fix: Codex account switch releases the conversation, Reset usage on the limit banner

.github/actions/server-ci/action.yml

@@ -0,0 +1,36 @@
+name: Server CI
+description: Run the server suite on a hosted shard or an isolated Linux worker.
+inputs:
+  shard:
+    description: Optional Vitest shard, such as 1/8
+    default: ""
+  max-workers:
+    description: Optional Vitest worker limit
+    default: ""
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-ci-deps
+    - name: Setup Rust
+      uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87
+      with:
+        toolchain: stable
+    - name: Install Chromium
+      shell: bash
+      run: node apps/server/node_modules/playwright-core/cli.js install --with-deps --only-shell chromium
+    - name: Test server
+      shell: bash
+      env:
+        TEST_SHARD: ${{ inputs.shard }}
+        MAX_WORKERS: ${{ inputs.max-workers }}
+      run: |
+        args=()
+        if [[ -n "$TEST_SHARD" ]]; then
+          [[ "$TEST_SHARD" =~ ^[1-9][0-9]*/[1-9][0-9]*$ ]]
+          args+=(--shard "$TEST_SHARD")
+        fi
+        if [[ -n "$MAX_WORKERS" ]]; then
+          [[ "$MAX_WORKERS" =~ ^[1-9][0-9]*$ ]]
+          args+=(--maxWorkers "$MAX_WORKERS")
+        fi
+        vp run --filter t3 test "${args[@]}"

.github/actions/setup-apt-mirrors/action.yml

@@ -5,17 +5,16 @@ runs:
   steps:
     - shell: bash
       run: |
-        # Replace the existing Blacksmith mirror list as well as direct sources.
         printf '%s\tpriority:%s\n' \
           https://archive.ubuntu.com/ubuntu 1 \
           https://mirrors.edge.kernel.org/ubuntu 2 \
           https://mirror.math.princeton.edu/pub/ubuntu 3 \
-          | sudo tee /etc/apt/blacksmith-ubuntu-mirrors.txt > /dev/null
+          | sudo tee /etc/apt/ci-ubuntu-mirrors.txt > /dev/null
 
         # APT's mirror transport retries each file against the next server.
         sudo find /etc/apt -maxdepth 2 -type f \( -name '*.list' -o -name '*.sources' \) \
           -exec sed -i -E \
-          's#https?://(([^/]+\.)?archive|security)\.ubuntu\.com/ubuntu/?#mirror+file:/etc/apt/blacksmith-ubuntu-mirrors.txt#g' {} +
+          's#https?://(([^/]+\.)?archive|security)\.ubuntu\.com/ubuntu/?#mirror+file:/etc/apt/ci-ubuntu-mirrors.txt#g' {} +
 
         # Move on to a fallback before an unreachable server exhausts the job.
         printf '%s\n' 'Acquire::http::Timeout "15";' 'Acquire::https::Timeout "15";' \

.github/actions/setup-ci-deps/action.yml

@@ -48,8 +48,13 @@ runs:
       if: steps.vp_cache.outputs.cache-hit == 'true'
       shell: bash
       run: |
-        echo "$HOME/.vite-plus/bin" >> "$GITHUB_PATH"
-        "$HOME/.vite-plus/bin/vp" env use "${{ steps.vp.outputs.node }}"
+        vp_bin="$HOME/.vite-plus/bin"
+        if [[ "$RUNNER_OS" == "Windows" ]]; then
+          cygpath -w "$vp_bin" >> "$GITHUB_PATH"
+        else
+          echo "$vp_bin" >> "$GITHUB_PATH"
+        fi
+        "$vp_bin/vp" env use "${{ steps.vp.outputs.node }}"
 
     # vp gives each Node.js download attempt 10 minutes by default, so one
     # stalled stream holds the job that long. It retries 3 times and resumes
@@ -85,10 +90,7 @@ runs:
 
