chore(coil): merge upstream/main d1d15c67f4 (867 commits)

.coderabbit.yaml

@@ -1,4 +1,4 @@
 reviews:
   review_status: false
   auto_review:
-    enabled: false
+    enabled: true

.devcontainer/devcontainer.json

@@ -1,29 +1,73 @@
+// Dev container for T3 Code. Mirrors CI (ubuntu-24.04, Node 24, Rust stable)
+// and the canonical setup in docs/operations/development.md: global `vp`, `vp i`.
+// Contributor doc: docs/internals/devcontainer.md
 {
-  "name": "T3 Code Dev",
-  "image": "debian:bookworm",
+  "name": "T3 Code",
+  "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04",
   "features": {
-    "ghcr.io/devcontainers/features/git:1": {},
-    "ghcr.io/devcontainers-extra/features/bun:1": {
-      "version": "1.3.11"
+    // nodeGypDependencies (default true) brings python3/make/g++, which Linux
+    // needs for node-pty's node-gyp fallback (its prebuilds are mac/win only).
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "24"
     },
-    "ghcr.io/devcontainers/features/node:1": {
-      "version": "24.13.1"
-    },
-    "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.10",
-      "installTools": false
-    }
+    // native/resource-monitor (edition 2024, needs stable >= 1.85). The server
+    // degrades gracefully without the binary, but CI checks cargo fmt + test.
+    "ghcr.io/devcontainers/features/rust:1": {},
+    "ghcr.io/devcontainers/features/github-cli:1": {}
+  },
+  "hostRequirements": {
+    "cpus": 4,
+    "memory": "8gb",
+    "storage": "32gb"
+  },
+  "containerEnv": {
+    // Keep all runtime state inside the (gitignored) workspace .t3, matching
+    // the worktree default. An explicit --home-dir still wins.
+    "T3CODE_HOME": "${containerWorkspaceFolder}/.t3"
   },
-  "overrideFeatureInstallOrder": [
-    "ghcr.io/devcontainers/features/git",
-    "ghcr.io/devcontainers-extra/features/bun"
+  "mounts": [
+    // vp keeps the pnpm content-addressable store and metadata cache under
+    // ~/.cache/pnpm (verified: the v11 store dir lives there); mounting a
+    // volume there lets installs survive container rebuilds.
+    "source=t3code-pnpm-store,target=/home/vscode/.cache/pnpm,type=volume",
+    // Root node_modules holds the whole pnpm virtual store (.pnpm), so one
+    // volume keeps the heavy tree off the slow macOS/Windows bind mount.
+    // Scoped by devcontainerId so parallel checkouts do not share it.
+    // Codespaces note: prebuild snapshots exclude volumes; drop these mounts
+    // if prebuilt codespaces become the primary workflow.
+    "source=t3code-node-modules-${devcontainerId},target=${containerWorkspaceFolder}/node_modules,type=volume"
   ],
-  "postCreateCommand": {
-    "bun-install": "bun install --backend=copyfile --frozen-lockfile"
+  "onCreateCommand": "bash .devcontainer/on-create.sh",
+  "updateContentCommand": "bash .devcontainer/update-content.sh",
+  "forwardPorts": [5733, 13773],
+  "portsAttributes": {
+    "5733": {
+      "label": "t3 web (open via the pairing URL, not the bare origin)",
+      "onAutoForward": "notify"
+    },
+    "13773": {
+      "label": "t3 server",
+      "onAutoForward": "silent"
+    }
   },
   "customizations": {
+    "codespaces": {
+      "openFiles": ["docs/internals/devcontainer.md"]
+    },
     "vscode": {
-      "extensions": ["oxc.oxc-vscode"]
+      "extensions": ["oxc.oxc-vscode", "rust-lang.rust-analyzer"],
+      "settings": {
+        // .repos is a large vendored read-only reference tree; watching it
+        // burns CPU and file handles.
+        "files.watcherExclude": {
+          "**/.repos/**": true,
+          "**/.t3/**": true
+        },
+        "search.exclude": {
+          "**/.repos": true
+        }
+      }
     }
-  }
+  },
+  "remoteUser": "vscode"
 }

