chore: sync with upstream pingdotgg/t3code main

.github/scripts/check-nightly-release.cjs

@@ -121,9 +121,54 @@ async function resolveLatestNightlyCommit({ github, context, core }) {
   return { tag, sha: commit.sha, version };
 }
 
+// The two places a nightly install looks for an update: the `update-feed` pointer, and
+// releases.atom, which holds the 10 newest git tags of any kind. Older installs take the first
+// nightly in the feed. Reports what each names beside the newest published nightly.
+async function readNightlyUpdateFeed({ github, context, fetch = globalThis.fetch }) {
+  const latest = await findLatestNightly({ github, context });
+  if (!latest) return {};
+
+  const base = `https://github.com/${context.repo.owner}/${context.repo.repo}`;
+  // Only a missing or malformed pointer is stale. Rewriting deletes the old file first, so a
+  // GitHub outage must not look like one.
+  // Node waits five minutes for a stalled response, which is this job's whole time limit.
+  const signal = () => AbortSignal.timeout(30_000);
+  const pointer = await fetch(`${base}/releases/download/update-feed/nightly.json`, {
+    signal: signal(),
+  });
+  if (!pointer.ok && pointer.status !== 404) {
+    throw new Error(`The update-feed pointer answered HTTP ${pointer.status}.`);
+  }
+  let pointerTag;
+  if (pointer.ok) {
+    // A body that fails to arrive throws here; only one that is not JSON counts as malformed.
+    const body = await pointer.text();
+    try {
+      pointerTag = JSON.parse(body)?.tag_name;
+    } catch {}
+  }
+
+  // An unreadable feed leaves `feedTags` unset, so the pointer is still repaired. An error page
+  // can answer HTTP 200, so only an Atom document counts as read.
+  let feedTags;
+  try {
+    const feed = await fetch(`${base}/releases.atom`, { signal: signal() });
+    const body = feed.ok ? await feed.text() : "";
+    if (/<feed[\s>]/.test(body)) {
+      feedTags = Array.from(body.matchAll(/href="[^"]*\/releases\/tag\/([^"]+)"/g), (match) =>
+        decodeURIComponent(match[1]),
+      );
+    }
+  } catch {}
+  const feedNightly = feedTags?.find((tag) => /^v?\d+\.\d+\.\d+-nightly\./.test(tag));
+
+  return { tag: latest.tagName, pointerTag, feedNightly, feedTags };
+}
+
 module.exports = {
   assertCommitOnDefaultBranch,
   assertReleaseSource,
   shouldReleaseNightly,
   resolveLatestNightlyCommit,
+  readNightlyUpdateFeed,
 };

