chore(upstream): sync marcode through 6c583620

.coderabbit.yaml

@@ -1,4 +1,4 @@
 reviews:
   review_status: false
   auto_review:
-    enabled: false
+    enabled: true

.devcontainer/devcontainer.json

@@ -1,32 +1,73 @@
+// Dev container for Marcode. Mirrors CI (ubuntu-24.04, Node 24, Rust stable)
+// and the canonical setup in docs/operations/development.md: global `vp`, `vp i`.
+// Contributor doc: docs/internals/devcontainer.md
 {
-  "name": "Marcode Dev",
-  "image": "debian:bookworm",
+  "name": "Marcode",
+  "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04",
   "features": {
-    "ghcr.io/devcontainers/features/git:1": {},
-    "ghcr.io/devcontainers-extra/features/bun:1": {
-      "version": "1.3.11"
+    // nodeGypDependencies (default true) brings python3/make/g++, which Linux
+    // needs for node-pty's node-gyp fallback (its prebuilds are mac/win only).
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "24"
     },
-    "ghcr.io/devcontainers/features/node:1": {
-      "version": "24.13.1"
-    },
-    "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.10",
-      "installTools": false
-    }
+    // native/resource-monitor (edition 2024, needs stable >= 1.85). The server
+    // degrades gracefully without the binary, but CI checks cargo fmt + test.
+    "ghcr.io/devcontainers/features/rust:1": {},
+    "ghcr.io/devcontainers/features/github-cli:1": {}
+  },
+  "hostRequirements": {
+    "cpus": 4,
+    "memory": "8gb",
+    "storage": "32gb"
+  },
+  "containerEnv": {
+    // Keep all runtime state inside the (gitignored) workspace .marcode,
+    // matching the worktree default. An explicit --home-dir still wins.
+    "MARCODE_HOME": "${containerWorkspaceFolder}/.marcode"
   },
-  "overrideFeatureInstallOrder": [
-    "ghcr.io/devcontainers/features/git",
-    "ghcr.io/devcontainers-extra/features/bun"
+  "mounts": [
+    // vp keeps the pnpm content-addressable store and metadata cache under
+    // ~/.cache/pnpm (verified: the v11 store dir lives there); mounting a
+    // volume there lets installs survive container rebuilds.
+    "source=marcode-pnpm-store,target=/home/vscode/.cache/pnpm,type=volume",
+    // Root node_modules holds the whole pnpm virtual store (.pnpm), so one
+    // volume keeps the heavy tree off the slow macOS/Windows bind mount.
+    // Scoped by devcontainerId so parallel checkouts do not share it.
+    // Codespaces note: prebuild snapshots exclude volumes; drop these mounts
+    // if prebuilt codespaces become the primary workflow.
+    "source=marcode-node-modules-${devcontainerId},target=${containerWorkspaceFolder}/node_modules,type=volume"
   ],
-  "postCreateCommand": {
-    // corepack reads the pnpm version from package.json `packageManager`, so this
-    // never drifts from the lockfile. bun stays installed above: it is not the
-    // package manager, it is what AGENTS.md uses for `bun:sqlite` test-data seeding.
-    "install": "corepack enable && pnpm install --frozen-lockfile"
+  "onCreateCommand": "bash .devcontainer/on-create.sh",
+  "updateContentCommand": "bash .devcontainer/update-content.sh",
+  "forwardPorts": [5733, 13773],
+  "portsAttributes": {
+    "5733": {
+      "label": "marcode web (open via the pairing URL, not the bare origin)",
+      "onAutoForward": "notify"
+    },
+    "13773": {
+      "label": "marcode server",
+      "onAutoForward": "silent"
+    }
   },
   "customizations": {
+    "codespaces": {
+      "openFiles": ["docs/internals/devcontainer.md"]
+    },
     "vscode": {
-      "extensions": ["oxc.oxc-vscode"]
+      "extensions": ["oxc.oxc-vscode", "rust-lang.rust-analyzer"],
+      "settings": {
+        // .repos is a large vendored read-only reference tree; watching it
+        // burns CPU and file handles.
+        "files.watcherExclude": {
+          "**/.repos/**": true,
+          "**/.marcode/**": true
+        },
+        "search.exclude": {
+          "**/.repos": true
+        }
+      }
     }
-  }
+  },
+  "remoteUser": "vscode"
 }

