feat(web): auto-reconcile external agent sessions on project open

.coderabbit.yaml

@@ -1,4 +1,4 @@
 reviews:
   review_status: false
   auto_review:
-    enabled: false
+    enabled: true

.devcontainer/devcontainer.json

@@ -1,29 +1,73 @@
+// Dev container for T3 Code. Mirrors CI (ubuntu-24.04, Node 24, Rust stable)
+// and the canonical setup in docs/operations/development.md: global `vp`, `vp i`.
+// Contributor doc: docs/internals/devcontainer.md
 {
-  "name": "T3 Code Dev",
-  "image": "debian:bookworm",
+  "name": "T3 Code",
+  "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04",
   "features": {
-    "ghcr.io/devcontainers/features/git:1": {},
-    "ghcr.io/devcontainers-extra/features/bun:1": {
-      "version": "1.3.11"
+    // nodeGypDependencies (default true) brings python3/make/g++, which Linux
+    // needs for node-pty's node-gyp fallback (its prebuilds are mac/win only).
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "24"
     },
-    "ghcr.io/devcontainers/features/node:1": {
-      "version": "24.13.1"
-    },
-    "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.10",
-      "installTools": false
-    }
+    // native/resource-monitor (edition 2024, needs stable >= 1.85). The server
+    // degrades gracefully without the binary, but CI checks cargo fmt + test.
+    "ghcr.io/devcontainers/features/rust:1": {},
+    "ghcr.io/devcontainers/features/github-cli:1": {}
+  },
+  "hostRequirements": {
+    "cpus": 4,
+    "memory": "8gb",
+    "storage": "32gb"
+  },
+  "containerEnv": {
+    // Keep all runtime state inside the (gitignored) workspace .t3, matching
+    // the worktree default. An explicit --home-dir still wins.
+    "T3CODE_HOME": "${containerWorkspaceFolder}/.t3"
   },
-  "overrideFeatureInstallOrder": [
-    "ghcr.io/devcontainers/features/git",
-    "ghcr.io/devcontainers-extra/features/bun"
+  "mounts": [
+    // vp keeps the pnpm content-addressable store and metadata cache under
+    // ~/.cache/pnpm (verified: the v11 store dir lives there); mounting a
+    // volume there lets installs survive container rebuilds.
+    "source=t3code-pnpm-store,target=/home/vscode/.cache/pnpm,type=volume",
+    // Root node_modules holds the whole pnpm virtual store (.pnpm), so one
+    // volume keeps the heavy tree off the slow macOS/Windows bind mount.
+    // Scoped by devcontainerId so parallel checkouts do not share it.
+    // Codespaces note: prebuild snapshots exclude volumes; drop these mounts
+    // if prebuilt codespaces become the primary workflow.
+    "source=t3code-node-modules-${devcontainerId},target=${containerWorkspaceFolder}/node_modules,type=volume"
   ],
-  "postCreateCommand": {
-    "bun-install": "bun install --backend=copyfile --frozen-lockfile"
+  "onCreateCommand": "bash .devcontainer/on-create.sh",
+  "updateContentCommand": "bash .devcontainer/update-content.sh",
+  "forwardPorts": [5733, 13773],
+  "portsAttributes": {
+    "5733": {
+      "label": "t3 web (open via the pairing URL, not the bare origin)",
+      "onAutoForward": "notify"
+    },
+    "13773": {
+      "label": "t3 server",
+      "onAutoForward": "silent"
+    }
   },
   "customizations": {
+    "codespaces": {
+      "openFiles": ["docs/internals/devcontainer.md"]
+    },
     "vscode": {
-      "extensions": ["oxc.oxc-vscode"]
+      "extensions": ["oxc.oxc-vscode", "rust-lang.rust-analyzer"],
+      "settings": {
+        // .repos is a large vendored read-only reference tree; watching it
+        // burns CPU and file handles.
+        "files.watcherExclude": {
+          "**/.repos/**": true,
+          "**/.t3/**": true
+        },
+        "search.exclude": {
+          "**/.repos": true
+        }
+      }
     }
-  }
+  },
+  "remoteUser": "vscode"
 }

