chore: sync with upstream pingdotgg/t3code main

.agents/skills/test-t3-mobile/SKILL.md

@@ -43,10 +43,15 @@ prints one JSON line; on failure it names the next command. Mobile verification
 includes that step unless the user prohibits it.
 
 For a device you opened in an agent-device session elsewhere (a device pool,
-cloud, or remote host), run `vp run mobile:install <ios|android> --session <s>`
-from the directory you opened the session in. It installs the cached build into
-that session (`--abi arm64-v8a` for an ARM Android device; `--metro <url>` also
-opens it against Metro) and never builds.
+cloud, or remote host), run `vp run mobile:install <ios|android> --session <s>
+--config <file>` from the directory you opened the session in, passing the
+`--config` file from `device_open`'s `targetArgs`. Without it, a device pool's
+gateway refuses the install, wrongly saying agent-device is too old. It installs
+the cached build into that session (`--abi arm64-v8a` for an ARM Android device;
+pool Android emulators are x86_64, the default; `--metro <url>` also opens it
+against Metro). Without a cached build for this checkout it builds first, which can
+outlast the lease, so run `vp run mobile:install <ios|android> --prepare` (with
+the same `--abi`) before you open the device.
 
 Start `vp run dev:client` from `apps/mobile`, or reuse a healthy Metro belonging
 to this checkout. Open its printed development-client URL with AgentDevice

.github/VOUCHED.td

@@ -22,6 +22,7 @@ github:btsouth
 github:cestercian
 github:chrisdeeming
 github:chuks-qua
+-github:coygeek Filed over 270 automated issues, about 50 a day at peak, far past what maintainers can triage
 github:cursoragent
 github:D3OXY
 github:dbalders

.github/workflows/agent-context-budget.yml

@@ -10,10 +10,7 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: agent-context-budget-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
+# No concurrency group: label events arrive in bursts, and a cancelled run reports as a failed check.
 jobs:
   budget:
     name: Agent context budget

.github/workflows/desktop-macos-preview-publish.yml

@@ -316,6 +316,7 @@ jobs:
       rust_target: aarch64-apple-darwin
       resource_key: darwin-arm64
       cli_archive: false
+      untrusted_bundle: true
 
   # Release assets download without a GitHub account, unlike workflow
   # artifacts. All preview DMGs live on one rolling prerelease tagged

.github/workflows/issue-vouch.yml

@@ -0,0 +1,77 @@
+name: Issue Vouch
+
+on:
+  issues:
+    types: [opened, reopened]
+  push:
+    branches:
+      - main
+    paths:
+      - .github/VOUCHED.td
+      - .github/workflows/issue-vouch.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+concurrency:
+  group: issue-vouch-${{ github.event.issue.number || 'all' }}
+  cancel-in-progress: true
+
+jobs:
+  label:
+    name: Label issues by author trust
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            // Only listed authors get a label; open issues number in the thousands,
+            // so unvouched is the default and stays unlabelled.
+            const labelByStatus = { vouched: "vouch:trusted", denounced: "vouch:denounced" };
+            const managedLabelNames = new Set(["vouch:trusted", "vouch:unvouched", "vouch:denounced"]);
+
+            const { data: file } = await github.rest.repos.getContent({
+              owner,
+              repo,
+              path: ".github/VOUCHED.td",
+              ref: context.payload.repository.default_branch,
+            });
+            const statusByUser = new Map();
+            for (const raw of Buffer.from(file.content, "base64").toString("utf8").split("\n")) {
+              const match = /^(-?)github:(\S+)/.exec(raw.trim());
+              if (match) statusByUser.set(match[2].toLowerCase(), match[1] ? "denounced" : "vouched");
+            }
+
+            const issues =
+              context.eventName === "issues"
+                ? [context.payload.issue]
+                : (
+                    await github.paginate(github.rest.issues.listForRepo, {
+                      owner,
+                      repo,
+                      state: "open",
+                      per_page: 100,
+                    })
+                  ).filter((issue) => !issue.pull_request);
+
+            for (const issue of issues) {
+              const status = statusByUser.get(issue.user.login.toLowerCase());
+              const next = labelByStatus[status];
+              const current = issue.labels.map((label) => label.name).filter((name) => managedLabelNames.has(name));
+
+              for (const name of current) {
+                if (name === next) continue;
+                try {
+                  await github.rest.issues.removeLabel({ owner, repo, issue_number: issue.number, name });
+                } catch (error) {
+                  if (error.status !== 404) throw error;
+                }
+              }
+              if (next && !current.includes(next)) {
+                await github.rest.issues.addLabels({ owner, repo, issue_number: issue.number, labels: [next] });
+                core.info(`Issue #${issue.number} (${issue.user.login}): ${status} -> ${next}`);
+              }
+            }

