chore(sync): merge 782 upstream commits, keeping the fork's features

.agents/skills/test-t3-mobile/SKILL.md

@@ -36,8 +36,9 @@ vp run mobile:install <ios|android> <device-id>
 
 This installs the dev client for the checkout's native fingerprint: from the
 device, the local cache, or the shared cache in seconds, building once only
-when no machine has that fingerprint yet (5-15 minutes, logged to the file it
-names). The device id may be omitted when exactly one device is booted. It
+when no machine has that fingerprint yet: in the `Mobile Dev Client` workflow
+on Blacksmith when HEAD is pushed and `gh` may dispatch it (the command waits),
+otherwise here (5-15 minutes, logged to the file it names). The device id may be omitted when exactly one device is booted. It
 prints one JSON line; on failure it names the next command. Mobile verification
 includes that step unless the user prohibits it.
 

.github/SECURITY.md

@@ -1,7 +1,7 @@
 # Security policy
 
 Report security vulnerabilities affecting T3 Code or T3 Tools-operated infrastructure to
-[security@ping.gg](mailto:security@ping.gg). Please do not disclose them publicly until we have had
+[security@t3.codes](mailto:security@t3.codes). Please do not disclose them publicly until we have had
 a reasonable opportunity to investigate and remediate them.
 
 See the [full security policy](https://t3.codes/security-policy) for reporting details, scope,

.github/actions/ci-changes/action.yml

@@ -5,6 +5,8 @@ outputs:
     value: ${{ steps.detect.outputs.typecheck }}
   build:
     value: ${{ steps.detect.outputs.build }}
+  desktop_launch:
+    value: ${{ steps.detect.outputs.desktop_launch }}
   test:
     value: ${{ steps.detect.outputs.test }}
   test_packages:

.github/actions/setup-ci-deps/action.yml

@@ -13,6 +13,10 @@ inputs:
     description: Arguments for `vp install`, such as filters. Empty installs the whole workspace.
     required: false
     default: ""
+  save-pnpm-store:
+    description: Set to "false" when a concurrent job with the same install args saves the pnpm store
+    required: false
+    default: "true"
 runs:
   using: composite
   steps:
@@ -123,10 +127,14 @@ runs:
         key: ${{ steps.pnpm_verified.outputs.cache-primary-key }}
 
     # A filtered install that started from the current full store adds nothing
-    # worth a second copy of it.
+    # worth a second copy of it. A stacked PR, based on a branch other than the
+    # default, saves a ~1 GB store only its own reruns can read, so it only restores.
+    # Concurrent jobs with the same install args reserve one key, so the losers
+    # compress the store for nothing; all but one pass save-pnpm-store: false.
     - name: Save pnpm store
       if: >-
-        inputs.install == 'true' &&
+        inputs.install == 'true' && inputs.save-pnpm-store == 'true' &&
+        (github.event_name != 'pull_request' || github.base_ref == github.event.repository.default_branch) &&
         steps.pnpm_cache.outputs.cache-hit != 'true' &&
         (steps.pnpm_store.outputs.namespace == 'full' ||
           steps.pnpm_cache.outputs.cache-matched-key != format('pnpm-full-v1-{0}-{1}-{2}', runner.os, runner.arch, hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json')))

.github/scripts/check-nightly-release.cjs

@@ -40,42 +40,67 @@ async function assertReleaseSource({ github, context, releaseChannel }) {
 
 const isNightlyTag = (tag) => /^v.*-nightly\./.test(tag) || tag.startsWith("nightly-v");
 
-async function findLatestNightly({ github, context }) {
-  const releases = await github.paginate(github.rest.repos.listReleases, {
-    ...context.repo,
-    per_page: 100,
-  });
-  return releases
-    .filter((release) => !release.draft && release.published_at && isNightlyTag(release.tag_name))
-    .sort((a, b) => Date.parse(b.published_at) - Date.parse(a.published_at))[0];
+// Only the three fields the gate reads. The REST list also returns every asset,
+// which made a full scan tens of megabytes.
+const RELEASES_QUERY = `
+  query ($owner: String!, $repo: String!, $cursor: String) {
+    repository(owner: $owner, name: $repo) {
+      releases(first: 100, after: $cursor, orderBy: { field: CREATED_AT, direction: DESC }) {
+        pageInfo { hasNextPage endCursor }
+        nodes { tagName isDraft publishedAt }
+      }
+    }
+  }
+`;
+
+// Returns the nightly with the newest publishedAt. Release order follows the
+// tagged commit date, not publication, so every page is read unless `isSettled`
+// says the newest nightly seen so far already decides the caller's answer.
+async function findLatestNightly({ github, context, isSettled = () => false }) {
+  let latest;
+  let cursor = null;
+  do {
+    const { repository } = await github.graphql(RELEASES_QUERY, { ...context.repo, cursor });
+    const { nodes, pageInfo } = repository.releases;
+    for (const release of nodes) {
+      if (release.isDraft || !release.publishedAt || !isNightlyTag(release.tagName)) continue;
+      if (!latest || Date.parse(release.publishedAt) > Date.parse(latest.publishedAt)) {
+        latest = release;
+      }
+    }
+    if (latest && isSettled(latest)) return latest;
+    cursor = pageInfo.hasNextPage ? pageInfo.endCursor : null;
+  } while (cursor);
+  return latest;
 }
 
