chore: sync T3 Code upstream through 6ea01f8d

.agents/skills/test-t3-mobile/SKILL.md

@@ -41,6 +41,9 @@ Start `vp run dev:client` from `apps/mobile`, or reuse a healthy Metro belonging
 to this checkout. Open its printed development-client URL with AgentDevice
 `open com.t3tools.t3code.dev <url>` and all returned target arguments.
 The device must be able to reach both Metro and the isolated backend.
+Append `&disableAutoLaunch=1&disableFab=1` to the development-client URL query
+when developer chrome would obscure screenshots or taps; the SDK 58 dev client
+applies these preferences before the app loads.
 
 ## Pair and verify
 

.github/workflows/ci.yml

@@ -14,8 +14,11 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  check:
-    name: Check
+  # Lint, typecheck, and the desktop build each get a runner so they run side by
+  # side instead of one after another. The `Check` job at the end of this file
+  # passes only when every other job does.
+  lint:
+    name: Lint
     runs-on: ${{ github.repository == 'pingdotgg/t3code' && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
     timeout-minutes: ${{ github.repository == 'pingdotgg/t3code' && 10 || 30 }}
     steps:
@@ -52,27 +55,88 @@ jobs:
       - name: Check
         run: vp check
 
+  typecheck:
+    name: Typecheck
+    runs-on: ${{ github.repository == 'pingdotgg/t3code' && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
+    timeout-minutes: ${{ github.repository == 'pingdotgg/t3code' && 10 || 30 }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Ensure Electron runtime is installed
+        run: vp run --filter @t3tools/desktop ensure:electron
+
       - name: Typecheck
         run: vpr typecheck
 
+  build:
+    name: Build
+    runs-on: ${{ github.repository == 'pingdotgg/t3code' && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
+    timeout-minutes: ${{ github.repository == 'pingdotgg/t3code' && 10 || 30 }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
       - uses: ./.github/actions/setup-apt-mirrors
 
-      - name: Install browser secret helper build libraries
+      # Runs in the background while Vite+ installs; the step before the build waits for it.
+      - name: Start installing browser secret helper build libraries
+        run: |
+          for source in /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources; do
+            if test -f "$source"; then sudo sed -i 's|http://|https://|g' "$source"; fi
+          done
+          (
+            set +e
+            sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+            echo "$?" > "$RUNNER_TEMP/apt-status"
+          ) > "$RUNNER_TEMP/apt.log" 2>&1 < /dev/null &
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Ensure Electron runtime is installed
+        run: vp run --filter @t3tools/desktop ensure:electron
+
+      - name: Finish installing browser secret helper build libraries
+        timeout-minutes: 5
         run: |
-          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
-          sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+          until test -s "$RUNNER_TEMP/apt-status"; do sleep 1; done
+          cat "$RUNNER_TEMP/apt.log"
+          exit "$(cat "$RUNNER_TEMP/apt-status")"
 
       - name: Build desktop pipeline
         run: vp run build:desktop
 
       - name: Verify preload bundle output
         run: node apps/desktop/scripts/verify-preload-bundle.mjs
 
-  # Everything except `t3` (apps/server). `--parallel` drops the package
-  # dependency ordering that `vp run` applies by default: these `test` tasks
-  # declare no `dependsOn` and resolve workspace deps from source, so ordering
-  # only bought us idle runners between dependency layers. The concurrency
-  # limit stays at the default 4 so peak load per runner is unchanged.
+  # Everything except `t3` (apps/server) and the web app, which has its own job
+  # below. `--parallel` drops the package dependency ordering that `vp run`
+  # applies by default: these `test` tasks declare no `dependsOn` and resolve
+  # workspace deps from source, so ordering only bought us idle runners between
+  # dependency layers. The concurrency limit stays at the default 4 so peak load
+  # per runner is unchanged.
   test:
     name: Test
     runs-on: ${{ github.repository == 'pingdotgg/t3code' && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
@@ -86,6 +150,21 @@ jobs:
             !/.repos/
           sparse-checkout-cone-mode: false
 
+      - uses: ./.github/actions/setup-apt-mirrors
+
+      # The desktop tests compile the browser secret helper. The install runs in
+      # the background while Vite+ installs; the step before the tests waits for it.
+      - name: Start installing browser secret helper build libraries
+        run: |
+          for source in /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources; do
+            if test -f "$source"; then sudo sed -i 's|http://|https://|g' "$source"; fi
+          done
+          (
+            set +e
+            sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+            echo "$?" > "$RUNNER_TEMP/apt-status"
+          ) > "$RUNNER_TEMP/apt.log" 2>&1 < /dev/null &
+
       - name: Setup Vite+
         uses: voidzero-dev/setup-vp@v1
         with:
@@ -96,36 +175,61 @@ jobs:
       - name: Ensure Electron runtime is installed
         run: vp run --filter @t3tools/desktop ensure:electron
 
