feat: build the Command Center agentic OS foundation

.command-center-public-baseline

@@ -0,0 +1 @@
+b511227b7ad421c422f1ebca65116776020e4799

.github/workflows/ci.yml

@@ -7,9 +7,50 @@ on:
       - main
 
 jobs:
+  public_safety:
+    name: Public repository safety
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout full history
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Scan Git history for secrets
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_VERSION: 8.30.1
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Enforce the public/private boundary
+        run: vp run public:check
+        env:
+          COMMAND_CENTER_PUBLIC_DENYLIST: ${{ secrets.COMMAND_CENTER_PUBLIC_DENYLIST }}
+
+      - name: Require the private identifier denylist on trusted changes
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          COMMAND_CENTER_PUBLIC_DENYLIST: ${{ secrets.COMMAND_CENTER_PUBLIC_DENYLIST }}
+        run: |
+          if [ -z "$COMMAND_CENTER_PUBLIC_DENYLIST" ]; then
+            echo "Configure the COMMAND_CENTER_PUBLIC_DENYLIST Actions secret before publishing." >&2
+            exit 1
+          fi
+
   check:
     name: Check
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -42,7 +83,7 @@ jobs:
 
   test:
     name: Test
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -63,7 +104,7 @@ jobs:
 
   mobile_native_static_analysis:
     name: Mobile Native Static Analysis
-    runs-on: blacksmith-12vcpu-macos-26
+    runs-on: macos-26
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -84,7 +125,7 @@ jobs:
 
   release_smoke:
     name: Release Smoke
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout

.github/workflows/upstream-sync.yml

@@ -0,0 +1,150 @@
+name: Upstream sync
+
+on:
+  workflow_dispatch:
+    inputs:
+      upstream_ref:
+        description: Exact fetched ref (refs/tags/... or refs/remotes/upstream/...)
+        required: true
+        type: string
+      expected_commit:
+        description: Full 40-character commit expected at that ref
+        required: true
+        type: string
+
+concurrency:
+  group: command-center-upstream-sync
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync:
+    name: Validate, verify, and draft sync PR
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - name: Checkout the public fork
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: main
+
+      - name: Fetch the canonical T3 Code repository
+        run: |
+          if git remote get-url upstream >/dev/null 2>&1; then
+            git remote set-url upstream https://github.com/pingdotgg/t3code.git
+          else
+            git remote add upstream https://github.com/pingdotgg/t3code.git
+          fi
+          git fetch --prune --force upstream \
+            '+refs/heads/*:refs/remotes/upstream/*' \
+            '+refs/tags/*:refs/tags/*'
+
+      - name: Validate the exact target and ancestry
+        id: plan
+        env:
+          UPSTREAM_REF: ${{ inputs.upstream_ref }}
+          EXPECTED_COMMIT: ${{ inputs.expected_commit }}
+        run: |
+          node scripts/command-center/upstream-sync.ts plan \
+            --upstream-ref "$UPSTREAM_REF" \
+            --expected-commit "$EXPECTED_COMMIT" \
+            --github-output "$GITHUB_OUTPUT"
+
+      - name: Refuse to replace an existing sync branch
+        if: steps.plan.outputs.status == 'needs-sync'
+        env:
+          BRANCH_NAME: ${{ steps.plan.outputs.branch_name }}
+        run: |
+          if git ls-remote --exit-code --heads origin "$BRANCH_NAME"; then
+            echo "A sync branch already exists; review or remove it before dispatching again." >&2
+            exit 1
+          fi
+
+      - name: Merge upstream into an isolated branch
+        if: steps.plan.outputs.status == 'needs-sync'
+        env:
+          BRANCH_NAME: ${{ steps.plan.outputs.branch_name }}
+          TARGET_COMMIT: ${{ steps.plan.outputs.target_commit }}
+        run: |
+          git config user.name github-actions[bot]
+          git config user.email command-center-sync@example.test
+          git switch --create "$BRANCH_NAME"
+          git merge --no-ff --no-edit "$TARGET_COMMIT"
+
+      - name: Setup Vite+
+        if: steps.plan.outputs.status == 'needs-sync'
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Require the private identifier denylist
+        if: steps.plan.outputs.status == 'needs-sync'
+        env:
+          COMMAND_CENTER_PUBLIC_DENYLIST: ${{ secrets.COMMAND_CENTER_PUBLIC_DENYLIST }}
+        run: |
+          if [ -z "$COMMAND_CENTER_PUBLIC_DENYLIST" ]; then
+            echo "Configure the COMMAND_CENTER_PUBLIC_DENYLIST Actions secret before syncing." >&2
+            exit 1
+          fi
+
+      - name: Verify the complete upstream delta against the old baseline
+        if: steps.plan.outputs.status == 'needs-sync'
+        run: vp run public:check
+        env:
+          COMMAND_CENTER_PUBLIC_DENYLIST: ${{ secrets.COMMAND_CENTER_PUBLIC_DENYLIST }}
+
+      - name: Scan the complete candidate history for secrets
+        if: steps.plan.outputs.status == 'needs-sync'
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_VERSION: 8.30.1
+
+      - name: Verify upstream and Command Center behavior
+        if: steps.plan.outputs.status == 'needs-sync'
+        run: |
+          vp check
+          vpr typecheck
+          vp run test
+          vp run build:desktop
+
+      - name: Advance the baseline only after the upstream delta passes
+        if: steps.plan.outputs.status == 'needs-sync'
+        env:
+          TARGET_COMMIT: ${{ steps.plan.outputs.target_commit }}
+        run: |
+          node scripts/command-center/upstream-sync.ts advance-baseline \
+            --expected-commit "$TARGET_COMMIT"
+          git add .command-center-public-baseline
+          git commit -m "chore: advance public upstream baseline"
+
+      - name: Push the reviewed sync candidate
+        if: steps.plan.outputs.status == 'needs-sync'
+        env:
+          BRANCH_NAME: ${{ steps.plan.outputs.branch_name }}
+        run: git push --set-upstream origin "$BRANCH_NAME"
+
+      - name: Open a draft sync pull request
+        if: steps.plan.outputs.status == 'needs-sync'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BRANCH_NAME: ${{ steps.plan.outputs.branch_name }}
+          UPSTREAM_REF: ${{ inputs.upstream_ref }}
+          TARGET_COMMIT: ${{ steps.plan.outputs.target_commit }}
+        run: |
+          gh pr create \
+            --base main \
+            --head "$BRANCH_NAME" \
+            --draft \
+            --title "chore: sync T3 Code upstream ${TARGET_COMMIT:0:12}" \
+            --body "Manual upstream sync from \`$UPSTREAM_REF\` at \`$TARGET_COMMIT\`. The workflow validated ancestry from the pinned public baseline and completed the public-boundary, check, type, test, and desktop-build gates. Preserve the upstream MIT license and attribution during review."
+
+      - name: Record a no-op
+        if: steps.plan.outputs.status == 'already-contained'
+        run: echo "The exact requested upstream commit is already contained in main; no branch or PR was created."

