chore(upstream): sync marcode through 223ff449

.agents/skills/test-t3-mobile/SKILL.md

@@ -80,7 +80,6 @@ Run Metro from `apps/mobile`.
    APP_VARIANT=development vp exec expo start \
      --dev-client \
      --scheme t3code-dev \
-     --clear \
      --lan \
      --port <metro-port>
    ```
@@ -179,6 +178,7 @@ Keep local verification focused. Do not turn this workflow into a full repositor
 ## Troubleshoot predictable failures
 
 - **Old UI or an old error appears:** verify Metro's worktree, variant, URL, and port before diagnosing the app.
+- **Metro serves stale or invalid transforms after those checks:** stop the owned Metro process and run `vp run dev:client:reset` once on the standard port. For a custom port, add `--clear` to the complete explicit `expo start` command above.
 - **The environment remains empty:** verify the platform-specific HTTP origin, use a fresh token, and confirm project seeding used the identical base directory.
 - **A second client cannot pair:** pairing tokens are single-use; issue another token.
 - **The pairing form opens but does not connect:** confirm the deep link uses the existing `connections/new` route, includes `autoConnect=1`, and carries a freshly minted encoded `pairingUrl`.

.coderabbit.yaml

@@ -0,0 +1,4 @@
+reviews:
+  review_status: false
+  auto_review:
+    enabled: false

.gitattributes

@@ -1,2 +1,5 @@
 # git autocrlf=true converts LF to CRLF on Windows, causing issues with oxfmt
 * text=auto eol=lf
+# Batch files need CRLF for cmd.exe to parse them reliably.
+*.cmd text eol=crlf
+*.bat text eol=crlf

.github/VOUCHED.td

@@ -9,35 +9,51 @@
 #   -github:username reason for denouncement
 #
 # Keep entries sorted alphabetically.
+github:0x4bs3nt
+github:Adamulek123
 github:adityavardhansharma
+github:aoright
 github:arhxam
 github:bil0000
 github:binbandit
 github:Brechard
+github:btsouth
 github:chrisdeeming
 github:chuks-qua
 github:cursoragent
 github:D3OXY
+github:dbalders
 github:eggfriedrice24
 github:extoci
+github:flamboh
+github:FllipEis
 github:gbarros-dev
 github:gfsaaser24
 github:github-actions[bot]
 github:gsimone
 github:GuilhermeVieiraDev
 github:hwanseoc
+github:inayayousfi
+github:ipanasenko
 github:jakeleventhal
 github:jamesx0416
 github:jappyjan
 github:jasonLaster
 github:JoeEverest
 github:justsomelegs
 github:kridaydave
+github:lgwacker
 github:lnieuwenhuis
 github:Lucenx9
 github:mackinleysmith
 github:maria-rcks
+github:MatthewFeroz
+github:maxwellyoung
 github:mwolson
+github:myacoub91
+github:naMqe-h
+github:nateEc
+github:naveed949
 github:nmggithub
 github:Noojuno
 github:notkainoa
@@ -48,6 +64,7 @@ github:PollyGlot
 github:RakshithBhat03
 github:realAhmedRoach
 github:Rishet11
+github:ryanrhughes
 github:saphid
 github:sethwebster
 github:shiroyasha9
@@ -56,7 +73,9 @@ github:StiensWout
 github:SunkenInTime
 github:tarik02
 github:tris203
+github:tsouth89
 github:UtkarshUsername
+github:vitalyiegorov
 github:Yash-Singh1
 github:yashranaway
 github:Ymit24

.github/actions/setup-apt-mirrors/action.yml

@@ -0,0 +1,22 @@
+name: Setup APT mirrors
+description: Configure Ubuntu package downloads with automatic mirror failover.
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        # Replace the existing Blacksmith mirror list as well as direct sources.
+        printf '%s\tpriority:%s\n' \
+          https://archive.ubuntu.com/ubuntu 1 \
+          https://mirrors.edge.kernel.org/ubuntu 2 \
+          https://mirror.math.princeton.edu/pub/ubuntu 3 \
+          | sudo tee /etc/apt/blacksmith-ubuntu-mirrors.txt > /dev/null
+
+        # APT's mirror transport retries each file against the next server.
+        sudo find /etc/apt -maxdepth 2 -type f \( -name '*.list' -o -name '*.sources' \) \
+          -exec sed -i -E \
+          's#https?://(([^/]+\.)?archive|security)\.ubuntu\.com/ubuntu/?#mirror+file:/etc/apt/blacksmith-ubuntu-mirrors.txt#g' {} +
+
+        # Move on to a fallback before an unreachable server exhausts the job.
+        printf '%s\n' 'Acquire::http::Timeout "15";' 'Acquire::https::Timeout "15";' \
+          | sudo tee /etc/apt/apt.conf.d/80-mirror-timeouts > /dev/null

