chore(sync): merge upstream main through 7ac952c630, plus Home, task graphs, dictation, ghost text and ten Android PRs

.coderabbit.config.ts

@@ -1,15 +1,14 @@
 import { defineConfig, type CodeRabbitContext } from "@coderabbitai/config";
 
-// Org members and collaborators merge their own pull requests. On anyone else's, CodeRabbit
-// requests changes until its comments are resolved, then approves.
+// Org members and collaborators can approve their own pull requests.
 const UNGATED_AUTHORS = new Set(["OWNER", "MEMBER", "COLLABORATOR"]);
 const isGated = ({ pr }: CodeRabbitContext) => !UNGATED_AUTHORS.has(pr?.authorAssociation ?? "");
 
 export default defineConfig((ctx) => ({
   reviews: {
     high_level_summary: false,
     review_status: false,
-    request_changes_workflow: isGated(ctx),
+    request_changes_workflow: false,
     allow_author_approval: !isGated(ctx),
     auto_review: {
       enabled: true,

.github/ISSUE_TEMPLATE/via-triage.yml

@@ -37,7 +37,7 @@ body:
     id: version
     attributes:
       label: Version
-      description: Installed t3 version or commit.
+      description: Version the bug happened on (not the `t3 triage` CLI version), or unknown.
       placeholder: 0.0.33
     validations:
       required: true