.github/workflows/mobile-eas-production.yml

@@ -673,8 +673,8 @@ jobs:
           echo ":rocket: android: submitted and recorded \`$BUILD_TAG\`" >> "$GITHUB_STEP_SUMMARY"
 
   # Off unless the MOBILE_IOS_LOCAL_BUILDS repository variable is `true`; the
-  # production job only sets ios_build then. Store binaries need the final
-  # Xcode 27.1; MOBILE_IOS_ALLOW_XCODE_RC=true accepts the release candidate.
+  # production job only sets ios_build then. Xcode 27.1 matches the EAS build
+  # image in eas.json.
   # No sticky disk: it mounts ext4 and only works on Linux runners.
   ios:
     name: iOS store build
@@ -694,7 +694,6 @@ jobs:
       EXPO_TOKEN: ${{ secrets.EXPO_PRODUCTION_TOKEN }}
       PROFILE: ${{ needs.production.outputs.ios_profile }}
       BUILD_TAG: mobile-ios-build/${{ needs.production.outputs.ios_profile }}/${{ needs.production.outputs.ios_version }}/${{ needs.production.outputs.ios_fingerprint }}
-      ALLOW_XCODE_RC: ${{ vars.MOBILE_IOS_ALLOW_XCODE_RC == 'true' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
@@ -732,12 +731,9 @@ jobs:
         if: steps.record.outputs.built != 'true'
         run: |
           xcode=/Applications/Xcode_27.1.app
-          if [ ! -d "$xcode" ] && [ "$ALLOW_XCODE_RC" = "true" ]; then
-            xcode=/Applications/Xcode_27.1_Release_Candidate.app
-          fi
           if [ ! -d "$xcode" ]; then
             ls -d /Applications/Xcode*.app
-            echo "::error::Xcode 27.1 (final) is not on this runner. Set the MOBILE_IOS_ALLOW_XCODE_RC repository variable to true to build store binaries with the release candidate."
+            echo "::error::Xcode 27.1 is not on this runner."
             exit 1
           fi
           sudo xcode-select -s "$xcode/Contents/Developer"

.github/workflows/pr-vouch.yml

@@ -101,17 +101,17 @@ jobs:
               {
                 name: "vouch:trusted",
                 color: "1f883d",
-                description: "PR author is trusted by repo permissions or the VOUCHED list.",
+                description: "Author is trusted by repo permissions or the VOUCHED list.",
               },
               {
                 name: "vouch:unvouched",
                 color: "fbca04",
-                description: "PR author is not yet trusted in the VOUCHED list.",
+                description: "Author is not yet trusted in the VOUCHED list.",
               },
               {
                 name: "vouch:denounced",
                 color: "d1242f",
-                description: "PR author is explicitly blocked by the VOUCHED list.",
+                description: "Author is explicitly blocked by the VOUCHED list.",
               },
             ];
 

.github/workflows/release-desktop.yml

@@ -70,6 +70,12 @@ on:
         required: false
         default: false
         type: boolean
+      # Whether the JS bundle came from a pull request. This job holds the
+      # signing secrets, so packaging then skips every step that runs the bundle.
+      untrusted_bundle:
+        required: false
+        default: false
+        type: boolean
       # A runner of the target's own platform and architecture, for a `runner`
       # that cannot execute the target. The build job skips everything that
       # runs the packaged binaries, and a second job runs it there.
@@ -134,6 +140,14 @@ jobs:
       T3CODE_CLERK_CLI_OAUTH_CLIENT_ID: ${{ inputs.clerk_cli_oauth_client_id }}
       T3CODE_RELAY_URL: ${{ inputs.relay_url }}
     steps:
+      # The launch check and the CLI archive smoke test both run the bundle.
+      - name: Reject running an untrusted bundle
+        if: inputs.untrusted_bundle && (inputs.launch_check || inputs.cli_archive)
+        shell: bash
+        run: |
+          echo "::error::untrusted_bundle cannot be combined with launch_check or cli_archive, which run the bundle."
+          exit 1
+
       # This repository is public, so Git needs no credentials. checkout's
       # credential cleanup runs submodule foreach even with submodules disabled,
       # which fails on the orphaned gitlinks in our vendored .repos tree.
@@ -573,6 +587,7 @@ jobs:
           pnpm_config_prefer_offline: "true"
           T3CODE_DESKTOP_REUSE_RESOURCE_MONITOR: true
           T3CODE_DESKTOP_REUSE_LINUX_CAPTURE_HELPERS: ${{ steps.capture_helper_cache.outputs.cache-hit == 'true' }}
+          T3CODE_DESKTOP_UNTRUSTED_BUNDLE: ${{ inputs.untrusted_bundle }}
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
           APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}

