fix(server): two follow-ups for responsive waits (#35641)

.agents/skills/test-t3-mobile/SKILL.md

@@ -43,10 +43,15 @@ prints one JSON line; on failure it names the next command. Mobile verification
 includes that step unless the user prohibits it.
 
 For a device you opened in an agent-device session elsewhere (a device pool,
-cloud, or remote host), run `vp run mobile:install <ios|android> --session <s>`
-from the directory you opened the session in. It installs the cached build into
-that session (`--abi arm64-v8a` for an ARM Android device; `--metro <url>` also
-opens it against Metro) and never builds.
+cloud, or remote host), run `vp run mobile:install <ios|android> --session <s>
+--config <file>` from the directory you opened the session in, passing the
+`--config` file from `device_open`'s `targetArgs`. Without it, a device pool's
+gateway refuses the install, wrongly saying agent-device is too old. It installs
+the cached build into that session (`--abi arm64-v8a` for an ARM Android device;
+pool Android emulators are x86_64, the default; `--metro <url>` also opens it
+against Metro). Without a cached build for this checkout it builds first, which can
+outlast the lease, so run `vp run mobile:install <ios|android> --prepare` (with
+the same `--abi`) before you open the device.
 
 Start `vp run dev:client` from `apps/mobile`, or reuse a healthy Metro belonging
 to this checkout. Open its printed development-client URL with AgentDevice

.github/VOUCHED.td

@@ -22,6 +22,7 @@ github:btsouth
 github:cestercian
 github:chrisdeeming
 github:chuks-qua
+-github:coygeek Filed over 270 automated issues, about 50 a day at peak, far past what maintainers can triage
 github:cursoragent
 github:D3OXY
 github:dbalders

.github/scripts/pr-limits.cjs

@@ -100,14 +100,22 @@ function parseExemptions(text) {
 }
 
 // VOUCHED.td: one `github:login` per line, `#` comments, and `-github:login reason` to denounce.
-function vouchedLogins(text) {
-  const logins = new Set();
+// A login listed both ways is an error: pr-vouch.yml's action reads its first line and
+// issue-vouch.yml its last, so no answer here would agree with both labels.
+function parseVouchList(text) {
+  const vouched = new Set();
+  const denounced = new Set();
   for (const raw of text.split("\n")) {
-    const entry = raw.trim().split(/\s+/)[0];
-    if (entry.startsWith("github:")) logins.add(entry.slice("github:".length).toLowerCase());
+    const match = /^(-?)github:(\S+)/.exec(raw.trim());
+    if (!match) continue;
+    const login = match[2].toLowerCase();
+    const [listed, other] = match[1] ? [denounced, vouched] : [vouched, denounced];
+    if (other.has(login))
+      throw new Error(`${VOUCHED_PATH}: ${login} is both vouched and denounced`);
+    listed.add(login);
   }
-  if (logins.size === 0) throw new Error(`${VOUCHED_PATH}: no entries`);
-  return logins;
+  if (vouched.size === 0) throw new Error(`${VOUCHED_PATH}: no entries`);
+  return { vouched, denounced };
 }
 
 function labeledAt(pr, name) {
@@ -278,7 +286,8 @@ async function enforceOpenLimit({ github, context, core, dryRun }) {
   // lookups as "not vouched". Every read below throws on failure, and a throw closes nothing.
   if (pr.user.type === "Bot") return;
   if (parseExemptions(fs.readFileSync(EXEMPTIONS_PATH, "utf8")).has(author.toLowerCase())) return;
-  if (vouchedLogins(fs.readFileSync(VOUCHED_PATH, "utf8")).has(author.toLowerCase())) return;
+  const { vouched, denounced } = parseVouchList(fs.readFileSync(VOUCHED_PATH, "utf8"));
+  if (vouched.has(author.toLowerCase())) return;
   const { data: access } = await github.rest.repos.getCollaboratorPermissionLevel({
     ...context.repo,
     username: author,
@@ -289,6 +298,21 @@ async function enforceOpenLimit({ github, context, core, dryRun }) {
   const reopened = context.payload.action === "reopened";
   if (reopened && context.payload.sender.login.toLowerCase() !== author.toLowerCase()) return;
 
+  if (denounced.has(author.toLowerCase())) {
+    if (dryRun) {
+      core.notice(`Dry run. PR #${pr.number} would close: ${author} is denounced.`);
+      return;
+    }
+    await closeWithComment(
+      github,
+      context,
+      pr.number,
+      `Closing: ${author} is banned from contributing here, so this PR will not be reviewed. See [bans](${guideLink(context, "bans")}).`,
+    );
+    core.info(`PR #${pr.number}: closed, ${author} is denounced.`);
+    return;
+  }
+
   const q = `repo:${context.repo.owner}/${context.repo.repo} is:pr is:open author:${author} sort:created-asc`;
   const { search } = await read(github, AUTHOR_OPEN_PRS_QUERY, { q });
   // A new PR counts only the older ones, so two opened together cannot close each other.

