chore: sync with upstream T3 Code main

.agents/skills/test-t3-mobile/SKILL.md

@@ -43,10 +43,15 @@ prints one JSON line; on failure it names the next command. Mobile verification
 includes that step unless the user prohibits it.
 
 For a device you opened in an agent-device session elsewhere (a device pool,
-cloud, or remote host), run `vp run mobile:install <ios|android> --session <s>`
-from the directory you opened the session in. It installs the cached build into
-that session (`--abi arm64-v8a` for an ARM Android device; `--metro <url>` also
-opens it against Metro) and never builds.
+cloud, or remote host), run `vp run mobile:install <ios|android> --session <s>
+--config <file>` from the directory you opened the session in, passing the
+`--config` file from `device_open`'s `targetArgs`. Without it, a device pool's
+gateway refuses the install, wrongly saying agent-device is too old. It installs
+the cached build into that session (`--abi arm64-v8a` for an ARM Android device;
+pool Android emulators are x86_64, the default; `--metro <url>` also opens it
+against Metro). Without a cached build for this checkout it builds first, which can
+outlast the lease, so run `vp run mobile:install <ios|android> --prepare` (with
+the same `--abi`) before you open the device.
 
 Start `vp run dev:client` from `apps/mobile`, or reuse a healthy Metro belonging
 to this checkout. Open its printed development-client URL with AgentDevice

.github/scripts/pr-limits.cjs

@@ -100,14 +100,22 @@ function parseExemptions(text) {
 }
 
 // VOUCHED.td: one `github:login` per line, `#` comments, and `-github:login reason` to denounce.
-function vouchedLogins(text) {
-  const logins = new Set();
+// A login listed both ways is an error: pr-vouch.yml's action reads its first line and
+// issue-vouch.yml its last, so no answer here would agree with both labels.
+function parseVouchList(text) {
+  const vouched = new Set();
+  const denounced = new Set();
   for (const raw of text.split("\n")) {
-    const entry = raw.trim().split(/\s+/)[0];
-    if (entry.startsWith("github:")) logins.add(entry.slice("github:".length).toLowerCase());
+    const match = /^(-?)github:(\S+)/.exec(raw.trim());
+    if (!match) continue;
+    const login = match[2].toLowerCase();
+    const [listed, other] = match[1] ? [denounced, vouched] : [vouched, denounced];
+    if (other.has(login))
+      throw new Error(`${VOUCHED_PATH}: ${login} is both vouched and denounced`);
+    listed.add(login);
   }
-  if (logins.size === 0) throw new Error(`${VOUCHED_PATH}: no entries`);
-  return logins;
+  if (vouched.size === 0) throw new Error(`${VOUCHED_PATH}: no entries`);
+  return { vouched, denounced };
 }
 
 function labeledAt(pr, name) {
@@ -278,7 +286,8 @@ async function enforceOpenLimit({ github, context, core, dryRun }) {
   // lookups as "not vouched". Every read below throws on failure, and a throw closes nothing.
   if (pr.user.type === "Bot") return;
   if (parseExemptions(fs.readFileSync(EXEMPTIONS_PATH, "utf8")).has(author.toLowerCase())) return;
-  if (vouchedLogins(fs.readFileSync(VOUCHED_PATH, "utf8")).has(author.toLowerCase())) return;
+  const { vouched, denounced } = parseVouchList(fs.readFileSync(VOUCHED_PATH, "utf8"));
+  if (vouched.has(author.toLowerCase())) return;
   const { data: access } = await github.rest.repos.getCollaboratorPermissionLevel({
     ...context.repo,
     username: author,
@@ -289,6 +298,21 @@ async function enforceOpenLimit({ github, context, core, dryRun }) {
   const reopened = context.payload.action === "reopened";
   if (reopened && context.payload.sender.login.toLowerCase() !== author.toLowerCase()) return;
 