.devcontainer/on-create.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# One-time container setup, baked into prebuilds. Content-dependent work
+# (dependency install, Chromium) lives in update-content.sh.
+set -euo pipefail
+
+# The Vite+ CLI is the repo task runner (vp i, vp run dev, vp test run).
+# Download to a file first: a curl failure inside $( ) would yield an empty
+# script and a false success. VP_NODE_MANAGER=no skips the installer's node
+# shims; Node comes from the devcontainer feature. The VP_*_DIR group (set
+# together, absolute) pins the install location instead of the installer's
+# XDG platform defaults, which moved the binary from ~/.vite-plus/bin to
+# ~/.local/share/vite-plus/bin between releases and would break the check
+# below either way.
+export VP_BIN_DIR="$HOME/.local/share/vite-plus/bin"
+export VP_DATA_DIR="$HOME/.local/share/vite-plus"
+export VP_CACHE_DIR="$HOME/.cache/vite-plus"
+installer=$(mktemp)
+curl -fsSL https://vite.plus -o "$installer"
+VP_NODE_MANAGER=no bash "$installer"
+rm -f "$installer"
+
+# Non-login lifecycle shells never source the profile the installer edits,
+# so expose vp on the default PATH. test -x keeps a bad install loud.
+test -x "$VP_BIN_DIR/vp"
+sudo ln -sf "$VP_BIN_DIR/vp" /usr/local/bin/vp
+
+# First-run terminal notice, rendered by the devcontainers base image.
+sudo mkdir -p /usr/local/etc/vscode-dev-containers
+sudo tee /usr/local/etc/vscode-dev-containers/first-run-notice.txt >/dev/null <<'EOF'
+Marcode devcontainer
+
+  vp run dev            start server + web, then open the pairing URL it
+                        prints (the bare forwarded port will not authenticate)
+  cp .env.example .env  optional: enable Marcode Connect cloud features
+                        (public identifiers, not secrets)
+
+Details: docs/internals/devcontainer.md
+EOF

.devcontainer/update-content.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Runs at creation and on every prebuild content refresh, so codespaces start
+# with deps installed and caches warm. Everything here is idempotent.
+set -euo pipefail
+
+# Volume mounts (pnpm store, node_modules) and the directories docker creates
+# for them arrive root-owned; hand them to the dev user before installing.
+for dir in "$HOME/.cache" "$HOME/.cache/pnpm" node_modules; do
+  if [ -d "$dir" ] && [ "$(stat -c %U "$dir")" != "$(id -un)" ]; then
+    sudo chown "$(id -un):$(id -gn)" "$dir"
+  fi
+done
+
+CI=true vp i
+# Repairs electron's path.txt and exec bits after install, same as CI.
+vp run --filter @t3tools/desktop ensure:electron
+# Pre-warms Vite's dep optimizer (cache is keyed on the absolute path, which
+# is stable inside the container).
+node apps/web/scripts/warm-dep-cache.ts

.github/workflows/ci.yml

@@ -214,11 +214,17 @@ jobs:
         with:
           components: rustfmt
 
-      - name: Check resource monitor formatting
-        run: cargo fmt --manifest-path native/resource-monitor/Cargo.toml -- --check
+      - name: Check Rust formatting
+        run: |
+          for crate in resource-monitor kde-snap-shot hyprland-snap-shot; do
+            cargo fmt --manifest-path "native/$crate/Cargo.toml" -- --check
+          done
 