.devcontainer/on-create.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# One-time container setup, baked into prebuilds. Content-dependent work
+# (dependency install, Chromium) lives in update-content.sh.
+set -euo pipefail
+
+# The Vite+ CLI is the repo task runner (vp i, vp run dev, vp test run).
+# Download to a file first: a curl failure inside $( ) would yield an empty
+# script and a false success. VP_NODE_MANAGER=no skips the installer's node
+# shims; Node comes from the devcontainer feature. The VP_*_DIR group (set
+# together, absolute) pins the install location instead of the installer's
+# XDG platform defaults, which moved the binary from ~/.vite-plus/bin to
+# ~/.local/share/vite-plus/bin between releases and would break the check
+# below either way.
+export VP_BIN_DIR="$HOME/.local/share/vite-plus/bin"
+export VP_DATA_DIR="$HOME/.local/share/vite-plus"
+export VP_CACHE_DIR="$HOME/.cache/vite-plus"
+installer=$(mktemp)
+curl -fsSL https://vite.plus -o "$installer"
+VP_NODE_MANAGER=no bash "$installer"
+rm -f "$installer"
+
+# Non-login lifecycle shells never source the profile the installer edits,
+# so expose vp on the default PATH. test -x keeps a bad install loud.
+test -x "$VP_BIN_DIR/vp"
+sudo ln -sf "$VP_BIN_DIR/vp" /usr/local/bin/vp
+
+# First-run terminal notice, rendered by the devcontainers base image.
+sudo mkdir -p /usr/local/etc/vscode-dev-containers
+sudo tee /usr/local/etc/vscode-dev-containers/first-run-notice.txt >/dev/null <<'EOF'
+T3 Code devcontainer
+
+  vp run dev            start server + web, then open the pairing URL it
+                        prints (the bare forwarded port will not authenticate)
+  cp .env.example .env  optional: enable T3 Connect cloud features
+                        (public identifiers, not secrets)
+
+Details: docs/internals/devcontainer.md
+EOF

.devcontainer/update-content.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Runs at creation and on every prebuild content refresh, so codespaces start
+# with deps installed and caches warm. Everything here is idempotent.
+set -euo pipefail
+
+# Volume mounts (pnpm store, node_modules) and the directories docker creates
+# for them arrive root-owned; hand them to the dev user before installing.
+for dir in "$HOME/.cache" "$HOME/.cache/pnpm" node_modules; do
+  if [ -d "$dir" ] && [ "$(stat -c %U "$dir")" != "$(id -un)" ]; then
+    sudo chown "$(id -un):$(id -gn)" "$dir"
+  fi
+done
+
+CI=true vp i
+# Repairs electron's path.txt and exec bits after install, same as CI.
+vp run --filter @t3tools/desktop ensure:electron
+# Pre-warms Vite's dep optimizer (cache is keyed on the absolute path, which
+# is stable inside the container).
+node apps/web/scripts/warm-dep-cache.ts

.gitattributes

@@ -1,2 +1,5 @@
 # git autocrlf=true converts LF to CRLF on Windows, causing issues with oxfmt
 * text=auto eol=lf
+# Batch files need CRLF for cmd.exe to parse them reliably.
+*.cmd text eol=crlf
+*.bat text eol=crlf

.github/SECURITY.md

@@ -0,0 +1,8 @@
+# Security policy
+
+Report security vulnerabilities affecting T3 Code or T3 Tools-operated infrastructure to
+[security@ping.gg](mailto:security@ping.gg). Please do not disclose them publicly until we have had
+a reasonable opportunity to investigate and remediate them.
+
+See the [full security policy](https://t3.codes/security-policy) for reporting details, scope,
+and safe harbor terms for good-faith research.

.github/VOUCHED.td

@@ -12,22 +12,28 @@
 github:0x4bs3nt
 github:Adamulek123
 github:adityavardhansharma
+github:aoright
 github:arhxam
 github:bil0000
 github:binbandit
 github:Brechard
+github:btsouth
 github:chrisdeeming
 github:chuks-qua
 github:cursoragent
 github:D3OXY
+github:dbalders
 github:eggfriedrice24
 github:extoci
+github:flamboh
+github:FllipEis
 github:gbarros-dev
 github:gfsaaser24
 github:github-actions[bot]
 github:gsimone
 github:GuilhermeVieiraDev
 github:hwanseoc
+github:inayayousfi
 github:ipanasenko
 github:jakeleventhal
 github:jamesx0416
@@ -36,13 +42,18 @@ github:jasonLaster
 github:JoeEverest
 github:justsomelegs
 github:kridaydave
+github:lgwacker
 github:lnieuwenhuis
 github:Lucenx9
 github:mackinleysmith
 github:maria-rcks
+github:MatthewFeroz
 github:maxwellyoung
 github:mwolson
+github:myacoub91
+github:naMqe-h
 github:nateEc
+github:naveed949
 github:nmggithub
 github:Noojuno
 github:notkainoa
@@ -64,6 +75,7 @@ github:tarik02
 github:tris203
 github:tsouth89
 github:UtkarshUsername
+github:vitalyiegorov
 github:Yash-Singh1
 github:yashranaway
 github:Ymit24