.github/workflows/release.yml

@@ -903,34 +903,12 @@ jobs:
           fi
 
       # electron-updater reads one manifest per platform and channel and picks
-      # the file entry whose name carries the running arch, so the per-arch
-      # manifests the build jobs wrote are merged back into that one file.
-      - name: Merge macOS updater manifests
+      # the file entry whose name carries the running arch. Require every
+      # platform's two build jobs to have produced matching metadata before
+      # merging it, so a successful release can never strand one architecture.
+      - name: Merge desktop updater manifests
         if: needs.preflight.outputs.release_channel != 'preview'
-        run: |
-          shopt -s nullglob
-          for x64_manifest in release-assets/*-mac-x64.yml; do
-            arm64_manifest="${x64_manifest%-x64.yml}.yml"
-            if [[ -f "$arm64_manifest" ]]; then
-              node scripts/merge-update-manifests.ts --platform mac "$arm64_manifest" "$x64_manifest"
-              rm -f "$x64_manifest"
-            fi
-          done
-
-      - name: Merge Windows updater manifests
-        if: needs.preflight.outputs.release_channel != 'preview'
-        run: |
-          shopt -s nullglob
-          for x64_manifest in release-assets/*-win-x64.yml; do
-            arm64_manifest="${x64_manifest%-x64.yml}-arm64.yml"
-            merged_manifest="${x64_manifest%-win-x64.yml}.yml"
-            if [[ -f "$arm64_manifest" ]]; then
-              node scripts/merge-update-manifests.ts --platform win "$x64_manifest" "$arm64_manifest" "$merged_manifest"
-              rm -f "$x64_manifest" "$arm64_manifest"
-            else
-              mv "$x64_manifest" "$merged_manifest"
-            fi
-          done
+        run: node scripts/merge-release-update-manifests.ts release-assets
 
       # Updater manifests and blockmaps are what electron-updater consumes.
       # They are only listed for channels an updater is meant to follow.
@@ -1054,7 +1032,7 @@ jobs:
     name: Check the update feed
     needs: [preflight, release]
     if: ${{ !cancelled() && github.repository == 'pingdotgg/t3code' && ((github.event_name == 'schedule' && vars.PAUSE_NIGHTLY != 'true') || needs.preflight.outputs.release_channel == 'nightly') }}
-    runs-on: blacksmith-2vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:
       contents: write

AGENTS.md

@@ -1,6 +1,6 @@
 # T3 Code
 
-T3 Code is a minimal GUI for coding agents. A Node WebSocket server wraps provider CLIs and agents (Codex, Claude Code, Cursor, Grok, OpenCode, Antigravity, Kiro) and serves web, desktop, and mobile clients.
+T3 Code is a minimal GUI for coding agents. A Node WebSocket server wraps provider CLIs and agents (Codex, Claude Code, Cursor, Grok, OpenCode, Antigravity, Kiro, Pi, Muse Code, fx) and serves web, desktop, and mobile clients.
 
 You can think of T3 Code as an open source "bring-your-own-subscription" alternative to apps like Claude Desktop, Codex App, Cursor Glass and Conductor.
 
@@ -68,7 +68,7 @@ The most common defect in this repo is a change that works on the path you teste
 
 - **Entry points.** A behavior reachable from the chat view is usually also reachable from Settings, the command palette, and a keybinding. Fixing one is not fixing the feature.
 - **Clients.** Web, desktop (wraps web, adds Electron shell/IPC), and mobile (React Native, separate navigation). Shared logic lives in `packages/client-runtime`
-- **Providers.** Codex, Claude, Cursor, Grok, OpenCode, Antigravity, and Kiro each have an adapter. Provider-shaped features need a decision per adapter, even if the decision is "not supported here".
+- **Providers.** Codex, Claude, Cursor, Grok, OpenCode, Antigravity, Kiro, Pi, Muse Code, fx, and ACP Registry each have an adapter. Provider-shaped features need a decision per adapter, even if the decision is "not supported here".
 - **Agents.** A capability a user can trigger is usually one an agent should reach through MCP tools, and scheduled tasks run the same paths. That only works when it is a service method, not handler code.
 - **Contracts.** Anything crossing the wire is typed in `packages/contracts`. Change the schema and the server, web, mobile, and desktop all follow.
 - **Reverse states.** If you added a way in, add the way out and the way to see it. Snooze needs unsnooze. Close needs reopen. A one-way door is a bug.