-      - name: Test resource monitor
-        run: cargo test --locked --manifest-path native/resource-monitor/Cargo.toml
+      - name: Test Rust crates
+        run: |
+          for crate in resource-monitor kde-snap-shot hyprland-snap-shot; do
+            cargo test --locked --manifest-path "native/$crate/Cargo.toml"
+          done
 
   # The static analysis below needs a macOS runner, which bills ~6.7x a Linux
   # minute, so gate it on the native sources it actually lints instead of paying

.github/workflows/deploy-relay.yml

@@ -64,6 +64,7 @@ jobs:
           AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }}
           CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
           APNS_PRIVATE_KEY: ${{ secrets.APNS_PRIVATE_KEY }}
+          FCM_SERVICE_ACCOUNT: ${{ secrets.FCM_SERVICE_ACCOUNT }}
 
       - name: Publish relay deploy commit status
         uses: actions/github-script@v8

.github/workflows/release.yml

@@ -487,8 +487,18 @@ jobs:
           path: native/resource-monitor/target/${{ matrix.rust_target }}/release/t3-resource-monitor${{ matrix.platform == 'win' && '.exe' || '' }}
           key: resource-monitor-${{ matrix.rust_target }}-${{ hashFiles('native/resource-monitor/Cargo.lock', 'native/resource-monitor/Cargo.toml', 'native/resource-monitor/src/**') }}
 
+      - name: Cache Linux capture helpers
+        if: matrix.platform == 'linux'
+        id: capture_helper_cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            native/kde-snap-shot/target/${{ matrix.rust_target }}/release/t3-kde-snap-shot
+            native/hyprland-snap-shot/target/${{ matrix.rust_target }}/release/t3-hyprland-snap-shot
+          key: linux-capture-helpers-${{ matrix.rust_target }}-${{ hashFiles('native/kde-snap-shot/Cargo.lock', 'native/kde-snap-shot/Cargo.toml', 'native/kde-snap-shot/src/**', 'native/hyprland-snap-shot/Cargo.lock', 'native/hyprland-snap-shot/Cargo.toml', 'native/hyprland-snap-shot/src/**', 'native/hyprland-snap-shot/protocols/**') }}
+
       - name: Setup Rust
-        if: steps.resource_monitor_cache.outputs.cache-hit != 'true'
+        if: steps.resource_monitor_cache.outputs.cache-hit != 'true' || (matrix.platform == 'linux' && steps.capture_helper_cache.outputs.cache-hit != 'true')
         uses: dtolnay/rust-toolchain@stable
         with:
           targets: ${{ matrix.rust_target }}
@@ -620,6 +630,7 @@ jobs:
         env:
           pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
           T3CODE_DESKTOP_REUSE_RESOURCE_MONITOR: ${{ steps.resource_monitor_cache.outputs.cache-hit == 'true' }}
+          T3CODE_DESKTOP_REUSE_LINUX_CAPTURE_HELPERS: ${{ steps.capture_helper_cache.outputs.cache-hit == 'true' }}
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
           APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}

.macroscope/check-run-agents/effect-service-conventions.md

@@ -14,6 +14,7 @@ exclude:
   - "**/*.test.ts"
 labels:
   - vouch:trusted
+  - macroscope-review
 requires:
   - Check
 maxBudgetPerRun: 5
@@ -51,7 +52,7 @@ Review changed TypeScript for the conventions below. They apply when a pull requ
 
 ## Errors
 
-- Define service failures with `Schema.TaggedErrorClass` and structured attributes: operation or stage, resource path or entity identifier, normalized category or status. Derive `message` from those attributes only. Never derive it from `cause`, `cause.message`, or a stringified defect, and do not add a `detail` field that copies `cause.message`.
+- Define service failures with `Schema.TaggedError` and structured attributes: operation or stage, resource path or entity identifier, normalized category or status. Derive `message` from those attributes only. Never derive it from `cause`, `cause.message`, or a stringified defect, and do not add a `detail` field that copies `cause.message`.
 - When wrapping a real failure, keep the immediate underlying error as `cause` so the chain and stack survive. Make `cause` required if every construction wraps a failure. Pure validation or domain errors created without an underlying failure need no cause.
 - Keep attributes and log annotations safe and bounded: no raw wire payloads, command arguments or output, signed URLs, credentials, query strings, or arbitrary defect text. Preserve the exact value only as `cause`; expose normalized categories, lengths, counts, and safe URL protocol or hostname where useful.
 - At a translation boundary, pass through an already structured domain error when it is part of the target error channel; wrap only unknown or lower-level failures. Map failures where the context is known instead of wrapping a whole multi-step pipeline in one generic error.

