up.
 
 > **Point-in-time snapshot (2026-07-26, pre-fix).** Cleanup owed on this
 > machine once a fixed build is verified: delete `/Applications/T3 Code
-Fork.app` (v0.1.1), delete the orphaned `~/.t3/userdata-fork`, and note that
+> Fork.app` (v0.1.1), delete the orphaned `~/.t3/userdata-fork`, and note that
 > `~/.t3/caches/*.json` were rewritten and one `auth_sessions` row was
 > inserted per §2.2 (both inert). The backup can be removed once v0.1.2 is
 > verified by launch.

.fork/notes/FORK-LINT-GUARD-HANDOFF.md

@@ -175,7 +175,7 @@ Recorded so they are not silently re-litigated:
 
 1. **CI behaviour.** Everything in §2 ran on macOS locally. The guard has never run in an
    Actions runner. `vp lint` with an explicit path list under `setup-vp` with `run-install:
-true` is untested there.
+   true` is untested there.
 
 2. **Path list length.** 27 lintable paths today. Whether a growing list hits an argv limit,
    or whether Oxlint dedupes an overlapping dir + file argument sanely, is untested. Passing

.github/actions/setup-ci-deps/action.yml

@@ -1,51 +1,153 @@
 name: Setup CI dependencies
 description: Install Vite+ and the workspace dependencies from cache.
+inputs:
+  task-cache-read-token:
+    description: Read-only credential for the private maintainer task cache
+    required: false
+    default: ""
+  install:
+    description: Set to "false" to set up Vite+ only, with no pnpm store or install
+    required: false
+    default: "true"
+  install-args:
+    description: Arguments for `vp install`, such as filters. Empty installs the whole workspace.
+    required: false
+    default: ""
 runs:
   using: composite
   steps:
-    # setup-vp reuses an installed exact version, so restoring its home skips the
-    # installer download on every job.
+    # ~/.vite-plus holds vp, the Node.js runtime, and pnpm. A cache entry never
+    # updates, so the key names all three versions; otherwise a pnpm or Node.js
+    # bump makes every job download them from npm again.
     - name: Resolve Vite+ version
       id: vp
       shell: bash
       run: |
         echo "version=$(sed -nE 's/^  vite-plus: ([0-9][^ ]*)$/\1/p' pnpm-workspace.yaml)" >> "$GITHUB_OUTPUT"
+        echo "node=$(jq -r '.engines.node' package.json)" >> "$GITHUB_OUTPUT"
+        echo "pnpm=$(jq -r '.packageManager' package.json)" >> "$GITHUB_OUTPUT"
 
+    # Pinned because release-desktop.yml signs builds with this action in the job.
     - name: Cache Vite+
+      id: vp_cache
       if: steps.vp.outputs.version != ''
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
       with:
         path: ~/.vite-plus
-        key: vite-plus-home-v1-${{ runner.os }}-${{ runner.arch }}-${{ steps.vp.outputs.version }}
+        key: vite-plus-home-v2-${{ runner.os }}-${{ runner.arch }}-${{ steps.vp.outputs.version }}-node${{ steps.vp.outputs.node }}-${{ steps.vp.outputs.pnpm }}
 
+    # setup-vp always runs the installer, which fetches vp from npm even when
+    # this exact version is installed. A cache hit already has everything, so
+    # skip setup-vp and do its remaining work here. This keeps npm outages from
+    # failing jobs.
+    - name: Use cached Vite+
+      if: steps.vp_cache.outputs.cache-hit == 'true'
+      shell: bash
+      run: |
+        echo "$HOME/.vite-plus/bin" >> "$GITHUB_PATH"
+        "$HOME/.vite-plus/bin/vp" env use "${{ steps.vp.outputs.node }}"
+
+    # vp gives each Node.js download attempt 10 minutes by default, so one
+    # stalled stream holds the job that long. It retries 3 times and resumes
+    # partial bytes, so a shorter limit costs a slow download only a retry.
     - name: Setup Vite+
-      uses: voidzero-dev/setup-vp@v1
+      if: steps.vp_cache.outputs.cache-hit != 'true'
+      uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
+      env:
+        VP_DOWNLOAD_TIMEOUT: "120"
       with:
         node-version-file: package.json
         cache: false
         run-install: false
 