.github/workflows/agent-context-budget.yml

@@ -10,10 +10,7 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: agent-context-budget-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
+# No concurrency group: label events arrive in bursts, and a cancelled run reports as a failed check.
 jobs:
   budget:
     name: Agent context budget

.github/workflows/ci.yml

@@ -591,7 +591,7 @@ jobs:
     name: Mobile Native Static Analysis
     needs: changes
     if: ${{ !cancelled() && needs.changes.outputs.mobile_native != 'false' }}
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     timeout-minutes: 10
     steps:
       - name: Checkout

.github/workflows/desktop-macos-preview-publish.yml

@@ -316,6 +316,7 @@ jobs:
       rust_target: aarch64-apple-darwin
       resource_key: darwin-arm64
       cli_archive: false
+      untrusted_bundle: true
 
   # Release assets download without a GitHub account, unlike workflow
   # artifacts. All preview DMGs live on one rolling prerelease tagged

.github/workflows/issue-vouch.yml

@@ -0,0 +1,110 @@
+name: Issue Vouch
+
+on:
+  issues:
+    types: [opened, reopened]
+  push:
+    branches:
+      - main
+    paths:
+      - .github/VOUCHED.td
+      - .github/workflows/issue-vouch.yml
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+
+concurrency:
+  group: issue-vouch-${{ github.event.issue.number || 'all' }}
+  cancel-in-progress: true
+
+jobs:
+  label:
+    name: Label issues by author trust
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            // Only listed authors get a label; open issues number in the thousands,
+            // so unvouched is the default and stays unlabelled.
+            const labelByStatus = { vouched: "vouch:trusted", denounced: "vouch:denounced" };
+            const managedLabelNames = new Set(["vouch:trusted", "vouch:unvouched", "vouch:denounced"]);
+
+            const { data: file } = await github.rest.repos.getContent({
+              owner,
+              repo,
+              path: ".github/VOUCHED.td",
+              ref: context.payload.repository.default_branch,
+            });
+            const statusByUser = new Map();
+            const listedBothWays = new Set();
+            for (const raw of Buffer.from(file.content, "base64").toString("utf8").split("\n")) {
+              const match = /^(-?)github:(\S+)/.exec(raw.trim());
+              if (!match) continue;
+              const login = match[2].toLowerCase();
+              const status = match[1] ? "denounced" : "vouched";
+              if (statusByUser.has(login) && statusByUser.get(login) !== status) listedBothWays.add(login);
+              statusByUser.set(login, status);
+            }
+
+            const issues =
+              context.eventName === "issues"
+                ? [context.payload.issue]
+                : (
+                    await github.paginate(github.rest.issues.listForRepo, {
+                      owner,
+                      repo,
+                      state: "open",
+                      per_page: 100,
+                    })
+                  ).filter((issue) => !issue.pull_request);
+
+            for (const issue of issues) {
+              const status = statusByUser.get(issue.user.login.toLowerCase());
+              const next = labelByStatus[status];
+              const current = issue.labels.map((label) => label.name).filter((name) => managedLabelNames.has(name));
+
+              for (const name of current) {
+                if (name === next) continue;
+                try {
+                  await github.rest.issues.removeLabel({ owner, repo, issue_number: issue.number, name });
+                } catch (error) {
+                  if (error.status !== 404) throw error;
+                }
+              }
+              if (next && !current.includes(next)) {
+                await github.rest.issues.addLabels({ owner, repo, issue_number: issue.number, labels: [next] });
+                core.info(`Issue #${issue.number} (${issue.user.login}): ${status} -> ${next}`);
+              }
+
+              // Only a newly opened issue is closed. One filed before its author was denounced
+              // may already have a fix on the way, so the sweep leaves those to maintainers.
+              // Someone else reopening it is a maintainer keeping it open.
+              const reopenedByOther =
+                context.payload.action === "reopened" &&
+                context.payload.sender.login.toLowerCase() !== issue.user.login.toLowerCase();
+              // The PR rules refuse a list that names a login both ways, so nothing closes for one here.
+              const trusted =
+                issue.user.type === "Bot" ||
+                ["OWNER", "MEMBER", "COLLABORATOR"].includes(issue.author_association) ||
+                listedBothWays.has(issue.user.login.toLowerCase());
+              if (status === "denounced" && context.eventName === "issues" && !reopenedByOther && !trusted) {
+                await github.rest.issues.createComment({
+                  owner,
+                  repo,
+                  issue_number: issue.number,
+                  body: `Closing: ${issue.user.login} is banned from contributing here, so this issue will not be triaged. See [bans](https://github.com/${owner}/${repo}/blob/main/CONTRIBUTING.md#bans).`,
+                });
+                await github.rest.issues.update({
+                  owner,
+                  repo,
+                  issue_number: issue.number,
+                  state: "closed",
+                  state_reason: "not_planned",
+                });
+                core.info(`Issue #${issue.number}: closed, ${issue.user.login} is denounced.`);
+              }
+            }