.macroscope/check-run-agents/ui-consistency.md

@@ -13,6 +13,7 @@ exclude:
   - "apps/web/src/**/*.test.tsx"
 labels:
   - vouch:trusted
+  - macroscope-review
 requires:
   - Check
 maxBudgetPerRun: 2

.repos/alchemy-effect/.gitattributes

@@ -0,0 +1,4 @@
+* text=auto eol=lf
+
+.vendor/** linguist-vendored
+distilled/** linguist-vendored

.repos/alchemy-effect/.github/workflows/check.yml

@@ -1,41 +1,101 @@
-name: check
+name: Check
 
-# Runs the website docs validator (`bun run docs:check`) on every PR
-# so broken links / missing API references fail fast before merge.
+# Validates the repository type graph and website docs.
 
 on:
+  push:
+    branches: [main]
+    paths:
+      - "distilled"
+      - "benchmark/**"
+      - "examples/**"
+      - "packages/**"
+      - "website/**"
+      - "scripts/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/check.yml"
   pull_request:
     types: [opened, reopened, synchronize]
+    paths:
+      - "distilled"
+      - "benchmark/**"
+      - "examples/**"
+      - "packages/**"
+      - "website/**"
+      - "scripts/**"
+      - "patches/**"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "turbo.json"
+      - "tsconfig.json"
+      - ".github/workflows/check.yml"
+  workflow_dispatch:
 
 permissions:
   contents: read
 
-env:
-  NODE_VERSION: "24"
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   check:
-    runs-on: ubuntu-22-large
+    name: Check
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # `bun install` needs the distilled submodule (workspace member)
-          submodules: true
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Checkout distilled
+        run: git submodule update --init --depth=1 --checkout -- distilled
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Restore Astro build cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          node-version: ${{ env.NODE_VERSION }}
+          path: website/node_modules/.astro
+          key: website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-${{ github.sha }}-
+            website-astro-${{ runner.os }}-${{ github.event.pull_request.number || 'main' }}-
+            website-astro-${{ runner.os }}-main-
 
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      - name: Restore Turbo cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
-          bun-version: latest
+          path: .turbo
+          key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
+          restore-keys: |
+            turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
+            turbo-${{ runner.os }}-${{ github.repository_id }}-
 
-      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      - name: Setup pnpm, Node.js, Bun and install dependencies
+        uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
         with:
-          path: ~/.bun/install/cache
-          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
-          restore-keys: bun-${{ runner.os }}-
+          cache: true
+          install: true
+          require-lockfile: true
+
+      - name: Run Node Utils tests
+        run: pnpm -C packages/node-utils test
+
+      - name: Run Typecheck
+        run: pnpm tsc -b
+
+      - name: Check API JSDocs
+        run: pnpm docs:check-jsdoc
 
-      - run: bun install
-      - run: bun tsc -b
-      - run: bun run docs:check
+      # An internal PR carrying `deploy-website` gets a full Astro build in
+      # website.yml via StaticSite. That build runs the same output validators,
+      # so avoid building the site a second time here. Forks still run this
+      # check because they cannot access the preview deployment secrets.
+      - name: Check website docs
+        if: >-
+          github.event.pull_request.head.repo.full_name != github.repository ||
+          !contains(github.event.pull_request.labels.*.name, 'deploy-website')
+        run: pnpm docs:check