     # Filtered installs prefer the current full store, which holds every package,
     # over an older store of their own.
-    # The pnpm store stays a cache tarball on the runner's own disk. A store on a
-    # Blacksmith sticky disk mounts in under a second, but pnpm then copies every
-    # package across filesystems instead of hard-linking it: install took 28-49s
-    # against 9s plus an 11s restore.
+    # Keep the pnpm store on the workspace filesystem so installs can hard-link packages.
     - name: Restore pnpm store
       id: pnpm_cache
       if: inputs.install == 'true'

.github/scripts/check-runner-labels.py

@@ -0,0 +1,141 @@
+"""Keep workflow runner selection on hosted pools.
+
+This repository has no self-hosted runners. Pull requests from forks can propose
+workflow changes, and a workflow that selects a private runner would put
+untrusted code on hardware that holds credentials and reaches the internal
+network. Every `runs-on` value must name a standard GitHub-hosted image.
+
+Two modes:
+
+    check-runner-labels.py
+        Scan `.github/workflows/*.yml` and fail on `self-hosted` or a
+        private-runner label (`linux-runner`, `windows-runner`,
+        `macos-runner`, `bench-*`). Comments are ignored.
+
+    check-runner-labels.py --runner LABEL [--verify-runner LABEL]
+        Validate labels passed to a reusable workflow, where the static scan
+        cannot see through `${{ inputs.runner }}`.
+"""
+
+import argparse
+import os
+import re
+import sys
+from pathlib import Path
+
+WORKFLOWS_DIR = Path(__file__).resolve().parent.parent / "workflows"
+
+# Excludes paid larger runners and third-party pools.
+HOSTED_LABEL = re.compile(r"^(?:ubuntu-(?:latest|22\.04|24\.04|26\.04)(?:-arm)?|macos-(?:latest|14|15|26)(?:-intel)?|windows-(?:latest|2022|2025|11-arm))$")
+
+# Runner labels that name hardware this account owns. `-runner` is a stronger
+# signal than `-hosted`, so a label such as `linux-runner` is private by
+# construction; `self-hosted` is GitHub's own selector.
+PRIVATE_LABEL_HINT = ("self-hosted", "-runner")
+
+# What the static scan looks for in workflow text: GitHub's self-hosted
+# selector, the private labels this repository used to have, and the `bench-*`
+# capacity pool. `android-emulator-runner` and other action names do not match.
+FORBIDDEN_REFERENCE = re.compile(
+    r"blacksmith-[a-z0-9.-]+|self-hosted|\b(?:linux|windows|macos)-runner\b|\bbench-[a-z0-9][a-z0-9.-]*"
+)
+
+
+def strip_comment(line):
+    """Drop a trailing YAML comment without touching quoted `#` characters."""
+    quote = None
+    for index, char in enumerate(line):
+        if quote:
+            if char == quote:
+                quote = None
+        elif char in ("'", '"'):
+            quote = char
+        elif char == "#" and (index == 0 or line[index - 1] in " \t"):
+            return line[:index]
+    return line
+
+
+def scan_workflows(workflows_dir=WORKFLOWS_DIR):
+    """Return one message per workflow line that references a private runner."""
+    problems = []
+    paths = sorted(workflows_dir.glob("*.yml")) + sorted(workflows_dir.glob("*.yaml"))
+    for path in paths:
+        for number, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
+            code = strip_comment(line)
+            match = FORBIDDEN_REFERENCE.search(code)
+            if match:
+                problems.append(
+                    f"{path.name}:{number}: references private runner {match.group(0)!r}: "
+                    f"{code.strip()}"
+                )
+    return problems
+
+
+def check_label(name, label, required):
+    """Return a message when `label` is empty-but-required or not a hosted pool."""
+    if not label:
+        if required:
+            return f"inputs.{name} is empty; this workflow needs a hosted runner label"
+        return None
+    if any(hint in label for hint in PRIVATE_LABEL_HINT) or not HOSTED_LABEL.match(label):
+        return (
+            f"inputs.{name}={label!r} is not a hosted runner label; "
+            "use a standard GitHub-hosted Ubuntu, macOS or Windows image"
+        )
+    return None
+
+
+def check_labels(runner, verify_runner):
+    """Validate the runner inputs of a reusable workflow."""
+    problems = [
+        message
+        for message in (
+            check_label("runner", runner, required=True),
+            check_label("verify_runner", verify_runner, required=False),
+        )
+        if message
+    ]
+    return problems
+
+
+def report(message):
+    prefix = "::error::" if os.environ.get("GITHUB_ACTIONS") else "error: "
+    print(f"{prefix}{message}", file=sys.stderr)
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument(
+        "--runner",
+        help="runner input of a reusable workflow; validates labels instead of scanning",
+    )
+    parser.add_argument(
+        "--verify-runner",
+        help="optional verify_runner input; empty means the workflow has no verify job",
+    )
+    parser.add_argument(
+        "--workflows-dir",
+        type=Path,
+        default=WORKFLOWS_DIR,
+        help=f"directory to scan (default: {WORKFLOWS_DIR})",
+    )
+    args = parser.parse_args(argv)
+
+    if args.runner is None and args.verify_runner is None:
+        problems = scan_workflows(args.workflows_dir)
+        checked = "workflow runner references"
+    else:
+        # A caller may pass neither flag through the shell, so both are checked.
+        problems = check_labels(args.runner or "", args.verify_runner or "")
+        checked = "runner inputs"
+
+    for problem in problems:
+        report(problem)
+    if problems:
+        return 1
+    print(f"All {checked} name hosted runner pools.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.github/scripts/check-runner-labels.test.py