+  if (denounced.has(author.toLowerCase())) {
+    if (dryRun) {
+      core.notice(`Dry run. PR #${pr.number} would close: ${author} is denounced.`);
+      return;
+    }
+    await closeWithComment(
+      github,
+      context,
+      pr.number,
+      `Closing: ${author} is banned from contributing here, so this PR will not be reviewed. See [bans](${guideLink(context, "bans")}).`,
+    );
+    core.info(`PR #${pr.number}: closed, ${author} is denounced.`);
+    return;
+  }
+
   const q = `repo:${context.repo.owner}/${context.repo.repo} is:pr is:open author:${author} sort:created-asc`;
   const { search } = await read(github, AUTHOR_OPEN_PRS_QUERY, { q });
   // A new PR counts only the older ones, so two opened together cannot close each other.

.github/workflows/ci.yml

@@ -591,7 +591,7 @@ jobs:
     name: Mobile Native Static Analysis
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.mobile_native != 'false' }}
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     timeout-minutes: 10
     steps:
       - name: Checkout

.github/workflows/desktop-macos-preview-publish.yml

@@ -316,6 +316,7 @@ jobs:
       rust_target: aarch64-apple-darwin
       resource_key: darwin-arm64
       cli_archive: false
+      untrusted_bundle: true
 
   # Release assets download without a GitHub account, unlike workflow
   # artifacts. All preview DMGs live on one rolling prerelease tagged

.github/workflows/issue-vouch.yml

@@ -40,9 +40,14 @@ jobs:
               ref: context.payload.repository.default_branch,
             });
             const statusByUser = new Map();
+            const listedBothWays = new Set();
             for (const raw of Buffer.from(file.content, "base64").toString("utf8").split("\n")) {
               const match = /^(-?)github:(\S+)/.exec(raw.trim());
-              if (match) statusByUser.set(match[2].toLowerCase(), match[1] ? "denounced" : "vouched");
+              if (!match) continue;
+              const login = match[2].toLowerCase();
+              const status = match[1] ? "denounced" : "vouched";
+              if (statusByUser.has(login) && statusByUser.get(login) !== status) listedBothWays.add(login);
+              statusByUser.set(login, status);
             }
 
             const issues =
@@ -74,4 +79,32 @@ jobs:
                 await github.rest.issues.addLabels({ owner, repo, issue_number: issue.number, labels: [next] });
                 core.info(`Issue #${issue.number} (${issue.user.login}): ${status} -> ${next}`);
               }
+
+              // Only a newly opened issue is closed. One filed before its author was denounced
+              // may already have a fix on the way, so the sweep leaves those to maintainers.
+              // Someone else reopening it is a maintainer keeping it open.
+              const reopenedByOther =
+                context.payload.action === "reopened" &&
+                context.payload.sender.login.toLowerCase() !== issue.user.login.toLowerCase();
+              // The PR rules refuse a list that names a login both ways, so nothing closes for one here.
+              const trusted =
+                issue.user.type === "Bot" ||
+                ["OWNER", "MEMBER", "COLLABORATOR"].includes(issue.author_association) ||
+                listedBothWays.has(issue.user.login.toLowerCase());
+              if (status === "denounced" && context.eventName === "issues" && !reopenedByOther && !trusted) {
+                await github.rest.issues.createComment({
+                  owner,
+                  repo,
+                  issue_number: issue.number,
+                  body: `Closing: ${issue.user.login} is banned from contributing here, so this issue will not be triaged. See [bans](https://github.com/${owner}/${repo}/blob/main/CONTRIBUTING.md#bans).`,
+                });
+                await github.rest.issues.update({
+                  owner,
+                  repo,
+                  issue_number: issue.number,
+                  state: "closed",
+                  state_reason: "not_planned",
+                });
+                core.info(`Issue #${issue.number}: closed, ${issue.user.login} is denounced.`);
+              }
             }