.github/scripts/check-nightly-release.test.cjs

@@ -237,3 +237,81 @@ test("stable releases fail when no nightly is published", async () => {
   const { options } = nightlyCommitFixture({ releases: [nightly(1, { tagName: "v1.0.0" })] });
   await assert.rejects(resolveLatestNightlyCommit(options), /No published nightly found/);
 });
+
+const { readNightlyUpdateFeed } = require("./check-nightly-release.cjs");
+
+// GitHub percent-encodes tag names in the feed, and any tag in the repository takes a slot.
+const atomEntry = (tag) =>
+  `<entry><link rel="alternate" type="text/html" href="https://github.com/example/app/releases/tag/${encodeURIComponent(tag)}"/></entry>`;
+const atomFeed = (tags) => new Response(`<feed>${tags.map(atomEntry).join("")}</feed>`);
+const NEWEST = "v1.0.1-nightly.20260905.123";
+const OLDER = "v1.0.1-nightly.20260905.100";
+
+function updateFeedFixture({ feed, pointer }) {
+  const { options } = fixture({
+    releases: [nightly(1), nightly(0, { tagName: "v1.0.2-preview.1" })],
+  });
+  options.fetch = async (url) =>
+    url === "https://github.com/example/app/releases.atom"
+      ? feed
+      : url === "https://github.com/example/app/releases/download/update-feed/nightly.json"
+        ? pointer
+        : assert.fail(`unexpected fetch ${url}`);
+  return options;
+}
+
+const missing = () => new Response("Not Found", { status: 404 });
+// HTTP 200, then the connection drops before the body arrives.
+const brokenBody = () =>
+  new Response(new ReadableStream({ start: (controller) => controller.error(new Error("reset")) }));
+for (const [name, { feed, pointer }, expected] of [
+  [
+    "a nightly crowded out of the feed and a missing pointer",
+    { feed: atomFeed(["v1.0.2-preview.1", "mobile-android-build/2.3.0/abc"]), pointer: missing() },
+    { pointerTag: undefined, feedNightly: undefined },
+  ],
+  [
+    "the first nightly in the feed, which is the one older installs take",
+    { feed: atomFeed(["update-feed", OLDER, NEWEST]), pointer: Response.json({ tag_name: OLDER }) },
+    { pointerTag: OLDER, feedNightly: OLDER },
+  ],
+  [
+    "a malformed pointer as stale and an unreadable feed as naming nothing",
+    { feed: new Response("", { status: 503 }), pointer: Response.json(null) },
+    { pointerTag: undefined, feedNightly: undefined, unreadable: true },
+  ],
+  [
+    "an HTML page with release links as an unreadable feed",
+    {
+      feed: new Response(
+        `<html><feedback-form></feedback-form><a href="/example/app/releases/tag/${OLDER}">x</a></html>`,
+      ),
+      pointer: Response.json({ tag_name: NEWEST }),
+    },
+    { pointerTag: NEWEST, feedNightly: undefined, unreadable: true },
+  ],
+  [
+    "the pointer when the feed's body fails to arrive",
+    { feed: brokenBody(), pointer: Response.json({ tag_name: NEWEST }) },
+    { pointerTag: NEWEST, feedNightly: undefined, unreadable: true },
+  ],
+]) {
+  test(`update feed check reports ${name}`, async () => {
+    const { tag, pointerTag, feedNightly, feedTags } = await readNightlyUpdateFeed(
+      updateFeedFixture({ feed, pointer }),
+    );
+    const { unreadable = false, ...named } = expected;
+    assert.deepEqual({ tag, pointerTag, feedNightly }, { tag: NEWEST, ...named });
+    assert.equal(feedTags === undefined, unreadable);
+  });
+}
+
+for (const [name, pointer, error] of [
+  ["answers with an error", () => new Response("", { status: 503 }), /pointer answered HTTP 503/],
+  ["drops the connection", brokenBody, /reset/],
+]) {
+  test(`update feed check does not call a pointer stale when GitHub ${name}`, async () => {
+    const options = updateFeedFixture({ feed: atomFeed([NEWEST]), pointer: pointer() });
+    await assert.rejects(readNightlyUpdateFeed(options), error);
+  });
+}

.github/workflows/ci.yml

@@ -504,8 +504,9 @@ jobs:
           T3CODE_TRANSFER_BUDGET_REPORT_PATH: ${{ runner.temp }}/t3code-transfer-budget.md
           T3CODE_TRANSFER_BUDGET_RESULT_PATH: ${{ runner.temp }}/thread-transfer-result.json
           T3CODE_TRANSFER_BUDGET_SCENARIOS_PATH: ${{ runner.temp }}/thread-transfer-scenarios.json
+        # One process per file spends ~2s starting before its tests run; one file per vCPU overlaps that.
         run: >-
-          vp run test:cached -- --shard ${{ matrix.shard }}/${{ strategy.job-total }}
+          vp run test:cached -- --shard ${{ matrix.shard }}/${{ strategy.job-total }} --concurrency 4
           --uncached apps/server/integration/transferBudgetV2.integration.test.ts
           --verify-hits 1 apps/server
 

.github/workflows/release.yml

@@ -49,7 +49,8 @@ jobs:
   # published nightly, so stable only ever ships a build that nightly users
   # have already run. Scheduled runs also decide here whether a nightly is due.
   # The PAUSE_NIGHTLY repository variable skips scheduled runs only; every later
-  # job needs this one, so a skip here skips the whole run.
+  # job needs this one, so a skip here skips the whole run. `update_feed` runs
+  # without it and checks the variable itself.
   resolve_commit:
     name: Resolve release commit
     if: github.repository == 'pingdotgg/t3code' && (github.event_name != 'schedule' || vars.PAUSE_NIGHTLY != 'true')
@@ -165,14 +166,12 @@ jobs:
             echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
             echo "make_latest=false" >> "$GITHUB_OUTPUT"
           elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${DISPATCH_CHANNEL:-preview}" == "preview" ]]; then
-            # Manual-only test train: exercises the whole release flow for a
-            # commit end users must never receive. Never scheduled.
+            # Manual-only test train: exercises the release flow up to a draft
+            # release for a commit end users must never receive. Never scheduled.
             # Same versioning as nightly under its own prerelease identifier.
-            # A preview release is reachable only by asking for it: npm gets it
-            # under the `preview` dist-tag, which nothing resolves by default,
-            # its desktop builds carry no update feed, and no updater manifest
-            # is attached to the release, so neither stable nor nightly
-            # installs can ever be offered one.
+            # A preview release stays a draft (see "Publish prerelease"), its
+            # desktop builds carry no update feed, no updater manifest is
+            # attached, and npm gets nothing, so no install can be offered one.
             nightly_date="$(date -u -d "$NIGHTLY_DATE" +%Y%m%d)"
 