-    - name: Resolve pnpm store path
+    # A shared key lets whichever install saves first, often a small filtered
+    # one, become every job's store. Each set of install args gets its own.
+    - name: Resolve pnpm store
       id: pnpm_store
+      if: inputs.install == 'true'
       shell: bash
+      env:
+        INSTALL_ARGS: ${{ inputs.install-args }}
       run: |
-        store_path="$(vp pm cache dir)"
-        echo "path=$store_path" >> "$GITHUB_OUTPUT"
+        echo "path=$(vp pm cache dir)" >> "$GITHUB_OUTPUT"
+        metadata_dir="${pnpm_config_cache_dir:-$RUNNER_TEMP/pnpm-metadata}"
+        echo "pnpm_config_cache_dir=$metadata_dir" >> "$GITHUB_ENV"
+        echo "verified=$metadata_dir/lockfile-verified.jsonl" >> "$GITHUB_OUTPUT"
+        if [[ -z "$INSTALL_ARGS" ]]; then
+          echo "namespace=full" >> "$GITHUB_OUTPUT"
+        else
+          echo "namespace=filtered-$(printf '%s' "$INSTALL_ARGS" | cksum | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"
+        fi
 
-    # setup-vp's shared cache key ignores install filters. Keep full installs in a
-    # separate namespace, including fallback restores.
+    # Filtered installs prefer the current full store, which holds every package,
+    # over an older store of their own.
     # The pnpm store stays a cache tarball on the runner's own disk. A store on a
     # Blacksmith sticky disk mounts in under a second, but pnpm then copies every
     # package across filesystems instead of hard-linking it: install took 28-49s
     # against 9s plus an 11s restore.
-    - name: Cache full pnpm store
-      uses: actions/cache@v6
+    - name: Restore pnpm store
+      id: pnpm_cache
+      if: inputs.install == 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
       with:
         path: ${{ steps.pnpm_store.outputs.path }}
-        key: pnpm-full-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
+        key: pnpm-${{ steps.pnpm_store.outputs.namespace }}-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
         restore-keys: |
+          pnpm-full-v1-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
+          pnpm-${{ steps.pnpm_store.outputs.namespace }}-v1-${{ runner.os }}-${{ runner.arch }}-
           pnpm-full-v1-${{ runner.os }}-${{ runner.arch }}-
 
+    # pnpm accepts an earlier pass for the same lockfile and policy at any age, so
+    # a cached record skips fetching registry metadata for every package.
+    - name: Restore lockfile verification
+      id: pnpm_verified
+      if: inputs.install == 'true'
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: ${{ steps.pnpm_store.outputs.verified }}
+        key: pnpm-verified-v1-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json') }}
+
     - name: Install dependencies
+      if: inputs.install == 'true'
       shell: bash
-      run: vp install
+      env:
+        INSTALL_ARGS: ${{ inputs.install-args }}
+      # Unquoted so each filter is its own argument.
+      run: vp install $INSTALL_ARGS
+
+    - name: Save lockfile verification
+      if: inputs.install == 'true' && steps.pnpm_verified.outputs.cache-hit != 'true'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: ${{ steps.pnpm_store.outputs.verified }}
+        key: ${{ steps.pnpm_verified.outputs.cache-primary-key }}
+
+    # A filtered install that started from the current full store adds nothing
+    # worth a second copy of it.
+    - name: Save pnpm store
+      if: >-
+        inputs.install == 'true' &&
+        steps.pnpm_cache.outputs.cache-hit != 'true' &&
+        (steps.pnpm_store.outputs.namespace == 'full' ||
+          steps.pnpm_cache.outputs.cache-matched-key != format('pnpm-full-v1-{0}-{1}-{2}', runner.os, runner.arch, hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json')))
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      with:
+        path: ${{ steps.pnpm_store.outputs.path }}
+        key: ${{ steps.pnpm_cache.outputs.cache-primary-key }}
+
+    - name: Enable shared task cache
+      if: >-
+        github.repository == 'pingdotgg/t3code' &&
+        (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+        hashFiles('.task-cache.json') != '' &&
+        inputs.task-cache-read-token != ''
+      shell: bash
+      env:
+        T3_TASK_CACHE_READ_TOKEN: ${{ inputs.task-cache-read-token }}
+      run: |
+        node infra/task-cache/scripts/install-ci.ts
+        if [[ ( "$GITHUB_EVENT_NAME" == pull_request && "$GITHUB_BASE_REF" == main ) || ( "$GITHUB_EVENT_NAME" == push && "$GITHUB_REF" == refs/heads/main ) ]]; then
+          echo 'VP_REMOTE_CACHE=read-write' >> "$GITHUB_ENV"
+        else
+          echo 'VP_REMOTE_CACHE=read' >> "$GITHUB_ENV"
+        fi