.devcontainer/on-create.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# One-time container setup, baked into prebuilds. Content-dependent work
+# (dependency install, Chromium) lives in update-content.sh.
+set -euo pipefail
+
+# The Vite+ CLI is the repo task runner (vp i, vp run dev, vp test run).
+# Download to a file first: a curl failure inside $( ) would yield an empty
+# script and a false success. VP_NODE_MANAGER=no skips the installer's node
+# shims; Node comes from the devcontainer feature. The VP_*_DIR group (set
+# together, absolute) pins the install location instead of the installer's
+# XDG platform defaults, which moved the binary from ~/.vite-plus/bin to
+# ~/.local/share/vite-plus/bin between releases and would break the check
+# below either way.
+export VP_BIN_DIR="$HOME/.local/share/vite-plus/bin"
+export VP_DATA_DIR="$HOME/.local/share/vite-plus"
+export VP_CACHE_DIR="$HOME/.cache/vite-plus"
+installer=$(mktemp)
+curl -fsSL https://vite.plus -o "$installer"
+VP_NODE_MANAGER=no bash "$installer"
+rm -f "$installer"
+
+# Non-login lifecycle shells never source the profile the installer edits,
+# so expose vp on the default PATH. test -x keeps a bad install loud.
+test -x "$VP_BIN_DIR/vp"
+sudo ln -sf "$VP_BIN_DIR/vp" /usr/local/bin/vp
+
+# First-run terminal notice, rendered by the devcontainers base image.
+sudo mkdir -p /usr/local/etc/vscode-dev-containers
+sudo tee /usr/local/etc/vscode-dev-containers/first-run-notice.txt >/dev/null <<'EOF'
+T3 Code devcontainer
+
+  vp run dev            start server + web, then open the pairing URL it
+                        prints (the bare forwarded port will not authenticate)
+  cp .env.example .env  optional: enable T3 Connect cloud features
+                        (public identifiers, not secrets)
+
+Details: docs/internals/devcontainer.md
+EOF

.devcontainer/update-content.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Runs at creation and on every prebuild content refresh, so codespaces start
+# with deps installed and caches warm. Everything here is idempotent.
+set -euo pipefail
+
+# Volume mounts (pnpm store, node_modules) and the directories docker creates
+# for them arrive root-owned; hand them to the dev user before installing.
+for dir in "$HOME/.cache" "$HOME/.cache/pnpm" node_modules; do
+  if [ -d "$dir" ] && [ "$(stat -c %U "$dir")" != "$(id -un)" ]; then
+    sudo chown "$(id -un):$(id -gn)" "$dir"
+  fi
+done
+
+CI=true vp i
+# Repairs electron's path.txt and exec bits after install, same as CI.
+vp run --filter @t3tools/desktop ensure:electron
+# Pre-warms Vite's dep optimizer (cache is keyed on the absolute path, which
+# is stable inside the container).
+node apps/web/scripts/warm-dep-cache.ts

.github/SECURITY.md

@@ -0,0 +1,8 @@
+# Security policy
+
+Report security vulnerabilities affecting T3 Code or T3 Tools-operated infrastructure to
+[security@ping.gg](mailto:security@ping.gg). Please do not disclose them publicly until we have had
+a reasonable opportunity to investigate and remediate them.
+
+See the [full security policy](https://t3.codes/security-policy) for reporting details, scope,
+and safe harbor terms for good-faith research.

.github/scripts/check-nightly-release.cjs

@@ -1,19 +1,21 @@
 const MINIMUM_RELEASE_GAP_MS = 6 * 60 * 60 * 1000;
 
-// Runs after the workflow acquires the nightly concurrency lock.
-async function shouldReleaseNightly({ github, context, core, now = Date.now() }) {
+const isNightlyTag = (tag) => /^v.*-nightly\./.test(tag) || tag.startsWith("nightly-v");
+
+// Newest published nightly by publication time, or undefined when none exists.
+async function findLatestNightly({ github, context }) {
   const releases = await github.paginate(github.rest.repos.listReleases, {
     ...context.repo,
     per_page: 100,
   });
-  const lastNightly = releases
-    .filter(
-      (release) =>
-        !release.draft &&
-        release.published_at &&
-        (/^v.*-nightly\./.test(release.tag_name) || release.tag_name.startsWith("nightly-v")),
-    )
+  return releases
+    .filter((release) => !release.draft && release.published_at && isNightlyTag(release.tag_name))
     .sort((a, b) => Date.parse(b.published_at) - Date.parse(a.published_at))[0];
+}
+
+// Runs after the workflow acquires the nightly concurrency lock.
+async function shouldReleaseNightly({ github, context, core, now = Date.now() }) {
+  const lastNightly = await findLatestNightly({ github, context });
 
   if (!lastNightly) {
     core.info("No published nightly found. Proceeding with release.");
@@ -41,4 +43,25 @@ async function shouldReleaseNightly({ github, context, core, now = Date.now() })
   return true;
 }
 