.github/scripts/check-nightly-release.cjs

@@ -0,0 +1,44 @@
+const MINIMUM_RELEASE_GAP_MS = 6 * 60 * 60 * 1000;
+
+// Runs after the workflow acquires the nightly concurrency lock.
+async function shouldReleaseNightly({ github, context, core, now = Date.now() }) {
+  const releases = await github.paginate(github.rest.repos.listReleases, {
+    ...context.repo,
+    per_page: 100,
+  });
+  const lastNightly = releases
+    .filter(
+      (release) =>
+        !release.draft &&
+        release.published_at &&
+        (/^v.*-nightly\./.test(release.tag_name) || release.tag_name.startsWith("nightly-v")),
+    )
+    .sort((a, b) => Date.parse(b.published_at) - Date.parse(a.published_at))[0];
+
+  if (!lastNightly) {
+    core.info("No published nightly found. Proceeding with release.");
+    return true;
+  }
+
+  if (now - Date.parse(lastNightly.published_at) < MINIMUM_RELEASE_GAP_MS) {
+    core.info(`Nightly ${lastNightly.tag_name} was published less than six hours ago. Skipping.`);
+    return false;
+  }
+
+  const { data: comparison } = await github.rest.repos.compareCommitsWithBasehead({
+    ...context.repo,
+    basehead: `${lastNightly.tag_name}...${context.sha}`,
+    per_page: 1,
+  });
+  if (comparison.status !== "ahead") {
+    core.info(
+      `Candidate commit is ${comparison.status} relative to ${lastNightly.tag_name}. Skipping.`,
+    );
+    return false;
+  }
+
+  core.info(`New commits since ${lastNightly.tag_name}, and the six-hour gap has passed.`);
+  return true;
+}
+
+module.exports = { shouldReleaseNightly };

.github/scripts/check-nightly-release.test.cjs

@@ -0,0 +1,101 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const { shouldReleaseNightly } = require("./check-nightly-release.cjs");
+
+const now = Date.parse("2026-09-05T12:00:00Z");
+const hour = 60 * 60 * 1000;
+const nightly = (hoursAgo, overrides = {}) => ({
+  tag_name: "v1.0.1-nightly.20260905.123",
+  draft: false,
+  published_at: new Date(now - hoursAgo * hour).toISOString(),
+  ...overrides,
+});
+
+function fixture({ releases = [nightly(7)], comparisonStatus = "ahead" } = {}) {
+  const calls = [];
+  return {
+    calls,
+    options: {
+      now,
+      context: { repo: { owner: "example", repo: "app" }, sha: "new" },
+      core: { info() {} },
+      github: {
+        rest: {
+          repos: {
+            listReleases() {},
+            async compareCommitsWithBasehead(params) {
+              calls.push(params);
+              return { data: { status: comparisonStatus } };
+            },
+          },
+        },
+        async paginate() {
+          return releases;
+        },
+      },
+    },
+  };
+}
+
+test("releases the first nightly when no nightly is published", async () => {
+  const { options } = fixture({
+    releases: [nightly(0, { tag_name: "v1.0.0" }), nightly(0, { draft: true })],
+  });
+  assert.equal(await shouldReleaseNightly(options), true);
+});
+
+test("waits six hours after publication, including manual nightlies", async () => {
+  for (const age of [0, 3, 6 - 1 / 3600]) {
+    const { options, calls } = fixture({ releases: [nightly(age)] });
+    assert.equal(await shouldReleaseNightly(options), false);
+    assert.equal(calls.length, 0);
+  }
+});
+
+test("releases new commits at six hours and after an idle period", async () => {
+  for (const age of [6, 7, 24]) {
+    const { options } = fixture({ releases: [nightly(age)] });
+    assert.equal(await shouldReleaseNightly(options), true);
+  }
+});
+
+test("skips unchanged commits after the gap", async () => {
+  const { options } = fixture({ comparisonStatus: "identical" });
+  assert.equal(await shouldReleaseNightly(options), false);
+});
+
+test("uses publication time, not release order or the tagged commit date", async () => {
+  const { options } = fixture({
+    releases: [nightly(10), nightly(1), nightly(20, { tag_name: "nightly-v0.9.0" })],
+  });
+  assert.equal(await shouldReleaseNightly(options), false);
+});
+
+test("ignores stable releases and drafts when checking the gap", async () => {
+  const { options } = fixture({
+    releases: [nightly(0, { tag_name: "v1.0.0" }), nightly(0, { draft: true }), nightly(7)],
+  });
+  assert.equal(await shouldReleaseNightly(options), true);
+});
+
+test("compares against the published tag, including legacy nightly tags", async () => {
+  const tag = "nightly-v0.9.0";
+  const { options, calls } = fixture({ releases: [nightly(7, { tag_name: tag })] });
+  assert.equal(await shouldReleaseNightly(options), true);
+  assert.equal(calls[0].basehead, `${tag}...new`);
+});
+
+test("fails instead of releasing when GitHub cannot supply release state", async () => {
+  const { options } = fixture();
+  options.github.paginate = async () => {
+    throw new Error("GitHub unavailable");
+  };
+  await assert.rejects(shouldReleaseNightly(options), /GitHub unavailable/);
+});
+
+for (const status of ["behind", "diverged"]) {
+  test(`skips a candidate commit that is ${status} relative to the last nightly`, async () => {
+    const { options } = fixture({ comparisonStatus: status });
+    assert.equal(await shouldReleaseNightly(options), false);
+  });
+}