@@ -0,0 +1,109 @@
+import importlib.util
+import tempfile
+import unittest
+from pathlib import Path
+
+spec = importlib.util.spec_from_file_location(
+    "check_runner_labels", Path(__file__).with_name("check-runner-labels.py")
+)
+labels = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(labels)
+
+
+class ScanWorkflowsTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.workflows = Path(self.temp.name)
+
+    def scan(self, filename, text):
+        (self.workflows / filename).write_text(text, encoding="utf-8")
+        return labels.scan_workflows(self.workflows)
+
+    def test_accepts_hosted_pools(self):
+        self.assertEqual(self.scan("build.yml", """
+            jobs:
+              build:
+                runs-on: ubuntu-24.04
+              verify:
+                runs-on: windows-11-arm
+              lint:
+                runs-on: ubuntu-24.04-arm
+              mac:
+                runs-on: macos-26
+        """), [])
+
+    def test_rejects_self_hosted(self):
+        problems = self.scan("build.yml", "        runs-on: [self-hosted, linux]\n")
+        self.assertEqual(len(problems), 1)
+        self.assertIn("build.yml:1", problems[0])
+        self.assertIn("self-hosted", problems[0])
+
+    def test_rejects_private_runner_labels(self):
+        for label in ("linux-runner", "windows-runner", "macos-runner", "bench-32vcpu", "blacksmith-8vcpu-ubuntu-2404"):
+            with self.subTest(label=label):
+                self.workflows.joinpath("build.yml").unlink(missing_ok=True)
+                problems = self.scan("build.yml", f"        runs-on: {label}\n")
+                self.assertEqual(len(problems), 1, problems)
+
+    def test_rejects_matrix_values(self):
+        problems = self.scan("release.yml", """
+            strategy:
+              matrix:
+                runner: [ubuntu-24.04, bench-arm64]
+            runs-on: ${{ matrix.runner }}
+        """)
+        self.assertEqual(len(problems), 1)
+        self.assertIn("bench-arm64", problems[0])
+
+    def test_ignores_comments_and_action_names(self):
+        self.assertEqual(self.scan("notes.yml", """
+            # A private runner would be self-hosted or linux-runner.
+            jobs:
+              emulator:
+                runs-on: ubuntu-24.04
+                steps:
+                  - uses: reactivecircus/android-emulator-runner@v2
+        """), [])
+
+    def test_ignores_trailing_comments(self):
+        self.assertEqual(self.scan("build.yml", "runs-on: ubuntu-24.04 # not self-hosted\n"), [])
+
+    def test_strip_comment_keeps_hash_inside_quotes(self):
+        self.assertEqual(
+            labels.strip_comment('run: echo "a # b" # mentions linux-runner'),
+            'run: echo "a # b" ',
+        )
+
+
+class CheckLabelsTests(unittest.TestCase):
+    def test_accepts_hosted_labels(self):
+        self.assertEqual(
+            labels.check_labels("ubuntu-24.04", "windows-2025"), []
+        )
+        self.assertEqual(labels.check_labels("ubuntu-24.04-arm", ""), [])
+
+    def test_rejects_private_labels(self):
+        for label in ("self-hosted", "linux-runner", "bench-32vcpu", "macos-26-runner", "blacksmith-8vcpu-ubuntu-2404", "macos-15-large", "macos-15-xlarge"):
+            with self.subTest(label=label):
+                problems = labels.check_labels(label, "")
+                self.assertEqual(len(problems), 1, problems)
+                self.assertIn("inputs.runner", problems[0])
+
+    def test_rejects_verify_runner_on_a_private_pool(self):
+        problems = labels.check_labels("ubuntu-24.04", "linux-runner")
+        self.assertEqual(len(problems), 1)
+        self.assertIn("inputs.verify_runner", problems[0])
+
+    def test_requires_runner_but_not_verify_runner(self):
+        self.assertEqual(len(labels.check_labels("", "")), 1)
+        self.assertIn("inputs.runner is empty", labels.check_labels("", "")[0])
+
+
+class MainTests(unittest.TestCase):
+    def test_scan_mode_passes_on_the_repository_workflows(self):
+        self.assertEqual(labels.scan_workflows(), [])
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/scripts/ci-changes.cjs