.github/scripts/check-nightly-release.test.cjs

@@ -61,12 +61,6 @@ for (const releaseChannel of ["stable", "nightly"]) {
     );
     assert.equal(calls.length, 0);
   });
-
-  test(`allows a manual ${releaseChannel} release from main`, async () => {
-    const { options, calls } = releaseSourceFixture();
-    await assertReleaseSource({ ...options, releaseChannel });
-    assert.equal(calls[0].basehead, "candidate...main");
-  });
 }
 
 for (const comparisonStatus of ["behind", "diverged"]) {
@@ -79,13 +73,6 @@ for (const comparisonStatus of ["behind", "diverged"]) {
   });
 }
 
-test("accepts a release commit already contained in main", async () => {
-  for (const comparisonStatus of ["ahead", "identical"]) {
-    const { options } = releaseSourceFixture({ comparisonStatus, eventName: "push" });
-    await assertCommitOnDefaultBranch({ ...options, sha: "release-commit" });
-  }
-});
-
 function fixture({ releases = [nightly(7)], comparisonStatus = "ahead" } = {}) {
   const calls = [];
   return {
@@ -119,26 +106,6 @@ test("releases the first nightly when no nightly is published", async () => {
   assert.equal(await shouldReleaseNightly(options), true);
 });
 
-test("waits six hours after publication, including manual nightlies", async () => {
-  for (const age of [0, 3, 6 - 1 / 3600]) {
-    const { options, calls } = fixture({ releases: [nightly(age)] });
-    assert.equal(await shouldReleaseNightly(options), false);
-    assert.equal(calls.length, 0);
-  }
-});
-
-test("releases new commits at six hours and after an idle period", async () => {
-  for (const age of [6, 7, 24]) {
-    const { options } = fixture({ releases: [nightly(age)] });
-    assert.equal(await shouldReleaseNightly(options), true);
-  }
-});
-
-test("skips unchanged commits after the gap", async () => {
-  const { options } = fixture({ comparisonStatus: "identical" });
-  assert.equal(await shouldReleaseNightly(options), false);
-});
-
 test("uses publication time, not release order or the tagged commit date", async () => {
   const { options } = fixture({
     releases: [nightly(10), nightly(1), nightly(20, { tag_name: "nightly-v0.9.0" })],
@@ -153,13 +120,6 @@ test("ignores stable releases and drafts when checking the gap", async () => {
   assert.equal(await shouldReleaseNightly(options), true);
 });
 
-test("compares against the published tag, including legacy nightly tags", async () => {
-  const tag = "nightly-v0.9.0";
-  const { options, calls } = fixture({ releases: [nightly(7, { tag_name: tag })] });
-  assert.equal(await shouldReleaseNightly(options), true);
-  assert.equal(calls[0].basehead, `${tag}...new`);
-});
-
 test("fails instead of releasing when GitHub cannot supply release state", async () => {
   const { options } = fixture();
   options.github.paginate = async () => {
@@ -211,8 +171,3 @@ test("stable releases derive the version from legacy nightly tags", async () =>
   });
   assert.equal((await resolveLatestNightlyCommit(options)).version, "0.9.0");
 });
-
-test("stable releases fail without a published nightly", async () => {
-  const { options } = nightlyCommitFixture({ releases: [nightly(0, { tag_name: "v1.0.0" })] });
-  await assert.rejects(resolveLatestNightlyCommit(options), /No published nightly/);
-});