-      - uses: ./.github/actions/setup-apt-mirrors
-
-      - name: Install browser secret helper build libraries
-        run: |
-          sudo sed -i 's|http://|https://|g' /etc/apt/blacksmith-ubuntu-mirrors.txt /etc/apt/sources.list.d/ubuntu.sources
-          sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
-
       - name: Test preview artifact validation
         run: python3 -B .github/scripts/stage-preview-bundle.test.py
 
       - name: Test nightly release checks
         run: node --test .github/scripts/check-nightly-release.test.cjs
 
+      - name: Finish installing browser secret helper build libraries
+        timeout-minutes: 5
+        run: |
+          until test -s "$RUNNER_TEMP/apt-status"; do sleep 1; done
+          cat "$RUNNER_TEMP/apt.log"
+          exit "$(cat "$RUNNER_TEMP/apt-status")"
+
+      - name: Test
+        run: vp run --parallel --concurrency-limit ${{ github.repository == 'pingdotgg/t3code' && 4 || 1 }} --filter '!t3' --filter '!@t3tools/monorepo' --filter '!@t3tools/web' test
+
+  # The web suite is the largest outside the server. In the shared Test job it
+  # started last and ran alone for about 40s after everything else finished.
+  test_web:
+    name: Test Web
+    runs-on: ${{ github.repository == 'pingdotgg/t3code' && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
+    timeout-minutes: ${{ github.repository == 'pingdotgg/t3code' && 10 || 30 }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
       - name: Test
-        # Each suite owns its own workers. Serialize packages on the fork's
-        # shared runners to keep CPU-heavy editor tests within their budget.
-        run: vp run --parallel --concurrency-limit ${{ github.repository == 'pingdotgg/t3code' && 4 || 1 }} --filter '!t3' --filter '!@t3tools/monorepo' test
+        run: vp run --filter @t3tools/web test
 
-  # apps/server sets `fileParallelism: false`, so its 239 files run strictly
+  # apps/server sets `fileParallelism: false`, so its test files run strictly
   # one at a time. Sharding spreads them over separate runners instead of
   # separate workers, so no two server test files ever share a machine and the
-  # isolation that flag buys is preserved exactly.
+  # isolation that flag buys is preserved exactly. One file at a time keeps
+  # about 1.5 cores busy, so 4 vCPU runners lose nothing against 8. The shards
+  # split files by recorded duration (apps/server/src/testUtils/weightedShardSequencer.ts).
   test_server:
     name: Test Server ${{ matrix.shard }}
-    runs-on: ${{ github.repository == 'pingdotgg/t3code' && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
+    runs-on: ${{ github.repository == 'pingdotgg/t3code' && 'blacksmith-4vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
     timeout-minutes: ${{ github.repository == 'pingdotgg/t3code' && 10 || 30 }}
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3]
+        shard: [1, 2, 3, 4, 5, 6]
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -349,3 +453,37 @@ jobs:
 
       - name: Exercise release-only workflow steps
         run: node scripts/release-smoke.ts
+
+  # Branch protection requires this job by its name, `Check`. It fails when any
+  # other job fails, is cancelled, or is skipped without a reason, so splitting
+  # or resharding jobs needs no ruleset change. Add every new job to `needs`.
+  # `always()` rather than `!cancelled()`: a skipped job reports success to
+  # branch protection, so a cancelled run must still produce a failing check.
+  check:
+    name: Check
+    if: ${{ always() }}
+    needs:
+      [
+        lint,
+        typecheck,
+        build,
+        test,
+        test_web,
+        test_server,
+        rust,
+        mobile_native_changes,
+        mobile_native_static_analysis,
+        release_smoke,
+      ]
+    runs-on: ${{ github.repository == 'pingdotgg/t3code' && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-24.04' }}
+    timeout-minutes: 5
+    steps:
+      - name: Require every job to pass
+        env:
+          RESULTS: ${{ toJSON(needs) }}
+        run: |
+          echo "$RESULTS" | jq -r 'to_entries[] | "\(.key): \(.value.result)"'
+          # Only the macOS lint skips on purpose, when no native mobile code changed.
+          echo "$RESULTS" | jq -e 'all(to_entries[];
+            .value.result == "success"
+            or (.key == "mobile_native_static_analysis" and .value.result == "skipped"))' > /dev/null

.github/workflows/desktop-macos-preview-publish.yml

@@ -284,6 +284,10 @@ jobs:
     concurrency:
       group: desktop-macos-preview-${{ needs.resolve.outputs.pr_number }}-build
       cancel-in-progress: true
+    # release-desktop.yml asks for actions: read (its Windows builds list artifacts).
+    permissions:
+      actions: read
+      contents: read
     uses: ./.github/workflows/release-desktop.yml
     secrets:
       CSC_LINK: ${{ secrets.CSC_LINK }}