chore: sync main from pingdotgg/t3code

.agents/skills/test-t3-mobile/SKILL.md

@@ -43,10 +43,15 @@ prints one JSON line; on failure it names the next command. Mobile verification
 includes that step unless the user prohibits it.
 
 For a device you opened in an agent-device session elsewhere (a device pool,
-cloud, or remote host), run `vp run mobile:install <ios|android> --session <s>`
-from the directory you opened the session in. It installs the cached build into
-that session (`--abi arm64-v8a` for an ARM Android device; `--metro <url>` also
-opens it against Metro) and never builds.
+cloud, or remote host), run `vp run mobile:install <ios|android> --session <s>
+--config <file>` from the directory you opened the session in, passing the
+`--config` file from `device_open`'s `targetArgs`. Without it, a device pool's
+gateway refuses the install, wrongly saying agent-device is too old. It installs
+the cached build into that session (`--abi arm64-v8a` for an ARM Android device;
+pool Android emulators are x86_64, the default; `--metro <url>` also opens it
+against Metro). Without a cached build for this checkout it builds first, which can
+outlast the lease, so run `vp run mobile:install <ios|android> --prepare` (with
+the same `--abi`) before you open the device.
 
 Start `vp run dev:client` from `apps/mobile`, or reuse a healthy Metro belonging
 to this checkout. Open its printed development-client URL with AgentDevice

.github/scripts/pr-limits.cjs

@@ -100,14 +100,22 @@ function parseExemptions(text) {
 }
 
 // VOUCHED.td: one `github:login` per line, `#` comments, and `-github:login reason` to denounce.
-function vouchedLogins(text) {
-  const logins = new Set();
+// A login listed both ways is an error: pr-vouch.yml's action reads its first line and
+// issue-vouch.yml its last, so no answer here would agree with both labels.
+function parseVouchList(text) {
+  const vouched = new Set();
+  const denounced = new Set();
   for (const raw of text.split("\n")) {
-    const entry = raw.trim().split(/\s+/)[0];
-    if (entry.startsWith("github:")) logins.add(entry.slice("github:".length).toLowerCase());
+    const match = /^(-?)github:(\S+)/.exec(raw.trim());
+    if (!match) continue;
+    const login = match[2].toLowerCase();
+    const [listed, other] = match[1] ? [denounced, vouched] : [vouched, denounced];
+    if (other.has(login))
+      throw new Error(`${VOUCHED_PATH}: ${login} is both vouched and denounced`);
+    listed.add(login);
   }
-  if (logins.size === 0) throw new Error(`${VOUCHED_PATH}: no entries`);
-  return logins;
+  if (vouched.size === 0) throw new Error(`${VOUCHED_PATH}: no entries`);
+  return { vouched, denounced };
 }
 
 function labeledAt(pr, name) {
@@ -278,7 +286,8 @@ async function enforceOpenLimit({ github, context, core, dryRun }) {
   // lookups as "not vouched". Every read below throws on failure, and a throw closes nothing.
   if (pr.user.type === "Bot") return;
   if (parseExemptions(fs.readFileSync(EXEMPTIONS_PATH, "utf8")).has(author.toLowerCase())) return;
-  if (vouchedLogins(fs.readFileSync(VOUCHED_PATH, "utf8")).has(author.toLowerCase())) return;
+  const { vouched, denounced } = parseVouchList(fs.readFileSync(VOUCHED_PATH, "utf8"));
+  if (vouched.has(author.toLowerCase())) return;
   const { data: access } = await github.rest.repos.getCollaboratorPermissionLevel({
     ...context.repo,
     username: author,
@@ -289,6 +298,21 @@ async function enforceOpenLimit({ github, context, core, dryRun }) {
   const reopened = context.payload.action === "reopened";
   if (reopened && context.payload.sender.login.toLowerCase() !== author.toLowerCase()) return;
 
+  if (denounced.has(author.toLowerCase())) {
+    if (dryRun) {
+      core.notice(`Dry run. PR #${pr.number} would close: ${author} is denounced.`);
+      return;
+    }
+    await closeWithComment(
+      github,
+      context,
+      pr.number,
+      `Closing: ${author} is banned from contributing here, so this PR will not be reviewed. See [bans](${guideLink(context, "bans")}).`,
+    );
+    core.info(`PR #${pr.number}: closed, ${author} is denounced.`);
+    return;
+  }
+
   const q = `repo:${context.repo.owner}/${context.repo.repo} is:pr is:open author:${author} sort:created-asc`;
   const { search } = await read(github, AUTHOR_OPEN_PRS_QUERY, { q });
   // A new PR counts only the older ones, so two opened together cannot close each other.