.github/workflows/mobile-dev-client.yml

@@ -219,7 +219,7 @@ jobs:
   ios:
     name: iOS simulator
     if: github.repository == 'pingdotgg/t3code' && (github.event_name != 'workflow_dispatch' || inputs.platform == 'ios')
-    runs-on: blacksmith-12vcpu-macos-26
+    runs-on: blacksmith-12vcpu-macos-27
     timeout-minutes: 60
     concurrency:
       group: mobile-dev-client-ios-${{ github.event_name == 'pull_request' && github.event.pull_request.number || inputs.fingerprint || github.sha }}

.github/workflows/mobile-eas-production.yml

@@ -680,8 +680,8 @@ jobs:
           echo ":rocket: android: submitted and recorded \`$BUILD_TAG\`" >> "$GITHUB_STEP_SUMMARY"
 
   # Off unless the MOBILE_IOS_LOCAL_BUILDS repository variable is `true`; the
-  # production job only sets ios_build then. Store binaries need the final
-  # Xcode 27.1; MOBILE_IOS_ALLOW_XCODE_RC=true accepts the release candidate.
+  # production job only sets ios_build then. Xcode 27.1 matches the EAS build
+  # image in eas.json.
   # No sticky disk: it mounts ext4 and only works on Linux runners.
   ios:
     name: iOS store build
@@ -701,7 +701,6 @@ jobs:
       EXPO_TOKEN: ${{ secrets.EXPO_PRODUCTION_TOKEN }}
       PROFILE: ${{ needs.production.outputs.ios_profile }}
       BUILD_TAG: mobile-ios-build/${{ needs.production.outputs.ios_profile }}/${{ needs.production.outputs.ios_version }}/${{ needs.production.outputs.ios_fingerprint }}
-      ALLOW_XCODE_RC: ${{ vars.MOBILE_IOS_ALLOW_XCODE_RC == 'true' }}
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
@@ -739,12 +738,9 @@ jobs:
         if: steps.record.outputs.built != 'true'
         run: |
           xcode=/Applications/Xcode_27.1.app
-          if [ ! -d "$xcode" ] && [ "$ALLOW_XCODE_RC" = "true" ]; then
-            xcode=/Applications/Xcode_27.1_Release_Candidate.app
-          fi
           if [ ! -d "$xcode" ]; then
             ls -d /Applications/Xcode*.app
-            echo "::error::Xcode 27.1 (final) is not on this runner. Set the MOBILE_IOS_ALLOW_XCODE_RC repository variable to true to build store binaries with the release candidate."
+            echo "::error::Xcode 27.1 is not on this runner."
             exit 1
           fi
           sudo xcode-select -s "$xcode/Contents/Developer"

.github/workflows/mobile-showcase-screenshots.yml

@@ -45,7 +45,7 @@ jobs:
   ios:
     name: iPhone, iPhone Duo, and iPad 13
     if: inputs.platform == 'all' || inputs.platform == 'ios'
-    runs-on: blacksmith-12vcpu-macos-26
+    runs-on: blacksmith-12vcpu-macos-27
     # Capturing every palette multiplies the device matrix by six, and only the
     # one native build is shared between them.
     timeout-minutes: ${{ inputs.theme == 'all' && 300 || 60 }}