 async function shouldReleaseNightly({ github, context, core, now = Date.now() }) {
-  const lastNightly = await findLatestNightly({ github, context });
+  const isInGap = (release) => now - Date.parse(release.publishedAt) < MINIMUM_RELEASE_GAP_MS;
+  // Any nightly inside the gap means the newest one is too, so stop reading.
+  const lastNightly = await findLatestNightly({ github, context, isSettled: isInGap });
 
   if (!lastNightly) {
     core.info("No published nightly found. Proceeding with release.");
     return true;
   }
 
-  if (now - Date.parse(lastNightly.published_at) < MINIMUM_RELEASE_GAP_MS) {
-    core.info(`Nightly ${lastNightly.tag_name} was published less than six hours ago. Skipping.`);
+  const tag = lastNightly.tagName;
+  if (isInGap(lastNightly)) {
+    core.info(`Nightly ${tag} was published less than six hours ago. Skipping.`);
     return false;
   }
 
   const { data: comparison } = await github.rest.repos.compareCommitsWithBasehead({
     ...context.repo,
-    basehead: `${lastNightly.tag_name}...${context.sha}`,
+    basehead: `${tag}...${context.sha}`,
     per_page: 1,
   });
   if (comparison.status !== "ahead") {
-    core.info(
-      `Candidate commit is ${comparison.status} relative to ${lastNightly.tag_name}. Skipping.`,
-    );
+    core.info(`Candidate commit is ${comparison.status} relative to ${tag}. Skipping.`);
     return false;
   }
 
-  core.info(`New commits since ${lastNightly.tag_name}, and the six-hour gap has passed.`);
+  core.info(`New commits since ${tag}, and the six-hour gap has passed.`);
   return true;
 }
 
@@ -85,7 +110,7 @@ async function resolveLatestNightlyCommit({ github, context, core }) {
     throw new Error("No published nightly found. Stable releases build the latest nightly commit.");
   }
 
-  const tag = lastNightly.tag_name;
+  const tag = lastNightly.tagName;
   const { data: commit } = await github.rest.repos.getCommit({ ...context.repo, ref: tag });
   const version = /^(?:nightly-)?v(\d+\.\d+\.\d+)-nightly\./.exec(tag)?.[1];
   if (!version) {

.github/scripts/check-nightly-release.test.cjs

@@ -9,9 +9,9 @@ const {
 const now = Date.parse("2026-09-05T12:00:00Z");
 const hour = 60 * 60 * 1000;
 const nightly = (hoursAgo, overrides = {}) => ({
-  tag_name: "v1.0.1-nightly.20260905.123",
-  draft: false,
-  published_at: new Date(now - hoursAgo * hour).toISOString(),
+  tagName: "v1.0.1-nightly.20260905.123",
+  isDraft: false,
+  publishedAt: new Date(now - hoursAgo * hour).toISOString(),
   ...overrides,
 });
 
@@ -73,26 +73,39 @@ for (const comparisonStatus of ["behind", "diverged"]) {
   });
 }
 
-function fixture({ releases = [nightly(7)], comparisonStatus = "ahead" } = {}) {
+// `pages` holds the GraphQL release pages; `releases` is shorthand for one page.
+function fixture({ releases = [nightly(7)], pages = [releases], comparisonStatus = "ahead" } = {}) {
   const calls = [];
+  const cursors = [];
   return {
     calls,
+    cursors,
     options: {
       now,
       context: { repo: { owner: "example", repo: "app" }, sha: "new" },
       core: { info() {} },
       github: {
         rest: {
           repos: {
-            listReleases() {},
             async compareCommitsWithBasehead(params) {
               calls.push(params);
               return { data: { status: comparisonStatus } };
             },
           },
         },
-        async paginate() {
-          return releases;
+        async graphql(_query, { owner, repo, cursor }) {
+          assert.deepEqual({ owner, repo }, { owner: "example", repo: "app" });
+          cursors.push(cursor);
+          const index = cursor === null ? 0 : Number(cursor);
+          const hasNextPage = index + 1 < pages.length;
+          return {
+            repository: {
+              releases: {
+                nodes: pages[index],
+                pageInfo: { hasNextPage, endCursor: hasNextPage ? String(index + 1) : null },
+              },
+            },
+          };
         },
       },
     },
@@ -101,28 +114,65 @@ function fixture({ releases = [nightly(7)], comparisonStatus = "ahead" } = {}) {
 