.github/scripts/mirror-play-apk.cjs

@@ -0,0 +1,189 @@
+// Mirrors the newest build on a Google Play track to a rolling GitHub
+// prerelease as a universal APK. Play generates and signs that APK from the
+// uploaded bundle with the app signing key, so it carries the same signature
+// as the Play Store install. Run by .github/workflows/mobile-android-apk.yml.
+const { execFileSync } = require("node:child_process");
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { Readable } = require("node:stream");
+const { pipeline } = require("node:stream/promises");
+
+const PLAY_API = "https://androidpublisher.googleapis.com/androidpublisher/v3/applications";
+
+function requireEnv(name) {
+  const value = process.env[name];
+  if (!value) throw new Error(`${name} is required.`);
+  return value;
+}
+
+// Service account key -> OAuth access token via a self-signed JWT grant.
+async function playAccessToken(key) {
+  const now = Math.floor(Date.now() / 1000);
+  const encode = (value) => Buffer.from(JSON.stringify(value)).toString("base64url");
+  const unsigned = `${encode({ alg: "RS256", typ: "JWT" })}.${encode({
+    iss: key.client_email,
+    scope: "https://www.googleapis.com/auth/androidpublisher",
+    aud: key.token_uri,
+    iat: now,
+    exp: now + 600,
+  })}`;
+  const signature = crypto.sign("RSA-SHA256", Buffer.from(unsigned), key.private_key);
+  const response = await fetch(key.token_uri, {
+    method: "POST",
+    body: new URLSearchParams({
+      grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+      assertion: `${unsigned}.${signature.toString("base64url")}`,
+    }),
+  });
+  if (!response.ok) {
+    throw new Error(`Google token exchange failed: ${response.status} ${await response.text()}`);
+  }
+  return (await response.json()).access_token;
+}
+
+async function play(token, method, url) {
+  const response = await fetch(url, { method, headers: { authorization: `Bearer ${token}` } });
+  if (!response.ok) {
+    throw new Error(`${method} ${url} failed: ${response.status} ${await response.text()}`);
+  }
+  return response;
+}
+
+// Highest version code the track serves, with its release name. Play names a
+// release after the bundle's versionName unless the uploader sets one. This
+// endpoint reads without opening an edit; an edit would invalidate any open
+// EAS Submit edit made with the same service account.
+async function newestTrackBuild(token, appUrl, trackName) {
+  const { releases = [] } = await (
+    await play(token, "GET", `${appUrl}/tracks/${trackName}/releases`)
+  ).json();
+  let newest;
+  for (const release of releases) {
+    if (release.releaseLifecycleState !== "RELEASE_LIFECYCLE_STATE_PUBLISHED") continue;
+    for (const { versionCode } of release.activeArtifacts ?? []) {
+      if (!newest || versionCode > newest.versionCode) {
+        newest = { versionCode, versionName: release.releaseName || String(versionCode) };
+      }
+    }
+  }
+  return newest;
+}
+
+function gh(...args) {
+  return execFileSync("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+}
+
+function readRelease(tag) {
+  try {
+    return JSON.parse(gh("release", "view", tag, "--json", "assets,body"));
+  } catch {
+    return undefined;
+  }
+}
+
+// Downloads the build's universal APK and uploads it, creating the release on
+// first use. Returns false when Play lists no universal APK, which happens
+// while it is still processing a fresh upload.
+async function uploadApk({ token, appUrl, build, tag, apkName, notes, release }) {
+  const generated = await (
+    await play(token, "GET", `${appUrl}/generatedApks/${build.versionCode}`)
+  ).json();
+  // One entry per app signing key. More than one means a key rotation, so
+  // fail rather than guess which signature testers should get.
+  const universal = (generated.generatedApks ?? []).filter((entry) => entry.generatedUniversalApk);
+  if (universal.length === 0) return false;
+  if (universal.length > 1) {
+    throw new Error(`Play returned ${universal.length} universal APKs, one per signing key.`);
+  }
+  const { downloadId } = universal[0].generatedUniversalApk;
+
+  const apkPath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "apk-")), apkName);
+  const download = await play(
+    token,
+    "GET",
+    `${appUrl}/generatedApks/${build.versionCode}/downloads/${encodeURIComponent(downloadId)}:download?alt=media`,
+  );
+  await pipeline(Readable.fromWeb(download.body), fs.createWriteStream(apkPath));
+
+  if (!release) {
+    // Prerelease with a non-v tag: release.yml, the desktop updater, the CLI,
+    // and the marketing site's latest-release lookup all ignore it.
+    gh(
+      "release",
+      "create",
+      tag,
+      "--prerelease",
+      "--latest=false",
+      "--title",
+      "T3 Code for Android (nightly)",
+      "--notes",
+      notes,
+    );
+  }
+  // --clobber replaces an asset a failed upload left behind.
+  gh("release", "upload", tag, apkPath, "--clobber");
+  return true;
+}
+
+async function main() {
+  const packageName = requireEnv("PACKAGE_NAME");
+  const trackName = requireEnv("PLAY_TRACK");
+  const tag = requireEnv("RELEASE_TAG");
+  const key = JSON.parse(requireEnv("GOOGLE_PLAY_SERVICE_ACCOUNT_JSON"));
+  const summary = (line) =>
+    process.env.GITHUB_STEP_SUMMARY &&
+    fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `${line}\n`);
+
+  const token = await playAccessToken(key);
+  const appUrl = `${PLAY_API}/${packageName}`;
+  const build = await newestTrackBuild(token, appUrl, trackName);
+  if (!build) {
+    console.log(`The ${trackName} track has no live release.`);
+    return;
+  }
+
+  const safeName = build.versionName.replace(/[^0-9A-Za-z.]+/g, "-").replace(/^-|-$/g, "");
+  const apkName = `t3code-android-${safeName}-${build.versionCode}.apk`;
+  const notes = [
+    `T3 Code for Android that works with nightly servers, mirrored from the Google Play ${trackName} track. Current build: ${build.versionName} (${build.versionCode}).`,
+    "",
+    "The Play Store release can't connect to a nightly server yet. Install this APK if you can't join the Play testing group. Only the newest build is kept here.",
+  ].join("\n");
+
+  const release = readRelease(tag);
+  const assets = release?.assets ?? [];
+  // A failed upload can leave an empty asset under the final name.
+  const published = assets.some(
+    (asset) => asset.name === apkName && asset.state === "uploaded" && asset.size > 0,
+  );
+  if (published) {
+    console.log(`${apkName} is already published.`);
+  } else if (await uploadApk({ token, appUrl, build, tag, apkName, notes, release })) {
+    console.log(`Published ${apkName}.`);
+    summary(`:white_check_mark: Published \`${apkName}\` to the \`${tag}\` release.`);
+  } else {
+    // The next run retries.
+    console.log(`Play lists no universal APK for ${build.versionCode}.`);
+    summary(
+      `:hourglass: Play lists no universal APK for ${build.versionName} (${build.versionCode}).`,
+    );
+    return;
+  }
+
+  // Reconciled on every run so an interrupted cleanup finishes on the next one.
+  for (const stale of assets) {
+    if (stale.name.endsWith(".apk") && stale.name !== apkName) {
+      gh("release", "delete-asset", tag, stale.name, "--yes");
+    }
+  }
+  if (release && release.body.replace(/\r\n/g, "\n").trim() !== notes) {
+    gh("release", "edit", tag, "--notes", notes);
+  }
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