.github/workflows/issue-vouch.yml

@@ -40,9 +40,14 @@ jobs:
               ref: context.payload.repository.default_branch,
             });
             const statusByUser = new Map();
+            const listedBothWays = new Set();
             for (const raw of Buffer.from(file.content, "base64").toString("utf8").split("\n")) {
               const match = /^(-?)github:(\S+)/.exec(raw.trim());
-              if (match) statusByUser.set(match[2].toLowerCase(), match[1] ? "denounced" : "vouched");
+              if (!match) continue;
+              const login = match[2].toLowerCase();
+              const status = match[1] ? "denounced" : "vouched";
+              if (statusByUser.has(login) && statusByUser.get(login) !== status) listedBothWays.add(login);
+              statusByUser.set(login, status);
             }
 
             const issues =
@@ -74,4 +79,32 @@ jobs:
                 await github.rest.issues.addLabels({ owner, repo, issue_number: issue.number, labels: [next] });
                 core.info(`Issue #${issue.number} (${issue.user.login}): ${status} -> ${next}`);
               }
+
+              // Only a newly opened issue is closed. One filed before its author was denounced
+              // may already have a fix on the way, so the sweep leaves those to maintainers.
+              // Someone else reopening it is a maintainer keeping it open.
+              const reopenedByOther =
+                context.payload.action === "reopened" &&
+                context.payload.sender.login.toLowerCase() !== issue.user.login.toLowerCase();
+              // The PR rules refuse a list that names a login both ways, so nothing closes for one here.
+              const trusted =
+                issue.user.type === "Bot" ||
+                ["OWNER", "MEMBER", "COLLABORATOR"].includes(issue.author_association) ||
+                listedBothWays.has(issue.user.login.toLowerCase());
+              if (status === "denounced" && context.eventName === "issues" && !reopenedByOther && !trusted) {
+                await github.rest.issues.createComment({
+                  owner,
+                  repo,
+                  issue_number: issue.number,
+                  body: `Closing: ${issue.user.login} is banned from contributing here, so this issue will not be triaged. See [bans](https://github.com/${owner}/${repo}/blob/main/CONTRIBUTING.md#bans).`,
+                });
+                await github.rest.issues.update({
+                  owner,
+                  repo,
+                  issue_number: issue.number,
+                  state: "closed",
+                  state_reason: "not_planned",
+                });
+                core.info(`Issue #${issue.number}: closed, ${issue.user.login} is denounced.`);
+              }
             }

.github/workflows/release.yml

@@ -903,34 +903,12 @@ jobs:
           fi
 
       # electron-updater reads one manifest per platform and channel and picks
-      # the file entry whose name carries the running arch, so the per-arch
-      # manifests the build jobs wrote are merged back into that one file.
-      - name: Merge macOS updater manifests
+      # the file entry whose name carries the running arch. Require every
+      # platform's two build jobs to have produced matching metadata before
+      # merging it, so a successful release can never strand one architecture.
+      - name: Merge desktop updater manifests
         if: needs.preflight.outputs.release_channel != 'preview'
-        run: |
-          shopt -s nullglob
-          for x64_manifest in release-assets/*-mac-x64.yml; do
-            arm64_manifest="${x64_manifest%-x64.yml}.yml"
-            if [[ -f "$arm64_manifest" ]]; then
-              node scripts/merge-update-manifests.ts --platform mac "$arm64_manifest" "$x64_manifest"
-              rm -f "$x64_manifest"
-            fi
-          done
-
-      - name: Merge Windows updater manifests
-        if: needs.preflight.outputs.release_channel != 'preview'
-        run: |
-          shopt -s nullglob
-          for x64_manifest in release-assets/*-win-x64.yml; do
-            arm64_manifest="${x64_manifest%-x64.yml}-arm64.yml"
-            merged_manifest="${x64_manifest%-win-x64.yml}.yml"
-            if [[ -f "$arm64_manifest" ]]; then
-              node scripts/merge-update-manifests.ts --platform win "$x64_manifest" "$arm64_manifest" "$merged_manifest"
-              rm -f "$x64_manifest" "$arm64_manifest"
-            else
-              mv "$x64_manifest" "$merged_manifest"
-            fi
-          done
+        run: node scripts/merge-release-update-manifests.ts release-assets
 
       # Updater manifests and blockmaps are what electron-updater consumes.
       # They are only listed for channels an updater is meant to follow.

