chore(upstream): sync marcode through 761d4bac

.agents/skills/test-t3-mobile/SKILL.md

@@ -80,7 +80,6 @@ Run Metro from `apps/mobile`.
    APP_VARIANT=development vp exec expo start \
      --dev-client \
      --scheme t3code-dev \
-     --clear \
      --lan \
      --port <metro-port>
    ```
@@ -179,6 +178,7 @@ Keep local verification focused. Do not turn this workflow into a full repositor
 ## Troubleshoot predictable failures
 
 - **Old UI or an old error appears:** verify Metro's worktree, variant, URL, and port before diagnosing the app.
+- **Metro serves stale or invalid transforms after those checks:** stop the owned Metro process and run `vp run dev:client:reset` once on the standard port. For a custom port, add `--clear` to the complete explicit `expo start` command above.
 - **The environment remains empty:** verify the platform-specific HTTP origin, use a fresh token, and confirm project seeding used the identical base directory.
 - **A second client cannot pair:** pairing tokens are single-use; issue another token.
 - **The pairing form opens but does not connect:** confirm the deep link uses the existing `connections/new` route, includes `autoConnect=1`, and carries a freshly minted encoded `pairingUrl`.

.coderabbit.yaml

@@ -0,0 +1,4 @@
+reviews:
+  review_status: false
+  auto_review:
+    enabled: false

.gitattributes

@@ -1,2 +1,5 @@
 # git autocrlf=true converts LF to CRLF on Windows, causing issues with oxfmt
 * text=auto eol=lf
+# Batch files need CRLF for cmd.exe to parse them reliably.
+*.cmd text eol=crlf
+*.bat text eol=crlf

.github/VOUCHED.td

@@ -9,35 +9,51 @@
 #   -github:username reason for denouncement
 #
 # Keep entries sorted alphabetically.
+github:0x4bs3nt
+github:Adamulek123
 github:adityavardhansharma
+github:aoright
 github:arhxam
 github:bil0000
 github:binbandit
 github:Brechard
+github:btsouth
 github:chrisdeeming
 github:chuks-qua
 github:cursoragent
 github:D3OXY
+github:dbalders
 github:eggfriedrice24
 github:extoci
+github:flamboh
+github:FllipEis
 github:gbarros-dev
 github:gfsaaser24
 github:github-actions[bot]
 github:gsimone
 github:GuilhermeVieiraDev
 github:hwanseoc
+github:inayayousfi
+github:ipanasenko
 github:jakeleventhal
 github:jamesx0416
 github:jappyjan
 github:jasonLaster
 github:JoeEverest
 github:justsomelegs
 github:kridaydave
+github:lgwacker
 github:lnieuwenhuis
 github:Lucenx9
 github:mackinleysmith
 github:maria-rcks
+github:MatthewFeroz
+github:maxwellyoung
 github:mwolson
+github:myacoub91
+github:naMqe-h
+github:nateEc
+github:naveed949
 github:nmggithub
 github:Noojuno
 github:notkainoa
@@ -48,6 +64,7 @@ github:PollyGlot
 github:RakshithBhat03
 github:realAhmedRoach
 github:Rishet11
+github:ryanrhughes
 github:saphid
 github:sethwebster
 github:shiroyasha9
@@ -56,7 +73,9 @@ github:StiensWout
 github:SunkenInTime
 github:tarik02
 github:tris203
+github:tsouth89
 github:UtkarshUsername
+github:vitalyiegorov
 github:Yash-Singh1
 github:yashranaway
 github:Ymit24