.github/workflows/mobile-dev-client.yml

@@ -219,7 +219,7 @@ jobs:
   ios:
     name: iOS simulator
     if: github.repository == 'pingdotgg/t3code' && (github.event_name != 'workflow_dispatch' || inputs.platform == 'ios')
-    runs-on: blacksmith-12vcpu-macos-26
+    runs-on: blacksmith-12vcpu-macos-27
     timeout-minutes: 60
     concurrency:
       group: mobile-dev-client-ios-${{ github.event_name == 'pull_request' && github.event.pull_request.number || inputs.fingerprint || github.sha }}

.github/workflows/mobile-eas-production.yml

@@ -680,8 +680,8 @@ jobs:
           echo ":rocket: android: submitted and recorded \`$BUILD_TAG\`" >> "$GITHUB_STEP_SUMMARY"
 
   # Off unless the MOBILE_IOS_LOCAL_BUILDS repository variable is `true`; the
-  # production job only sets ios_build then. Store binaries need the final
-  # Xcode 27.1; MOBILE_IOS_ALLOW_XCODE_RC=true accepts the release candidate.
+  # production job only sets ios_build then. Xcode 27.1 matches the EAS build
+  # image in eas.json.
   # No sticky disk: it mounts ext4 and only works on Linux runners.
   ios:
     name: iOS store build
@@ -701,7 +701,6 @@ jobs:
       EXPO_TOKEN: ${{ secrets.EXPO_PRODUCTION_TOKEN }}
       PROFILE: ${{ needs.production.outputs.ios_profile }}
       BUILD_TAG: mobile-ios-build/${{ needs.production.outputs.ios_profile }}/${{ needs.production.outputs.ios_version }}/${{ needs.production.outputs.ios_fingerprint }}
-      ALLOW_XCODE_RC: ${{ vars.MOBILE_IOS_ALLOW_XCODE_RC == 'true' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
@@ -739,12 +738,9 @@ jobs:
         if: steps.record.outputs.built != 'true'
         run: |
           xcode=/Applications/Xcode_27.1.app
-          if [ ! -d "$xcode" ] && [ "$ALLOW_XCODE_RC" = "true" ]; then
-            xcode=/Applications/Xcode_27.1_Release_Candidate.app
-          fi
           if [ ! -d "$xcode" ]; then
             ls -d /Applications/Xcode*.app
-            echo "::error::Xcode 27.1 (final) is not on this runner. Set the MOBILE_IOS_ALLOW_XCODE_RC repository variable to true to build store binaries with the release candidate."
+            echo "::error::Xcode 27.1 is not on this runner."
             exit 1
           fi
           sudo xcode-select -s "$xcode/Contents/Developer"

.github/workflows/mobile-showcase-screenshots.yml

@@ -45,7 +45,7 @@ jobs:
   ios:
     name: iPhone, iPhone Duo, and iPad 13
     if: inputs.platform == 'all' || inputs.platform == 'ios'
-    runs-on: blacksmith-12vcpu-macos-26
+    runs-on: blacksmith-12vcpu-macos-27
     # Capturing every palette multiplies the device matrix by six, and only the
     # one native build is shared between them.
     timeout-minutes: ${{ inputs.theme == 'all' && 300 || 60 }}