.github/workflows/pr-vouch.yml

@@ -101,17 +101,17 @@ jobs:
               {
                 name: "vouch:trusted",
                 color: "1f883d",
-                description: "PR author is trusted by repo permissions or the VOUCHED list.",
+                description: "Author is trusted by repo permissions or the VOUCHED list.",
               },
               {
                 name: "vouch:unvouched",
                 color: "fbca04",
-                description: "PR author is not yet trusted in the VOUCHED list.",
+                description: "Author is not yet trusted in the VOUCHED list.",
               },
               {
                 name: "vouch:denounced",
                 color: "d1242f",
-                description: "PR author is explicitly blocked by the VOUCHED list.",
+                description: "Author is explicitly blocked by the VOUCHED list.",
               },
             ];
 

.github/workflows/release-desktop.yml

@@ -70,6 +70,12 @@ on:
         required: false
         default: false
         type: boolean
+      # Whether the JS bundle came from a pull request. This job holds the
+      # signing secrets, so packaging then skips every step that runs the bundle.
+      untrusted_bundle:
+        required: false
+        default: false
+        type: boolean
       # A runner of the target's own platform and architecture, for a `runner`
       # that cannot execute the target. The build job skips everything that
       # runs the packaged binaries, and a second job runs it there.
@@ -134,6 +140,14 @@ jobs:
       T3CODE_CLERK_CLI_OAUTH_CLIENT_ID: ${{ inputs.clerk_cli_oauth_client_id }}
       T3CODE_RELAY_URL: ${{ inputs.relay_url }}
     steps:
+      # The launch check and the CLI archive smoke test both run the bundle.
+      - name: Reject running an untrusted bundle
+        if: inputs.untrusted_bundle && (inputs.launch_check || inputs.cli_archive)
+        shell: bash
+        run: |
+          echo "::error::untrusted_bundle cannot be combined with launch_check or cli_archive, which run the bundle."
+          exit 1
+
       # This repository is public, so Git needs no credentials. checkout's
       # credential cleanup runs submodule foreach even with submodules disabled,
       # which fails on the orphaned gitlinks in our vendored .repos tree.
@@ -573,6 +587,7 @@ jobs:
           pnpm_config_prefer_offline: "true"
           T3CODE_DESKTOP_REUSE_RESOURCE_MONITOR: true
           T3CODE_DESKTOP_REUSE_LINUX_CAPTURE_HELPERS: ${{ steps.capture_helper_cache.outputs.cache-hit == 'true' }}
+          T3CODE_DESKTOP_UNTRUSTED_BUNDLE: ${{ inputs.untrusted_bundle }}
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
           APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}

.github/workflows/release.yml

@@ -903,34 +903,12 @@ jobs:
           fi
 
       # electron-updater reads one manifest per platform and channel and picks
-      # the file entry whose name carries the running arch, so the per-arch
-      # manifests the build jobs wrote are merged back into that one file.
-      - name: Merge macOS updater manifests
+      # the file entry whose name carries the running arch. Require every
+      # platform's two build jobs to have produced matching metadata before
+      # merging it, so a successful release can never strand one architecture.
+      - name: Merge desktop updater manifests
         if: needs.preflight.outputs.release_channel != 'preview'
-        run: |
-          shopt -s nullglob
-          for x64_manifest in release-assets/*-mac-x64.yml; do
-            arm64_manifest="${x64_manifest%-x64.yml}.yml"
-            if [[ -f "$arm64_manifest" ]]; then
-              node scripts/merge-update-manifests.ts --platform mac "$arm64_manifest" "$x64_manifest"
-              rm -f "$x64_manifest"
-            fi
-          done
-
-      - name: Merge Windows updater manifests
-        if: needs.preflight.outputs.release_channel != 'preview'
-        run: |
-          shopt -s nullglob
-          for x64_manifest in release-assets/*-win-x64.yml; do
-            arm64_manifest="${x64_manifest%-x64.yml}-arm64.yml"
-            merged_manifest="${x64_manifest%-win-x64.yml}.yml"
-            if [[ -f "$arm64_manifest" ]]; then
-              node scripts/merge-update-manifests.ts --platform win "$x64_manifest" "$arm64_manifest" "$merged_manifest"
-              rm -f "$x64_manifest" "$arm64_manifest"
-            else
-              mv "$x64_manifest" "$merged_manifest"
-            fi
-          done
+        run: node scripts/merge-release-update-manifests.ts release-assets
 
       # Updater manifests and blockmaps are what electron-updater consumes.
       # They are only listed for channels an updater is meant to follow.

.gitignore

@@ -49,3 +49,5 @@ node_modules/
 
 # pnpm content-addressable store; never belongs in the repo.
 .pnpm-store/
+
+/packages/ssh/.ssh-launcher-test-*/