.github/actions/setup-apt-mirrors/action.yml

@@ -0,0 +1,22 @@
+name: Setup APT mirrors
+description: Configure Ubuntu package downloads with automatic mirror failover.
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        # Replace the existing Blacksmith mirror list as well as direct sources.
+        printf '%s\tpriority:%s\n' \
+          https://archive.ubuntu.com/ubuntu 1 \
+          https://mirrors.edge.kernel.org/ubuntu 2 \
+          https://mirror.math.princeton.edu/pub/ubuntu 3 \
+          | sudo tee /etc/apt/blacksmith-ubuntu-mirrors.txt > /dev/null
+
+        # APT's mirror transport retries each file against the next server.
+        sudo find /etc/apt -maxdepth 2 -type f \( -name '*.list' -o -name '*.sources' \) \
+          -exec sed -i -E \
+          's#https?://(([^/]+\.)?archive|security)\.ubuntu\.com/ubuntu/?#mirror+file:/etc/apt/blacksmith-ubuntu-mirrors.txt#g' {} +
+
+        # Move on to a fallback before an unreachable server exhausts the job.
+        printf '%s\n' 'Acquire::http::Timeout "15";' 'Acquire::https::Timeout "15";' \
+          | sudo tee /etc/apt/apt.conf.d/80-mirror-timeouts > /dev/null

.github/scripts/check-nightly-release.cjs

@@ -0,0 +1,67 @@
+const MINIMUM_RELEASE_GAP_MS = 6 * 60 * 60 * 1000;
+
+const isNightlyTag = (tag) => /^v.*-nightly\./.test(tag) || tag.startsWith("nightly-v");
+
+// Newest published nightly by publication time, or undefined when none exists.
+async function findLatestNightly({ github, context }) {
+  const releases = await github.paginate(github.rest.repos.listReleases, {
+    ...context.repo,
+    per_page: 100,
+  });
+  return releases
+    .filter((release) => !release.draft && release.published_at && isNightlyTag(release.tag_name))
+    .sort((a, b) => Date.parse(b.published_at) - Date.parse(a.published_at))[0];
+}
+
+// Runs after the workflow acquires the nightly concurrency lock.
+async function shouldReleaseNightly({ github, context, core, now = Date.now() }) {
+  const lastNightly = await findLatestNightly({ github, context });
+
+  if (!lastNightly) {
+    core.info("No published nightly found. Proceeding with release.");
+    return true;
+  }
+
+  if (now - Date.parse(lastNightly.published_at) < MINIMUM_RELEASE_GAP_MS) {
+    core.info(`Nightly ${lastNightly.tag_name} was published less than six hours ago. Skipping.`);
+    return false;
+  }
+
+  const { data: comparison } = await github.rest.repos.compareCommitsWithBasehead({
+    ...context.repo,
+    basehead: `${lastNightly.tag_name}...${context.sha}`,
+    per_page: 1,
+  });
+  if (comparison.status !== "ahead") {
+    core.info(
+      `Candidate commit is ${comparison.status} relative to ${lastNightly.tag_name}. Skipping.`,
+    );
+    return false;
+  }
+
+  core.info(`New commits since ${lastNightly.tag_name}, and the six-hour gap has passed.`);
+  return true;
+}
+
+// Stable releases build the commit the latest nightly shipped, so the stable
+// build is one nightly users already ran. Returns the nightly tag, its commit,
+// and the stable version that nightly was a preview of.
+async function resolveLatestNightlyCommit({ github, context, core }) {
+  const lastNightly = await findLatestNightly({ github, context });
+  if (!lastNightly) {
+    throw new Error("No published nightly found. Stable releases build the latest nightly commit.");
+  }
+
+  const tag = lastNightly.tag_name;
+  // repos.getCommit dereferences annotated tags, so this is the commit either way.
+  const { data: commit } = await github.rest.repos.getCommit({ ...context.repo, ref: tag });
+  const version = /^(?:nightly-)?v(\d+\.\d+\.\d+)-nightly\./.exec(tag)?.[1];
+  if (!version) {
+    throw new Error(`Cannot derive a stable version from nightly tag ${tag}.`);
+  }
+
+  core.info(`Latest nightly ${tag} shipped ${commit.sha} as a preview of ${version}.`);
+  return { tag, sha: commit.sha, version };
+}
+
+module.exports = { shouldReleaseNightly, resolveLatestNightlyCommit };