 test("releases the first nightly when no nightly is published", async () => {
   const { options } = fixture({
-    releases: [nightly(0, { tag_name: "v1.0.0" }), nightly(0, { draft: true })],
+    releases: [nightly(0, { tagName: "v1.0.0" }), nightly(0, { isDraft: true })],
   });
   assert.equal(await shouldReleaseNightly(options), true);
 });
 
 test("uses publication time, not release order or the tagged commit date", async () => {
   const { options } = fixture({
-    releases: [nightly(10), nightly(1), nightly(20, { tag_name: "nightly-v0.9.0" })],
+    releases: [nightly(10), nightly(1), nightly(20, { tagName: "nightly-v0.9.0" })],
+  });
+  assert.equal(await shouldReleaseNightly(options), false);
+});
+
+test("the six-hour gap ends exactly six hours after publication", async () => {
+  const atBoundary = fixture({ releases: [nightly(6)] });
+  assert.equal(await shouldReleaseNightly(atBoundary.options), true);
+  const justInside = fixture({ releases: [nightly(6 - 1 / 3_600_000)] });
+  assert.equal(await shouldReleaseNightly(justInside.options), false);
+  assert.equal(justInside.calls.length, 0);
+});
+
+test("stops reading releases once a nightly inside the gap is seen", async () => {
+  const { options, cursors } = fixture({ pages: [[nightly(10), nightly(2)], [nightly(30)]] });
+  assert.equal(await shouldReleaseNightly(options), false);
+  assert.deepEqual(cursors, [null]);
+});
+
+test("reads every page when no nightly seen so far settles the gap", async () => {
+  const { options, cursors, calls } = fixture({
+    pages: [
+      [nightly(10), nightly(0, { tagName: "v1.0.0" })],
+      [nightly(1, { tagName: "nightly-v0.9.0" })],
+    ],
   });
   assert.equal(await shouldReleaseNightly(options), false);
+  assert.deepEqual(cursors, [null, "1"]);
+  assert.equal(calls.length, 0);
+});
+
+test("compares against the newest nightly across pages once the gap has passed", async () => {
+  const { options, calls } = fixture({
+    pages: [[nightly(10, { tagName: "v1.0.1-nightly.20260905.100" })], [nightly(8)]],
+  });
+  assert.equal(await shouldReleaseNightly(options), true);
+  assert.deepEqual(
+    calls.map((call) => call.basehead),
+    ["v1.0.1-nightly.20260905.123...new"],
+  );
 });
 
 test("ignores stable releases and drafts when checking the gap", async () => {
   const { options } = fixture({
-    releases: [nightly(0, { tag_name: "v1.0.0" }), nightly(0, { draft: true }), nightly(7)],
+    releases: [nightly(0, { tagName: "v1.0.0" }), nightly(0, { isDraft: true }), nightly(7)],
   });
   assert.equal(await shouldReleaseNightly(options), true);
 });
 
 test("fails instead of releasing when GitHub cannot supply release state", async () => {
   const { options } = fixture();
-  options.github.paginate = async () => {
+  options.github.graphql = async () => {
     throw new Error("GitHub unavailable");
   };
   await assert.rejects(shouldReleaseNightly(options), /GitHub unavailable/);
@@ -137,9 +187,9 @@ for (const status of ["behind", "diverged"]) {
 
 const { resolveLatestNightlyCommit } = require("./check-nightly-release.cjs");
 
-function nightlyCommitFixture({ releases, commitSha = "abc123" }) {
+function nightlyCommitFixture({ releases, pages, commitSha = "abc123" }) {
   const refs = [];
-  const { options } = fixture({ releases });
+  const { options } = fixture({ releases, pages });
   options.github.rest.repos.getCommit = async ({ ref }) => {
     refs.push(ref);
     return { data: { sha: commitSha } };
@@ -150,10 +200,10 @@ function nightlyCommitFixture({ releases, commitSha = "abc123" }) {
 test("stable releases resolve the commit of the newest published nightly", async () => {
   const { options, refs } = nightlyCommitFixture({
     releases: [
-      nightly(10, { tag_name: "v1.0.1-nightly.20260905.100" }),
-      nightly(1, { tag_name: "v1.0.1-nightly.20260905.123" }),
-      nightly(0, { tag_name: "v1.0.0" }),
-      nightly(0, { draft: true, tag_name: "v1.0.1-nightly.20260905.999" }),
+      nightly(10, { tagName: "v1.0.1-nightly.20260905.100" }),
+      nightly(1, { tagName: "v1.0.1-nightly.20260905.123" }),
+      nightly(0, { tagName: "v1.0.0" }),
+      nightly(0, { isDraft: true, tagName: "v1.0.1-nightly.20260905.999" }),
     ],
     commitSha: "deadbeef",
   });
@@ -167,7 +217,23 @@ test("stable releases resolve the commit of the newest published nightly", async
 
