sync/upstream 20260930

.github/VOUCHED.td

@@ -68,6 +68,7 @@ github:realAhmedRoach
 github:Rishet11
 github:ryanrhughes
 github:saphid
+github:scratchyone
 github:sethwebster
 github:shiroyasha9
 github:shivamhwp

.github/triage/PLAYBOOK.md

@@ -59,8 +59,9 @@ different code depending on it:
 
 Then work from evidence, not assumption. In rough order of value:
 
-- The server log and the trace file (`server.trace.ndjson`) around the time of the
-  problem. Recent failures usually leave a trail here.
+- The trace file (`server.trace.ndjson`) around the time of the problem, plus the
+  service log or desktop backend logs from the context file if they exist. Recent
+  failures usually leave a trail here.
 - The provider event log, for problems with claude/codex/cursor sessions.
 - The SQLite database. Read it freely, but only write when a write is necessary
   to fix the problem the user described, and get their explicit permission

.github/workflows/deploy-relay.yml

@@ -4,6 +4,15 @@ on:
   push:
     branches:
       - main
+  # Alchemy does not redeploy the Worker when only a Config value read in its
+  # Init changes (alchemy-run/alchemy#1831), so a changed repository variable
+  # needs a forced deploy to reach production.
+  workflow_dispatch:
+    inputs:
+      force:
+        description: Redeploy every resource, including ones with no detected changes
+        type: boolean
+        default: true
 
 permissions:
   contents: read
@@ -17,6 +26,8 @@ concurrency:
 jobs:
   deploy_relay:
     name: Deploy production relay
+    # A manual run from another branch would deploy that branch to production.
+    if: github.ref == 'refs/heads/main'
     runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 15
     environment:
@@ -28,6 +39,7 @@ jobs:
       RELAY_DOMAIN: ${{ vars.RELAY_DOMAIN }}
       RELAY_API_ZONE_NAME: ${{ vars.RELAY_API_ZONE_NAME }}
       RELAY_TUNNEL_ZONE_NAME: ${{ vars.RELAY_TUNNEL_ZONE_NAME }}
+      RELAY_TUNNEL_CLEANUP_MODE: ${{ vars.RELAY_TUNNEL_CLEANUP_MODE }}
       CLERK_PUBLISHABLE_KEY: ${{ vars.CLERK_PUBLISHABLE_KEY }}
       CLERK_JWT_AUDIENCE: ${{ vars.CLERK_JWT_AUDIENCE }}
       APNS_ENVIRONMENT: ${{ vars.APNS_ENVIRONMENT }}
@@ -54,7 +66,7 @@ jobs:
               - --filter=t3code-relay...
 
       - name: Deploy production relay stage
-        run: vp run --filter t3code-relay deploy --stage prod --yes --no-input
+        run: vp run --filter t3code-relay deploy --stage prod --yes --no-input ${{ inputs.force && '--force' || '' }}
         env:
           # The PublishClientConfig action writes the client env here instead
           # of the repo-root .env; nothing on the runner reads it.

.github/workflows/mobile-eas-preview.yml

@@ -78,7 +78,19 @@ jobs:
         working-directory: apps/mobile
         env:
           EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
-        run: eas env:pull preview --non-interactive
+        run: |
+          eas env:pull preview --non-interactive
+          # EAS Update disables dotenv loading. Keep the downloaded native config
+          # in its process environment so Android build and OTA fingerprints match.
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from "node:fs";
+          import { parseEnv } from "node:util";
+          const env = parseEnv(readFileSync(".env.local", "utf8"));
+          const googleServicesFile = env.T3CODE_ANDROID_GOOGLE_SERVICES_FILE;
+          if (googleServicesFile) {
+            appendFileSync(process.env.GITHUB_ENV, `T3CODE_ANDROID_GOOGLE_SERVICES_FILE=${googleServicesFile}\n`);
+          }
+          NODE
 
       - name: Deploy with fingerprint check
         if: steps.expo-token.outputs.present == 'true'

.github/workflows/mobile-showcase-screenshots.yml

@@ -76,6 +76,17 @@ jobs:
           echo "$vp_pnpm_bin" >> "$GITHUB_PATH"
           "$vp_pnpm_bin/pnpm" --version
 