.gitignore

@@ -15,6 +15,7 @@ build/
 release/
 release-mock/
 .t3
+.t3-config
 .idea/
 apps/web/.playwright
 apps/web/playwright-report
@@ -35,3 +36,58 @@ node_modules/
 *.log
 .env*
 !.env.example
+
+# Command Center configuration and runtime state are never part of the public fork.
+/.command-center-private-denylist
+/.command-center-config/
+/.command-center/
+/.vite-plus/
+/userdata/
+/runtime-data/
+*.db
+*.db-*
+*.db.*
+*.db3
+*.db3-*
+*.db3.*
+*.duckdb
+*.duckdb-*
+*.duckdb.*
+*.accdb
+*.accdb-*
+*.accdb.*
+*.mdb
+*.mdb-*
+*.mdb.*
+*.rdb
+*.rdb-*
+*.rdb.*
+*.realm
+*.realm-*
+*.realm.*
+*.sqlite
+*.sqlite-*
+*.sqlite.*
+*.sqlite3
+*.sqlite3-*
+*.sqlite3.*
+*.jsonl
+*.jsonl.*
+*.ndjson
+*.ndjson.*
+*.log.*
+*.pem
+*.key
+*.p12
+*.pfx
+*.mobileprovision
+*.transcript.json
+*.transcript.jsonl
+*.transcript.log
+*.transcript.md
+*.transcript.ndjson
+*.transcript.txt
+*.transcript
+/databases/
+/logs/
+/transcripts/

.gitleaksignore

@@ -0,0 +1,17 @@
+# Exact false-positive fingerprints inherited from the pinned public T3 Code baseline.
+# Never add a Command Center finding here; investigate and remove it instead.
+7a820abfddbf77166d16614bb9bcabe8fcd2c829:apps/server/src/cloud/CliTokenManager.test.ts:generic-api-key:22
+e95b57dc268471c882f734546fdcd92e9a833e45:apps/mobile/src/features/cloud/linkEnvironment.test.ts:generic-api-key:58
+5ae77c0d63ece1a3e3fa5a70bc7717aa7c342756:apps/server/src/cloud/publicConfig.test.ts:generic-api-key:48
+5ae77c0d63ece1a3e3fa5a70bc7717aa7c342756:apps/server/src/cloud/publicConfig.test.ts:generic-api-key:65
+5ae77c0d63ece1a3e3fa5a70bc7717aa7c342756:apps/server/src/cloud/publicConfig.test.ts:generic-api-key:69
+bd851c0203f4318b8222566ef87009a189cdf1f5:.repos/alchemy-effect/examples/cloudflare-dev/test/integ.test.ts:generic-api-key:70
+bd851c0203f4318b8222566ef87009a189cdf1f5:.repos/alchemy-effect/examples/cloudflare-dev/src/NotifyWorkflow.ts:generic-api-key:11
+bd851c0203f4318b8222566ef87009a189cdf1f5:.repos/alchemy-effect/packages/alchemy/src/Cloudflare/Auth/AuthProvider.ts:generic-api-key:705
+bd851c0203f4318b8222566ef87009a189cdf1f5:.repos/alchemy-effect/packages/alchemy/test/KeyPair.test.ts:private-key:19
+bd851c0203f4318b8222566ef87009a189cdf1f5:.repos/alchemy-effect/packages/alchemy/test/AWS/IAM/fixtures.ts:private-key:19
+e3f14058847dbd36695277aab941fefa94e21e5f:.repos/effect-smol/packages/effect/src/Config.ts:generic-api-key:1301
+e3f14058847dbd36695277aab941fefa94e21e5f:.repos/effect-smol/packages/effect/HTTPAPI.md:curl-auth-header:1039
+e3f14058847dbd36695277aab941fefa94e21e5f:.repos/effect-smol/packages/effect/test/unstable/eventlog/EventLogIdentityDerivation.test.ts:generic-api-key:6
+e3f14058847dbd36695277aab941fefa94e21e5f:.repos/effect-smol/cookbooks/schedule.md:generic-api-key:21154
+b7559c467803f923e59a287c112b4c92b96e15c7:apps/server/src/auth/Layers/BootstrapCredentialService.ts:generic-api-key:33

.vite-hooks/pre-commit

@@ -1 +1,3 @@
+node scripts/public-leak-scan.ts --staged
+node scripts/gitleaks-staged.ts
 vp staged