 test("stable releases derive the version from legacy nightly tags", async () => {
   const { options } = nightlyCommitFixture({
-    releases: [nightly(1, { tag_name: "nightly-v0.9.0-nightly.20260905.5" })],
+    releases: [nightly(1, { tagName: "nightly-v0.9.0-nightly.20260905.5" })],
   });
   assert.equal((await resolveLatestNightlyCommit(options)).version, "0.9.0");
 });
+
+test("stable releases read every page, even after a recent nightly", async () => {
+  const { options, refs } = nightlyCommitFixture({
+    pages: [
+      [nightly(2, { tagName: "v1.0.1-nightly.20260905.100" })],
+      [nightly(1, { tagName: "v1.0.1-nightly.20260905.123" })],
+    ],
+  });
+  assert.equal((await resolveLatestNightlyCommit(options)).tag, "v1.0.1-nightly.20260905.123");
+  assert.deepEqual(refs, ["v1.0.1-nightly.20260905.123"]);
+});
+
+test("stable releases fail when no nightly is published", async () => {
+  const { options } = nightlyCommitFixture({ releases: [nightly(1, { tagName: "v1.0.0" })] });
+  await assert.rejects(resolveLatestNightlyCommit(options), /No published nightly found/);
+});

.github/scripts/ci-changes.cjs

@@ -51,6 +51,21 @@ const BUILD_ONLY_DEPS = { t3: ["@t3tools/web"] };
 const MOBILE_NATIVE =
   /^apps\/mobile\/.*\.(swift|kt|kts)$|^apps\/mobile\/(\.swiftlint\.yml|detekt\.yml|\.editorconfig|Brewfile)$|^scripts\/mobile-native-static-check\.ts$|^package\.json$|^\.github\/workflows\/ci\.yml$|^\.github\/scripts\/ci-changes\.cjs$|^\.github\/actions\/ci-changes\//;
 
+// Startup, migration, settlement, and sidebar paths that decide whether an upgraded user's
+// threads show after launch. Build runs scripts/smoke-desktop-app.ts for them, so they do not
+// first fail in the release launch check.
+const DESKTOP_LAUNCH = [
+  /^apps\/desktop\/src\/((main|boot|compileCache|serverCompileCache)\.ts$|(app|backend|window)\/)/,
+  /^apps\/desktop\/src\/electron\/(ElectronApp|ElectronProtocol|ElectronWindow)\.ts$/,
+  /^apps\/web\/src\/((main|AppRoot|appInit)\.tsx|(bootstrap|router)\.ts)$/,
+  /^apps\/web\/src\/.*sidebar/i,
+  /^apps\/server\/src\/(bin|binMain|server|serverRuntimeStartup)\.ts$/,
+  /^apps\/server\/src\/persistence\/Migrations/,
+  /^apps\/server\/src\/orchestration-v2\/((ThreadSettlementService|ProjectionStore)\.ts$|legacy\/)/,
+  /^packages\/contracts\/src\/settings\.ts$/,
+  /^scripts\/(smoke-desktop-app\.ts|fixtures\/desktop-launch\/)/,
+];
+
 const OWN_TEST_JOB = new Set(["t3", "@t3tools/web", "@t3tools/monorepo"]);
 
 function readWorkspace() {
@@ -151,12 +166,18 @@ function decide(files, packages, full) {
     (pkg) => pkg.hasTest && !OWN_TEST_JOB.has(pkg.name) && affected.has(pkg.name),
   );
   const has = (name) => affected.has(name);
+  const desktopLaunch =
+    everything ||
+    files.some(
+      (file) => !/\.test\.tsx?$/.test(file) && DESKTOP_LAUNCH.some((pattern) => pattern.test(file)),
+    );
 
   return {
     affected: [...affected].sort(),
     outputs: {
       typecheck: affected.size > 0,
-      build: has("@t3tools/desktop") || has("t3") || has("@t3tools/web"),
+      build: has("@t3tools/desktop") || has("t3") || has("@t3tools/web") || desktopLaunch,
+      desktop_launch: desktopLaunch,
       test: tested.length > 0,
       // Empty means every package the Test job covers.
       test_packages: everything ? "" : tested.map((pkg) => pkg.name).join(" "),

.github/scripts/ci-changes.d.cts

@@ -16,6 +16,7 @@ export function decide(
   outputs: {
     typecheck: boolean;
     build: boolean;
+    desktop_launch: boolean;
     test: boolean;
     test_packages: string;
     test_web: boolean;