.github/triage/PLAYBOOK.md

@@ -6,7 +6,7 @@ crashes, auth failures, broken setups, slow launches, or anything else. Your job
 find out what went wrong, unblock the user if you can, and turn what you learned into
 a well written GitHub issue when one is warranted.
 
-A triage context file with machine facts (version, OS, paths, server liveness) was
+A triage context file with machine facts (versions, OS, paths, server liveness) was
 provided alongside this playbook. Everything machine-specific lives there, not here.
 
 ## 1. Ask what went wrong
@@ -18,9 +18,15 @@ valuable thing you can extract from this conversation.
 
 ## 2. Read the machine facts
 
-Read the triage context file before investigating. It tells you the installed
-version, the OS, whether the server process is currently running, and the exact
-paths for state, logs, and the database.
+Read the triage context file before investigating. It tells you the OS, whether
+the server process is currently running, and the exact paths for state, logs, and
+the database.
+
+Its triage CLI version (called "Installed version" in older context files) is only
+the version of the `t3` that ran `t3 triage`. It is often not the build the bug
+happened on: `npx t3 triage` runs whatever `t3` npm resolves, while the user may
+run the desktop app, the background service, or a nightly. The server process line
+gives the local server's version when the server recorded one.
 
 ## 3. Check for a newer playbook
 
@@ -30,8 +36,16 @@ instead of this one. The user may be on an old release with an old copy.
 
 ## 4. Get the source
 
-Clone the repo at the tag matching the user's installed version, into the source
-cache directory named in the context file, one subdirectory per commit hash:
+Before cloning, ask the user which version, device, and surface the bug happened
+on. The bug may have happened on another machine, a remote server, the mobile app,
+or an older build they have since updated. Check their answer against local facts
+where they apply: the server version in the context file, or `serverVersion` from
+`<origin>/.well-known/t3/environment` when a local server is running. If neither
+the user nor the machine can tell you the version, say it is unknown. Do not guess.
+
+Clone the repo at the release tag for that version (`v` followed by the version,
+such as `v0.0.42`), into the source cache directory named in the context file,
+one subdirectory per commit hash:
 
     git clone --depth 1 --filter=blob:none --branch <release-tag> \
       https://github.com/pingdotgg/t3code <source-cache-dir>/<hash>
@@ -82,8 +96,8 @@ comes from this repo's `main` branch.
 
 Search existing issues in pingdotgg/t3code (use `gh`, or the public GitHub search
 API if `gh` is missing or not logged in). Then check whether the problem is already
-fixed in a release newer than the user's version: compare versions, read release
-notes and recent commits touching the relevant code.
+fixed in a release newer than the version the bug happened on: compare versions,
+read release notes and recent commits touching the relevant code.
 
 If the user is behind and the fix likely shipped, say so plainly and give them the
 exact update command for how they run the CLI (the context file records how it was
@@ -105,6 +119,8 @@ of `main` for that work, never the tag-pinned diagnosis clone.
 - Match the structure of the `via-triage` issue template
   (`.github/ISSUE_TEMPLATE/via-triage.yml` in the repo): what happened, diagnosis,
   repro steps, environment, evidence, related issues.
+- Under Version, give the version the bug happened on from step 4, or say it is
+  unknown. Name the triage CLI version only as the CLI's.
 - Label it `via-triage`. Use a plain, specific title with no prefix.
 - Show the user the complete final issue text and get an explicit yes before
   posting. Never post without it.