@@ -24,13 +24,14 @@ const EXTRA_OWNERS = [
   [/^scripts\/lib\//, ["@t3tools/desktop", "@t3tools/mobile", "@t3tools/web", "t3"]],
   // scripts/build-desktop-artifact.ts reads the GNOME extension manifest.
   [/^apps\/desktop\/gnome-extension\//, ["@t3tools/scripts"]],
+  [/^native\/project-memory\//, ["t3"]],
   [/^native\/browser-secret\//, ["@t3tools/desktop"]],
   [/^native\/kde-snap-shot\//, ["@t3tools/desktop"]],
   [/^native\/libghostty-vt\//, ["@t3tools/web"]],
   // apps/server/src/cloud/ConnectReachability.test.ts checks the guide's headings.
   [/^docs\/user\/t3-connect-troubleshooting\.md$/, ["t3"]],
 ];
-const RUST = /^native\/(resource-monitor|kde-snap-shot|hyprland-snap-shot)\//;
+const RUST = /^native\/(resource-monitor|kde-snap-shot|hyprland-snap-shot|project-memory)\//;
 
 // These tests read other packages without declaring dependencies.
 const TEST_ONLY_DEPS = {
@@ -49,7 +50,7 @@ const TEST_ONLY_DEPS = {
 const BUILD_ONLY_DEPS = { t3: ["@t3tools/web"] };
 
 const MOBILE_NATIVE =
-  /^apps\/mobile\/.*\.(swift|kt|kts)$|^apps\/mobile\/(\.swiftlint\.yml|detekt\.yml|\.editorconfig|Brewfile)$|^scripts\/mobile-native-static-check\.ts$|^package\.json$|^\.github\/workflows\/ci\.yml$|^\.github\/scripts\/ci-changes\.cjs$|^\.github\/actions\/ci-changes\//;
+  /^apps\/mobile\/.*\.(swift|kt|kts)$|^apps\/mobile\/(\.swiftlint\.yml|detekt\.yml|\.editorconfig|Brewfile)$|^scripts\/mobile-native-static-check\.ts$|^package\.json$|^\.github\/workflows\/(fork-)?ci\.yml$|^\.github\/scripts\/ci-changes\.cjs$|^\.github\/actions\/ci-changes\//;
 
 const OWN_TEST_JOB = new Set(["t3", "@t3tools/web", "@t3tools/monorepo"]);