+      - name: Install AXe
+        # Locks the simulator and answers the notification prompt for the
+        # agent-activity scene.
+        # Homebrew refuses third-party tap formulae until they are trusted;
+        # older releases have no trust command and install them as is.
+        run: |
+          brew tap cameroncooke/axe
+          if brew commands | grep -qx trust; then brew trust --formula cameroncooke/axe/axe; fi
+          brew install cameroncooke/axe/axe
+          axe --version
+
       - name: Capture iOS showcase
         run: pnpm screenshots:mobile --platform ios --appearance "${{ inputs.appearance }}" --theme "${{ inputs.theme }}"
 

.github/workflows/release-desktop.yml

@@ -510,6 +510,7 @@ jobs:
             "release/*.dmg"
             "release/*.zip"
             "release/*.AppImage"
+            "release/*.deb"
             "release/*.exe"
           )
           # Preview builds have no publish config, so electron-builder writes

.github/workflows/release.yml

@@ -259,13 +259,76 @@ jobs:
       - name: Typecheck
         run: vp run typecheck
 
+  # Keep tests on their own runners, using the same package split and server
+  # shards as CI, so the release check job does not spend its budget on tests.
+  test:
+    name: Release tests
+    needs: [preflight]
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' }}
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.preflight.outputs.ref }}
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Ensure Electron runtime is installed
+        run: vp run --filter @t3tools/desktop ensure:electron
+
       - uses: ./.github/actions/setup-apt-mirrors
 
       - name: Install browser secret helper build libraries
-        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+        run: |
+          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
+          sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config build-essential
+
+      - name: Test
+        run: vp run --parallel --concurrency-limit 4 --filter '!t3' --filter '!@t3tools/monorepo' test
+
+  test_server:
+    name: Release server tests ${{ matrix.shard }}
+    needs: [preflight]
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' }}
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.preflight.outputs.ref }}
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
 
+      # No Electron setup here: `t3` (apps/server) has no Electron dependency
+      # and none of its tests touch the runtime. Only the non-server `test`
+      # job, which covers @t3tools/desktop, needs the download.
       - name: Test
-        run: vp run test
+        run: vp run --filter t3 test --shard ${{ matrix.shard }}/${{ strategy.job-total }}
 
   relay_public_config:
     name: Resolve T3 Connect public config
@@ -562,7 +625,7 @@ jobs:
       clerk_cli_oauth_client_id: ${{ needs.relay_public_config.outputs.clerk_cli_oauth_client_id }}
       relay_url: ${{ needs.relay_public_config.outputs.relay_url }}
       label: Linux arm64
-      runner: ubuntu-24.04-arm
+      runner: blacksmith-16vcpu-ubuntu-2404-arm
       platform: linux
       target: AppImage
       arch: arm64
@@ -630,13 +693,15 @@ jobs:
         preflight,
         relay_public_config,
         quality,
+        test,
+        test_server,
         desktop_mac_arm64,
         desktop_linux_x64,
         desktop_linux_arm64,
         desktop_win_x64,
         desktop_win_arm64,
       ]
-    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.relay_public_config.result == 'success' && needs.quality.result == 'success' && needs.desktop_mac_arm64.result == 'success' && needs.desktop_linux_x64.result == 'success' && needs.desktop_linux_arm64.result == 'success' && needs.desktop_win_x64.result == 'success' && needs.desktop_win_arm64.result == 'success' }}
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.relay_public_config.result == 'success' && needs.quality.result == 'success' && needs.test.result == 'success' && needs.test_server.result == 'success' && needs.desktop_mac_arm64.result == 'success' && needs.desktop_linux_x64.result == 'success' && needs.desktop_linux_arm64.result == 'success' && needs.desktop_win_x64.result == 'success' && needs.desktop_win_arm64.result == 'success' }}
     runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 15
     permissions:
@@ -810,6 +875,7 @@ jobs:
             echo 'release-assets/*.dmg'
             echo 'release-assets/*.zip'
             echo 'release-assets/*.AppImage'
+            echo 'release-assets/*.deb'
             echo 'release-assets/*.exe'
             if [[ "${{ needs.preflight.outputs.release_channel }}" != "preview" ]]; then
               echo 'release-assets/*.blockmap'

.macroscope/check-run-agents/effect-service-conventions.md

@@ -1,7 +1,7 @@
 ---
 title: Effect Service Conventions
-model: gpt-5-6-sol
-effort: medium
+model: gpt-6-sol
+effort: max
 input: incremental
 tools:
   - browse_code

.macroscope/check-run-agents/ui-consistency.md

@@ -1,7 +1,7 @@
 ---
 title: UI Consistency
-model: gpt-5-6-sol
-effort: medium
+model: gpt-6-sol
+effort: max
 input: incremental
 tools:
   - browse_code