.github/actions/setup-apt-mirrors/action.yml

@@ -0,0 +1,22 @@
+name: Setup APT mirrors
+description: Configure Ubuntu package downloads with automatic mirror failover.
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        # Replace the existing Blacksmith mirror list as well as direct sources.
+        printf '%s\tpriority:%s\n' \
+          https://archive.ubuntu.com/ubuntu 1 \
+          https://mirrors.edge.kernel.org/ubuntu 2 \
+          https://mirror.math.princeton.edu/pub/ubuntu 3 \
+          | sudo tee /etc/apt/blacksmith-ubuntu-mirrors.txt > /dev/null
+
+        # APT's mirror transport retries each file against the next server.
+        sudo find /etc/apt -maxdepth 2 -type f \( -name '*.list' -o -name '*.sources' \) \
+          -exec sed -i -E \
+          's#https?://(([^/]+\.)?archive|security)\.ubuntu\.com/ubuntu/?#mirror+file:/etc/apt/blacksmith-ubuntu-mirrors.txt#g' {} +
+
+        # Move on to a fallback before an unreachable server exhausts the job.
+        printf '%s\n' 'Acquire::http::Timeout "15";' 'Acquire::https::Timeout "15";' \
+          | sudo tee /etc/apt/apt.conf.d/80-mirror-timeouts > /dev/null

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -42,20 +45,28 @@ jobs:
       - name: Ensure Electron runtime is installed
         run: vp run --filter @t3tools/desktop ensure:electron
 
+      # Files/dependencies are repo-wide; export checks cover clean workspaces only.
+      - name: Check unused code
+        run: vp run knip:check
+
       - name: Check
         run: vp check
 
       - name: Typecheck
         run: vpr typecheck
 
+      - uses: ./.github/actions/setup-apt-mirrors
+
+      - name: Install browser secret helper build libraries
+        run: |
+          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
+          sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+
       - name: Build desktop pipeline
         run: vp run build:desktop
 
       - name: Verify preload bundle output
-        run: |
-          test -f apps/desktop/dist-electron/preload.cjs
-          grep -nE "desktopBridge|getLocalEnvironmentBootstrap|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.cjs
-          grep -n "__clerk_internal_electron_passkeys" apps/desktop/dist-electron/preload.cjs
+        run: node apps/desktop/scripts/verify-preload-bundle.mjs
 
   # Everything except `t3` (apps/server). `--parallel` drops the package
   # dependency ordering that `vp run` applies by default: these `test` tasks
@@ -85,6 +96,17 @@ jobs:
       - name: Ensure Electron runtime is installed
         run: vp run --filter @t3tools/desktop ensure:electron
 
+      - uses: ./.github/actions/setup-apt-mirrors
+
+      - name: Install browser secret helper build libraries
+        run: |
+          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
+          sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+
+      # Kept as its own step, named for the pin in
+      # scripts/upstream-sync-workflow.test.ts: every job that runs tests needs
+      # ripgrep, and folding it into an upstream step makes the pin silently
+      # stop matching the next time upstream renames that step.
       - name: Install workspace search dependency
         run: sudo apt-get update && sudo apt-get install --yes ripgrep
 

.github/workflows/cursor-hygiene-webhook.yml

@@ -0,0 +1,36 @@
+name: Forward to Cursor hygiene
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, reopened, ready_for_review]
+  issues:
+    types: [opened, closed, reopened]
+  discussion:
+    types: [created, closed, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  forward:
+    name: POST to Cursor
+    runs-on: ubuntu-24.04
+    steps:
+      - name: POST to Cursor
+        env:
+          URL: ${{ secrets.CURSOR_T3CODE_WEBHOOK_URL }}
+          AUTH: ${{ secrets.CURSOR_T3CODE_WEBHOOK_AUTH }}
+        run: |
+          set -euo pipefail
+          if [ -z "${URL:-}" ] || [ -z "${AUTH:-}" ]; then
+            echo "Missing CURSOR_T3CODE_WEBHOOK_URL or CURSOR_T3CODE_WEBHOOK_AUTH — skipping."
+            exit 0
+          fi
+          curl -fsS --max-time 60 -X POST "$URL" \
+            -H "Authorization: $AUTH" \
+            -H "Content-Type: application/json" \
+            -H "X-GitHub-Event: ${{ github.event_name }}" \
+            -H "X-GitHub-Delivery: ${{ github.run_id }}-${{ github.run_attempt }}" \
+            --data-binary @"${{ github.event_path }}"