.github/workflows/release-desktop.yml

@@ -70,6 +70,12 @@ on:
         required: false
         default: false
         type: boolean
+      # Whether the JS bundle came from a pull request. This job holds the
+      # signing secrets, so packaging then skips every step that runs the bundle.
+      untrusted_bundle:
+        required: false
+        default: false
+        type: boolean
       # A runner of the target's own platform and architecture, for a `runner`
       # that cannot execute the target. The build job skips everything that
       # runs the packaged binaries, and a second job runs it there.
@@ -134,6 +140,14 @@ jobs:
       T3CODE_CLERK_CLI_OAUTH_CLIENT_ID: ${{ inputs.clerk_cli_oauth_client_id }}
       T3CODE_RELAY_URL: ${{ inputs.relay_url }}
     steps:
+      # The launch check and the CLI archive smoke test both run the bundle.
+      - name: Reject running an untrusted bundle
+        if: inputs.untrusted_bundle && (inputs.launch_check || inputs.cli_archive)
+        shell: bash
+        run: |
+          echo "::error::untrusted_bundle cannot be combined with launch_check or cli_archive, which run the bundle."
+          exit 1
+
       # This repository is public, so Git needs no credentials. checkout's
       # credential cleanup runs submodule foreach even with submodules disabled,
       # which fails on the orphaned gitlinks in our vendored .repos tree.
@@ -573,6 +587,7 @@ jobs:
           pnpm_config_prefer_offline: "true"
           T3CODE_DESKTOP_REUSE_RESOURCE_MONITOR: true
           T3CODE_DESKTOP_REUSE_LINUX_CAPTURE_HELPERS: ${{ steps.capture_helper_cache.outputs.cache-hit == 'true' }}
+          T3CODE_DESKTOP_UNTRUSTED_BUNDLE: ${{ inputs.untrusted_bundle }}
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
           APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}

.github/workflows/release.yml

@@ -903,34 +903,12 @@ jobs:
           fi
 
       # electron-updater reads one manifest per platform and channel and picks
-      # the file entry whose name carries the running arch, so the per-arch
-      # manifests the build jobs wrote are merged back into that one file.
-      - name: Merge macOS updater manifests
+      # the file entry whose name carries the running arch. Require every
+      # platform's two build jobs to have produced matching metadata before
+      # merging it, so a successful release can never strand one architecture.
+      - name: Merge desktop updater manifests
         if: needs.preflight.outputs.release_channel != 'preview'
-        run: |
-          shopt -s nullglob
-          for x64_manifest in release-assets/*-mac-x64.yml; do
-            arm64_manifest="${x64_manifest%-x64.yml}.yml"
-            if [[ -f "$arm64_manifest" ]]; then
-              node scripts/merge-update-manifests.ts --platform mac "$arm64_manifest" "$x64_manifest"
-              rm -f "$x64_manifest"
-            fi
-          done
-
-      - name: Merge Windows updater manifests
-        if: needs.preflight.outputs.release_channel != 'preview'
-        run: |
-          shopt -s nullglob
-          for x64_manifest in release-assets/*-win-x64.yml; do
-            arm64_manifest="${x64_manifest%-x64.yml}-arm64.yml"
-            merged_manifest="${x64_manifest%-win-x64.yml}.yml"
-            if [[ -f "$arm64_manifest" ]]; then
-              node scripts/merge-update-manifests.ts --platform win "$x64_manifest" "$arm64_manifest" "$merged_manifest"
-              rm -f "$x64_manifest" "$arm64_manifest"
-            else
-              mv "$x64_manifest" "$merged_manifest"
-            fi
-          done
+        run: node scripts/merge-release-update-manifests.ts release-assets
 
       # Updater manifests and blockmaps are what electron-updater consumes.
       # They are only listed for channels an updater is meant to follow.

CONTRIBUTING.md

@@ -115,6 +115,9 @@ the open PR limit.
 - If you make our lives harder as reviewers and maintainers, you will be banned. Examples are repeated
   pings, a fight over a closure, and a second account to get around a limit.
 
+A banned account is denounced in [.github/VOUCHED.td](.github/VOUCHED.td). Any issue or PR it opens
+is closed when it is opened.
+
 <a id="closure-and-reconsideration"></a>
 
 ## When your PR is closed

apps/desktop/scripts/ensure-electron-runtime.mjs

@@ -209,6 +209,10 @@ export function ensureElectronRuntime() {
   return electronPath;
 }
 
+export function setup() {
+  ensureElectronRuntime();
+}
+
 // `file://${argv[1]}` never matches on Windows (drive letters need `file:///C:/`).
 if (process.argv[1] && NodeURL.pathToFileURL(process.argv[1]).href === import.meta.url) {
   const electronPath = ensureElectronRuntime();