README.md

@@ -54,6 +54,14 @@ winget install T3Tools.T3Code
 brew install --cask t3-code
 ```
 
+#### Debian, Ubuntu (`.deb`)
+
+Download the `.deb` from [GitHub Releases](https://github.com/pingdotgg/t3code/releases), then:
+
+```bash
+sudo apt install ./T3-Code-*.deb
+```
+
 #### Arch Linux (AUR)
 
 Stable:

apps/desktop/package.json

@@ -3,7 +3,7 @@
   "version": "0.0.42",
   "private": true,
   "type": "module",
-  "main": "dist-electron/main.cjs",
+  "main": "dist-electron/boot.cjs",
   "scripts": {
     "ensure:electron": "node scripts/ensure-electron-runtime.mjs",
     "start": "node scripts/start-electron.mjs",

apps/desktop/scripts/main-process-bundle.test.mjs

@@ -1,3 +1,4 @@
+import * as NodeChildProcess from "node:child_process";
 import * as NodeFSP from "node:fs/promises";
 import * as NodeOS from "node:os";
 import * as NodePath from "node:path";
@@ -108,3 +109,65 @@ void import("./linux.ts").then(({ result }) => process.emit("ready", result));`,
     await NodeFSP.rm(directory, { recursive: true, force: true });
   }
 });
+
+it("loads the emitted packaged boot entry and backend cache preload", async () => {
+  const directory = await NodeFSP.mkdtemp(NodePath.join(NodeOS.tmpdir(), "t3-desktop-boot-"));
+  try {
+    const entries = ["src/boot.ts", "src/compileCache.ts"];
+    await NodeFSP.mkdir(NodePath.join(directory, "src"));
+    await Promise.all(
+      entries.map((entry) =>
+        NodeFSP.copyFile(new URL(`../${entry}`, import.meta.url), NodePath.join(directory, entry)),
+      ),
+    );
+    assert.ok(Array.isArray(desktopConfig.pack));
+    for (const packConfig of desktopConfig.pack) {
+      if (!Array.isArray(packConfig.entry)) continue;
+      if (!packConfig.entry.some((entry) => entries.includes(entry))) continue;
+      await build({
+        ...packConfig,
+        config: false,
+        cwd: directory,
+        tsconfig: false,
+        sourcemap: false,
+        onSuccess: undefined,
+        logLevel: "silent",
+      });
+    }
+    const outputDirectory = NodePath.join(directory, "dist-electron");
+    const fixture = `console.log(require('node:module').getCompileCacheDir() ? 'cached' : 'uncached');`;
+    await NodeFSP.writeFile(NodePath.join(outputDirectory, "main.cjs"), fixture);
+    await NodeFSP.writeFile(
+      NodePath.join(outputDirectory, "backend.mjs"),
+      `import { getCompileCacheDir } from 'node:module'; console.log(getCompileCacheDir() ? 'cached' : 'uncached');`,
+    );
+    for (const disabled of [false, true]) {
+      for (const args of [
+        [NodePath.join(outputDirectory, "boot.cjs")],
+        [
+          "--require",
+          NodePath.join(outputDirectory, "compileCache.cjs"),
+          NodePath.join(outputDirectory, "backend.mjs"),
+        ],
+      ]) {
+        const child = NodeChildProcess.spawnSync(process.execPath, args, {
+          encoding: "utf8",
+          env: {
+            ...process.env,
+            APPIMAGE: "",
+            NODE_COMPILE_CACHE: undefined,
+            NODE_DISABLE_COMPILE_CACHE: disabled ? "1" : undefined,
+            XDG_CACHE_HOME: directory,
+            TMPDIR: directory,
+            TEMP: directory,
+            TMP: directory,
+          },
+        });
+        assert.equal(child.status, 0, child.stderr);
+        assert.equal(child.stdout.trim(), disabled ? "uncached" : "cached");
+      }
+    }
+  } finally {
+    await NodeFSP.rm(directory, { recursive: true, force: true });
+  }
+});

apps/desktop/scripts/smoke-test.mjs

@@ -5,7 +5,7 @@ import { resolveElectronLaunchCommand } from "./electron-launcher.mjs";
 
 const __dirname = NodePath.dirname(NodeURL.fileURLToPath(import.meta.url));
 const desktopDir = NodePath.resolve(__dirname, "..");
-const mainJs = NodePath.resolve(desktopDir, "dist-electron/main.cjs");
+const mainJs = NodePath.resolve(desktopDir, "dist-electron/boot.cjs");
 
 console.log("\nLaunching Electron smoke test...");