.github/workflows/cursor-hygiene-webhook.yml

@@ -28,9 +28,23 @@ jobs:
             echo "Missing CURSOR_T3CODE_WEBHOOK_URL or CURSOR_T3CODE_WEBHOOK_AUTH — skipping."
             exit 0
           fi
-          curl -fsS --max-time 60 -X POST "$URL" \
-            -H "Authorization: $AUTH" \
-            -H "Content-Type: application/json" \
-            -H "X-GitHub-Event: ${{ github.event_name }}" \
-            -H "X-GitHub-Delivery: ${{ github.run_id }}-${{ github.run_attempt }}" \
-            --data-binary @"${{ github.event_path }}"
+          for attempt in 1 2 3; do
+            curl_status=0
+            http_status=$(curl -fsS --max-time 60 -X POST "$URL" \
+              --output /dev/null --write-out '%{http_code}' \
+              -H "Authorization: $AUTH" \
+              -H "Content-Type: application/json" \
+              -H "X-GitHub-Event: ${{ github.event_name }}" \
+              -H "X-GitHub-Delivery: ${{ github.run_id }}-${{ github.run_attempt }}" \
+              --data-binary @"${{ github.event_path }}") || curl_status=$?
+            if [ "$curl_status" -eq 0 ]; then
+              exit 0
+            fi
+            if [ "$GITHUB_REF" != "refs/heads/main" ] || \
+               [ "$curl_status" -ne 22 ] || [ "$http_status" != "400" ] || \
+               [ "$attempt" -eq 3 ]; then
+              exit "$curl_status"
+            fi
+            echo "Cursor webhook returned HTTP 400; retrying in 5 seconds ($attempt/2)."
+            sleep 5
+          done

.github/workflows/mobile-android-apk.yml

@@ -0,0 +1,59 @@
+name: Mobile Android APK
+
+# Publishes the newest nightly-compatible Android build as a sideloadable APK
+# on the rolling "android-nightly" prerelease, for nightly users who can't join
+# the Play testing group. Play re-signs uploaded bundles with the app signing
+# key, so its universal APK matches the Play Store install and needs no signing
+# secrets here. EAS submits asynchronously (--no-wait), so this polls Play
+# instead of chaining off mobile-eas-production.yml; runs with nothing new exit
+# early.
+on:
+  schedule:
+    # Avoid minute zero, when GitHub scheduled jobs are busiest.
+    - cron: "23 * * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: mobile-android-apk
+  cancel-in-progress: false
+
+jobs:
+  mirror:
+    name: Mirror Play APK
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    env:
+      PACKAGE_NAME: com.t3tools.t3code
+      # eas.json submits v2-preview builds to this closed testing track; they
+      # speak the orchestration protocol nightly servers use, which the Play
+      # Store release can't.
+      PLAY_TRACK: v2
+      RELEASE_TAG: android-nightly
+    steps:
+      - id: credentials
+        name: Check for Play credentials
+        env:
+          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
+        run: |
+          if [ -n "$GOOGLE_PLAY_SERVICE_ACCOUNT_JSON" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "GOOGLE_PLAY_SERVICE_ACCOUNT_JSON is not available; skipping APK mirror."
+          fi
+
+      - name: Checkout
+        if: steps.credentials.outputs.present == 'true'
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: .github/scripts
+
+      - name: Mirror the newest APK
+        if: steps.credentials.outputs.present == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          GOOGLE_PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.GOOGLE_PLAY_SERVICE_ACCOUNT_JSON }}
+        run: node .github/scripts/mirror-play-apk.cjs

.github/workflows/mobile-eas-preview.yml

@@ -100,6 +100,8 @@ jobs:
         uses: expo/expo-github-action/continuous-deploy-fingerprint@main
         env:
           EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          # The Expo action otherwise suppresses the EAS command's failure output.
+          RUNNER_DEBUG: "1"
         with:
           profile: preview:dev
           branch: pr-${{ github.event.pull_request.number }}