apps/desktop/scripts/dev-electron.mjs

@@ -138,7 +138,7 @@ function matchDevBackends(command, args) {
   return (
     NodeChildProcess.spawnSync(command, [...args, "-f", "--", devBackendPattern(desktopDir)], {
       stdio: "ignore",
-    }).status === 0
+    })?.status === 0
   );
 }
 

apps/desktop/scripts/electron-launcher.test.mjs

@@ -172,7 +172,7 @@ async function startupCleanupPattern(desktopDir) {
   await runDevElectronStartup({
     desktopDir,
     spawnSync: (command, args) => {
-      if (command === "pkill" && args.includes("-f")) pattern = args.at(-1);
+      if (command === "pkill" && args.includes("-f")) pattern ??= args.at(-1);
     },
   });
   assert.isString(pattern);

apps/desktop/scripts/ensure-electron-runtime.mjs

@@ -209,6 +209,10 @@ export function ensureElectronRuntime() {
   return electronPath;
 }
 
+export function setup() {
+  ensureElectronRuntime();
+}
+
 // `file://${argv[1]}` never matches on Windows (drive letters need `file:///C:/`).
 if (process.argv[1] && NodeURL.pathToFileURL(process.argv[1]).href === import.meta.url) {
   const electronPath = ensureElectronRuntime();

apps/desktop/src/app/DesktopApp.test.ts

@@ -86,6 +86,7 @@ it.effect.each([false, true])(
       const historyStarted = yield* Deferred.make<void>();
       const releaseHistory = yield* Deferred.make<void>();
       const quitting = yield* Ref.make(false);
+      const tokenRequested = yield* Deferred.make<void>();
       const events: string[] = [];
       const record = (event: string) =>
         Effect.sync(() => {
@@ -144,7 +145,7 @@ it.effect.each([false, true])(
             configure: Effect.void,
           } as PreviewPasskeys.PreviewPasskeys["Service"]),
           Effect.provideService(DesktopApplicationMenu.DesktopApplicationMenu, {
-            configure: Effect.void,
+            configure: record("menu"),
           }),
           Effect.provideService(DesktopUpdates.DesktopUpdates, {
             configure: Effect.void,
@@ -222,7 +223,12 @@ it.effect.each([false, true])(
             Layer.mock(DesktopClientSettings.DesktopClientSettings, {}),
             Layer.mock(DesktopConnectionCatalogStore.DesktopConnectionCatalogStore, {}),
             Layer.mock(DesktopIpc.DesktopIpc, {}),
-            Layer.mock(DesktopLocalEnvironmentAuth.DesktopLocalEnvironmentAuth, {}),
+            Layer.mock(DesktopLocalEnvironmentAuth.DesktopLocalEnvironmentAuth, {
+              getBearerToken: record("token").pipe(
+                Effect.andThen(Deferred.succeed(tokenRequested, undefined)),
+                Effect.as("token"),
+              ),
+            }),
             Layer.mock(DesktopManagedPolicy.DesktopManagedPolicy, {}),
             Layer.succeed(DesktopPrimaryPaste.DesktopPrimaryPaste, { enabled: true }),
             Layer.mock(DesktopSshEnvironment.DesktopSshEnvironment, {}),
@@ -253,7 +259,13 @@ it.effect.each([false, true])(
       );
       yield* Deferred.await(registrationStarted);
       yield* Deferred.await(windowStarted);
-      assert.deepEqual(events, ["identity", "ready", "identity", "backend", "window"]);
+      yield* Deferred.await(tokenRequested);
+      // The backend spawns before menus, and its token is minted without waiting for the renderer.
+      assert.deepEqual(
+        events.filter((event) => event !== "token"),
+        ["identity", "ready", "identity", "backend", "menu", "window"],
+      );
+      assert.isAbove(events.indexOf("token"), events.indexOf("backend"));
       assert.isFalse(yield* Deferred.isDone(registrationStopped));
       const shutdown = yield* DesktopShutdown.DesktopShutdown;
       yield* shutdown.request;