             node scripts/resolve-nightly-release.ts \
@@ -183,7 +182,6 @@ jobs:
               --github-output
 
             echo "release_channel=preview" >> "$GITHUB_OUTPUT"
-            echo "cli_dist_tag=preview" >> "$GITHUB_OUTPUT"
             echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
             echo "make_latest=false" >> "$GITHUB_OUTPUT"
           else
@@ -1038,22 +1036,93 @@ jobs:
       # The action keeps a stable release a draft until its assets finish uploading, but publishes a
       # prerelease first. Desktop clients update connected servers from the CLI archives as soon as
       # they see the release, so a prerelease also goes public only once every asset is attached.
+      # Previews stay drafts, because a draft has no git tag. releases.atom lists the 10 newest tags,
+      # a day's `preview` tags can sort above its `nightly` ones, and older updaters find nightlies only there.
       - name: Publish prerelease
-        if: needs.preflight.outputs.is_prerelease == 'true'
+        if: needs.preflight.outputs.is_prerelease == 'true' && needs.preflight.outputs.release_channel != 'preview'
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
           RELEASE_TAG: ${{ needs.preflight.outputs.tag }}
         run: gh release edit "$RELEASE_TAG" --draft=false
 
+  # A nightly install finds updates in releases.atom, which holds the 10 newest git tags of any
+  # kind, so a burst of other tags hides every nightly. The `update-feed` release is the fixed URL
+  # newer installs also read. Every unpaused scheduled tick and every nightly repairs it, then fails when
+  # the feed's first nightly is not the newest one. See docs/operations/release.md#update-feed.
+  update_feed:
+    name: Check the update feed
+    needs: [preflight, release]
+    if: ${{ !cancelled() && github.repository == 'pingdotgg/t3code' && ((github.event_name == 'schedule' && vars.PAUSE_NIGHTLY != 'true') || needs.preflight.outputs.release_channel == 'nightly') }}
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          sparse-checkout: .github/scripts
+
+      - id: feed
+        name: Read the update feed
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          retries: 3
+          script: |
+            const { readNightlyUpdateFeed } = require('./.github/scripts/check-nightly-release.cjs');
+            const { tag, pointerTag, feedNightly, feedTags } = await readNightlyUpdateFeed({ github, context });
+            if (!tag) return;
+            core.info(`Newest nightly: ${tag}. Pointer: ${pointerTag}. Feed: ${feedTags?.join(', ')}.`);
+            core.setOutput('tag', tag);
+            core.setOutput('pointer_stale', pointerTag !== tag);
+            core.setOutput('feed', feedTags === undefined ? 'unreadable' : feedNightly === tag ? 'ok' : 'hidden');
+
+      - name: Point the update feed at the newest nightly
+        if: steps.feed.outputs.pointer_stale == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_TAG: ${{ steps.feed.outputs.tag }}
+        run: |
+          gh api "repos/$GH_REPO/releases/tags/$RELEASE_TAG" --jq '{tag_name, name, body}' > nightly.json
+          gh release view update-feed > /dev/null 2>&1 ||
+            gh release create update-feed --prerelease --latest=false --title "Update feed" \
+              --notes "The desktop updater reads this release to find the newest nightly. Do not delete it. See docs/operations/release.md."
+          gh release upload update-feed nightly.json --clobber
+
+      # Every run, because the pointer can be current while the release's flags are wrong. A draft's
+      # files are not public, and a release marked "latest" is the one stable installs update to.
+      - name: Keep the update feed release public and never latest
+        if: steps.feed.outputs.tag != ''
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: gh release edit update-feed --draft=false --prerelease --latest=false
+
+      # An unreadable feed says nothing about its tags and the next tick reads it again, so only a
+      # feed that was read and names another nightly first fails the run.
+      - name: Fail when the feed hides the newest nightly
+        if: steps.feed.outputs.tag != '' && steps.feed.outputs.feed != 'ok'
+        env:
+          RELEASE_TAG: ${{ steps.feed.outputs.tag }}
+          FEED: ${{ steps.feed.outputs.feed }}
+        run: |
+          if [[ "$FEED" == "unreadable" ]]; then
+            echo "::warning::releases.atom could not be read, so this run did not check it."
+            exit 0
+          fi
+          echo "::error::The first nightly in releases.atom is not $RELEASE_TAG. Nightly installs older than 0.1.10-nightly.20261112.4603 cannot reach it, and neither can later builds that do not read the pointer when the feed names an older nightly. A preview from a branch not rebased onto main is the usual cause. See docs/operations/release.md#update-feed."
+          exit 1
+
   # The `t3` npm package is a launcher that downloads this version's CLI
   # archive from the GitHub Release, so it publishes only once that release
-  # exists. Preview publishes too, under the `preview` dist-tag, which
-  # nothing resolves unless asked for by name.
+  # exists. A preview release stays a draft, whose files are not public, so
+  # a preview never publishes the launcher.
   publish_cli:
     name: Publish CLI to npm
     needs: [preflight, build_bundle, release]
-    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.release.result == 'success' }}
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.release.result == 'success' && needs.preflight.outputs.release_channel != 'preview' }}
     runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 15
     permissions:

.gitignore

@@ -50,3 +50,5 @@ node_modules/
 # pnpm content-addressable store; never belongs in the repo.
 .pnpm-store/
 .vitest/
+
+/packages/ssh/.ssh-launcher-test-*/

AGENTS.md

@@ -83,7 +83,8 @@ The most common defect in this repo is a change that works on the path you teste
 - Ports derive from the worktree path and are stable across restarts, but read the real ones from the `[dev-runner]` line since occupied ports shift.
 - Sharing over the tailnet is three steps: run `vp run dev --share` in the background, wait for the `pairingUrl:` line in its output, then give that full URL to an unpaired browser. Do not wire up `tailscale serve` by hand, open the URL yourself, or consume the user's pairing link. A browser with the reusable dev cookie can use the bare origin. If a normal one-time token was consumed, mint a fresh one with `node apps/server/src/bin.ts pair`. It carries standard scopes, while the startup URL carries admin scopes needed for Connections settings.
 - To reuse web dev auth across worktrees, configure one fixed `T3CODE_DEV_AUTH_TOKEN` in the main checkout's gitignored `.env`. The `t3.json` setup links that file into worktrees. Never commit or publish the token or a startup URL. See [Reusable dev credential](docs/operations/development.md#reusable-dev-credential).
-- Stop what you started, by the PID you tracked. See rule 1.
+- Stop what you started, by the PID you tracked. See rule 1. `vp` does not pass SIGTERM on, so signalling the `vp run dev` PID alone leaves Vite and the server running. Stop the background task with your harness's own stop, which ends the whole tree.
+- Run dev servers, Metro, and builds from your own shell so they end with your session. Do not detach them with `systemd-run`, `nohup`, `setsid`, or `tmux` unless the user asks for one that outlives the session. Detached servers ran for weeks and filled RAM and swap. The dev runner stops itself above `--memory-limit-gb` (half of RAM, at most 16 GiB) on Linux.
 - Need a second checkout? `git worktree add` it next to this worktree, not in `/tmp`. Remove it when done.
 
 ## Test data
@@ -150,7 +151,7 @@ For mobile verification, a missing or outdated native client is an install step,
 
 - Never make a PR unless the developer explicitly asks you to do so.
 - PRs target this fork (`TrogonStack/t3code`), never `pingdotgg/t3code`, unless the developer asks for the change to go upstream.
-- If `origin` is git.cafe, follow [GitCafe mirror](docs/operations/development.md#gitcafe-mirror-optional): push to `origin`, open and track PRs with `cafe` and their git.cafe URLs, and keep `gh` for merging.
+- `origin` is not always GitHub. Check `git remote get-url origin` before your first forge command and use that forge's CLI and skill. See [Forge mirror](docs/operations/development.md#forge-mirror-optional).
 - Conventional commit titles, plain language: `fix(web): new threads no longer spike CPU`.
 - Body: the problem in a sentence or two, then how you fixed it.
 - UI changes need before/after images. Motion or timing needs a short video.