-module.exports = { shouldReleaseNightly };
+// Stable releases build the commit the latest nightly shipped, so the stable
+// build is one nightly users already ran. Returns the nightly tag, its commit,
+// and the stable version that nightly was a preview of.
+async function resolveLatestNightlyCommit({ github, context, core }) {
+  const lastNightly = await findLatestNightly({ github, context });
+  if (!lastNightly) {
+    throw new Error("No published nightly found. Stable releases build the latest nightly commit.");
+  }
+
+  const tag = lastNightly.tag_name;
+  // repos.getCommit dereferences annotated tags, so this is the commit either way.
+  const { data: commit } = await github.rest.repos.getCommit({ ...context.repo, ref: tag });
+  const version = /^(?:nightly-)?v(\d+\.\d+\.\d+)-nightly\./.exec(tag)?.[1];
+  if (!version) {
+    throw new Error(`Cannot derive a stable version from nightly tag ${tag}.`);
+  }
+
+  core.info(`Latest nightly ${tag} shipped ${commit.sha} as a preview of ${version}.`);
+  return { tag, sha: commit.sha, version };
+}
+
+module.exports = { shouldReleaseNightly, resolveLatestNightlyCommit };

.github/scripts/check-nightly-release.test.cjs

@@ -99,3 +99,45 @@ for (const status of ["behind", "diverged"]) {
     assert.equal(await shouldReleaseNightly(options), false);
   });
 }
+
+const { resolveLatestNightlyCommit } = require("./check-nightly-release.cjs");
+
+function nightlyCommitFixture({ releases, commitSha = "abc123" }) {
+  const refs = [];
+  const { options } = fixture({ releases });
+  options.github.rest.repos.getCommit = async ({ ref }) => {
+    refs.push(ref);
+    return { data: { sha: commitSha } };
+  };
+  return { options, refs };
+}
+
+test("stable releases resolve the commit of the newest published nightly", async () => {
+  const { options, refs } = nightlyCommitFixture({
+    releases: [
+      nightly(10, { tag_name: "v1.0.1-nightly.20260905.100" }),
+      nightly(1, { tag_name: "v1.0.1-nightly.20260905.123" }),
+      nightly(0, { tag_name: "v1.0.0" }),
+      nightly(0, { draft: true, tag_name: "v1.0.1-nightly.20260905.999" }),
+    ],
+    commitSha: "deadbeef",
+  });
+  assert.deepEqual(await resolveLatestNightlyCommit(options), {
+    tag: "v1.0.1-nightly.20260905.123",
+    sha: "deadbeef",
+    version: "1.0.1",
+  });
+  assert.deepEqual(refs, ["v1.0.1-nightly.20260905.123"]);
+});
+
+test("stable releases derive the version from legacy nightly tags", async () => {
+  const { options } = nightlyCommitFixture({
+    releases: [nightly(1, { tag_name: "nightly-v0.9.0-nightly.20260905.5" })],
+  });
+  assert.equal((await resolveLatestNightlyCommit(options)).version, "0.9.0");
+});
+
+test("stable releases fail without a published nightly", async () => {
+  const { options } = nightlyCommitFixture({ releases: [nightly(0, { tag_name: "v1.0.0" })] });
+  await assert.rejects(resolveLatestNightlyCommit(options), /No published nightly/);
+});

.github/workflows/ci.yml

@@ -198,11 +198,17 @@ jobs:
         with:
           components: rustfmt
 
-      - name: Check resource monitor formatting
-        run: cargo fmt --manifest-path native/resource-monitor/Cargo.toml -- --check
+      - name: Check Rust formatting
+        run: |
+          for crate in resource-monitor kde-snap-shot hyprland-snap-shot; do
+            cargo fmt --manifest-path "native/$crate/Cargo.toml" -- --check
+          done
 
-      - name: Test resource monitor
-        run: cargo test --locked --manifest-path native/resource-monitor/Cargo.toml
+      - name: Test Rust crates
+        run: |
+          for crate in resource-monitor kde-snap-shot hyprland-snap-shot; do
+            cargo test --locked --manifest-path "native/$crate/Cargo.toml"
+          done
 
   # The static analysis below needs a macOS runner, which bills ~6.7x a Linux
   # minute, so gate it on the native sources it actually lints instead of paying

.github/workflows/deploy-relay.yml

@@ -63,6 +63,7 @@ jobs:
           AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }}
           CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
           APNS_PRIVATE_KEY: ${{ secrets.APNS_PRIVATE_KEY }}
+          FCM_SERVICE_ACCOUNT: ${{ secrets.FCM_SERVICE_ACCOUNT }}
 
       - name: Publish relay deploy commit status
         uses: actions/github-script@v8