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -42,20 +45,28 @@ jobs:
       - name: Ensure Electron runtime is installed
         run: vp run --filter @t3tools/desktop ensure:electron
 
+      # Files/dependencies are repo-wide; export checks cover clean workspaces only.
+      - name: Check unused code
+        run: vp run knip:check
+
       - name: Check
         run: vp check
 
       - name: Typecheck
         run: vpr typecheck
 
+      - uses: ./.github/actions/setup-apt-mirrors
+
+      - name: Install browser secret helper build libraries
+        run: |
+          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
+          sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+
       - name: Build desktop pipeline
         run: vp run build:desktop
 
       - name: Verify preload bundle output
-        run: |
-          test -f apps/desktop/dist-electron/preload.cjs
-          grep -nE "desktopBridge|getLocalEnvironmentBootstrap|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.cjs
-          grep -n "__clerk_internal_electron_passkeys" apps/desktop/dist-electron/preload.cjs
+        run: node apps/desktop/scripts/verify-preload-bundle.mjs
 
   # Everything except `t3` (apps/server). `--parallel` drops the package
   # dependency ordering that `vp run` applies by default: these `test` tasks
@@ -85,9 +96,23 @@ jobs:
       - name: Ensure Electron runtime is installed
         run: vp run --filter @t3tools/desktop ensure:electron
 
+      - uses: ./.github/actions/setup-apt-mirrors
+
+      - name: Install browser secret helper build libraries
+        run: |
+          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
+          sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+
+      # Kept as its own step, named for the pin in
+      # scripts/upstream-sync-workflow.test.ts: every job that runs tests needs
+      # ripgrep, and folding it into an upstream step makes the pin silently
+      # stop matching the next time upstream renames that step.
       - name: Install workspace search dependency
         run: sudo apt-get update && sudo apt-get install --yes ripgrep
 
+      - name: Test nightly release checks
+        run: node --test .github/scripts/check-nightly-release.test.cjs
+
       - name: Test
         run: vp run --parallel --concurrency-limit 4 --filter '!t3' --filter '!@t3tools/monorepo' test
 

.github/workflows/cursor-hygiene-webhook.yml

@@ -0,0 +1,36 @@
+name: Forward to Cursor hygiene
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, reopened, ready_for_review]
+  issues:
+    types: [opened, closed, reopened]
+  discussion:
+    types: [created, closed, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  forward:
+    name: POST to Cursor
+    runs-on: ubuntu-24.04
+    steps:
+      - name: POST to Cursor
+        env:
+          URL: ${{ secrets.CURSOR_T3CODE_WEBHOOK_URL }}
+          AUTH: ${{ secrets.CURSOR_T3CODE_WEBHOOK_AUTH }}
+        run: |
+          set -euo pipefail
+          if [ -z "${URL:-}" ] || [ -z "${AUTH:-}" ]; then
+            echo "Missing CURSOR_T3CODE_WEBHOOK_URL or CURSOR_T3CODE_WEBHOOK_AUTH — skipping."
+            exit 0
+          fi
+          curl -fsS --max-time 60 -X POST "$URL" \
+            -H "Authorization: $AUTH" \
+            -H "Content-Type: application/json" \
+            -H "X-GitHub-Event: ${{ github.event_name }}" \
+            -H "X-GitHub-Delivery: ${{ github.run_id }}-${{ github.run_attempt }}" \
+            --data-binary @"${{ github.event_path }}"