CONTRIBUTING.md

@@ -115,6 +115,9 @@ the open PR limit.
 - If you make our lives harder as reviewers and maintainers, you will be banned. Examples are repeated
   pings, a fight over a closure, and a second account to get around a limit.
 
+A banned account is denounced in [.github/VOUCHED.td](.github/VOUCHED.td). Any issue or PR it opens
+is closed when it is opened.
+
 <a id="closure-and-reconsideration"></a>
 
 ## When your PR is closed

apps/desktop/scripts/ensure-electron-runtime.mjs

@@ -209,6 +209,10 @@ export function ensureElectronRuntime() {
   return electronPath;
 }
 
+export function setup() {
+  ensureElectronRuntime();
+}
+
 // `file://${argv[1]}` never matches on Windows (drive letters need `file:///C:/`).
 if (process.argv[1] && NodeURL.pathToFileURL(process.argv[1]).href === import.meta.url) {
   const electronPath = ensureElectronRuntime();

apps/desktop/src/app/DesktopApp.test.ts

@@ -86,6 +86,7 @@ it.effect.each([false, true])(
       const historyStarted = yield* Deferred.make<void>();
       const releaseHistory = yield* Deferred.make<void>();
       const quitting = yield* Ref.make(false);
+      const tokenRequested = yield* Deferred.make<void>();
       const events: string[] = [];
       const record = (event: string) =>
         Effect.sync(() => {
@@ -144,7 +145,7 @@ it.effect.each([false, true])(
             configure: Effect.void,
           } as PreviewPasskeys.PreviewPasskeys["Service"]),
           Effect.provideService(DesktopApplicationMenu.DesktopApplicationMenu, {
-            configure: Effect.void,
+            configure: record("menu"),
           }),
           Effect.provideService(DesktopUpdates.DesktopUpdates, {
             configure: Effect.void,
@@ -222,7 +223,12 @@ it.effect.each([false, true])(
             Layer.mock(DesktopClientSettings.DesktopClientSettings, {}),
             Layer.mock(DesktopConnectionCatalogStore.DesktopConnectionCatalogStore, {}),
             Layer.mock(DesktopIpc.DesktopIpc, {}),
-            Layer.mock(DesktopLocalEnvironmentAuth.DesktopLocalEnvironmentAuth, {}),
+            Layer.mock(DesktopLocalEnvironmentAuth.DesktopLocalEnvironmentAuth, {
+              getBearerToken: record("token").pipe(
+                Effect.andThen(Deferred.succeed(tokenRequested, undefined)),
+                Effect.as("token"),
+              ),
+            }),
             Layer.mock(DesktopManagedPolicy.DesktopManagedPolicy, {}),
             Layer.succeed(DesktopPrimaryPaste.DesktopPrimaryPaste, { enabled: true }),
             Layer.mock(DesktopSshEnvironment.DesktopSshEnvironment, {}),
@@ -253,7 +259,13 @@ it.effect.each([false, true])(
       );
       yield* Deferred.await(registrationStarted);
       yield* Deferred.await(windowStarted);
-      assert.deepEqual(events, ["identity", "ready", "identity", "backend", "window"]);
+      yield* Deferred.await(tokenRequested);
+      // The backend spawns before menus, and its token is minted without waiting for the renderer.
+      assert.deepEqual(
+        events.filter((event) => event !== "token"),
+        ["identity", "ready", "identity", "backend", "menu", "window"],
+      );
+      assert.isAbove(events.indexOf("token"), events.indexOf("backend"));
       assert.isFalse(yield* Deferred.isDone(registrationStopped));
       const shutdown = yield* DesktopShutdown.DesktopShutdown;
       yield* shutdown.request;