chore: merge upstream/main while preserving fork features

.github/VOUCHED.td

@@ -25,6 +25,7 @@ github:D3OXY
 github:dbalders
 github:eggfriedrice24
 github:extoci
+github:f-trycua
 github:flamboh
 github:FllipEis
 github:gbarros-dev

.github/scripts/stage-preview-bundle.py

@@ -0,0 +1,76 @@
+"""Stage an untrusted preview ZIP without letting it replace packaging code."""
+
+import shutil
+import stat
+import sys
+import zipfile
+from pathlib import Path
+
+ROOTS = ("server/dist", "desktop/dist-electron")
+REQUIRED_FILES = {
+    "server/dist/bin.mjs",
+    "server/dist/client/index.html",
+    "desktop/dist-electron/main.cjs",
+}
+# The current bundle is about 32 MiB compressed. Bound extraction on the
+# trusted runner even when the PR replaces the uploader entirely.
+MAX_ARCHIVE_BYTES = 512 * 1024 * 1024
+MAX_EXPANDED_BYTES = 2 * 1024 * 1024 * 1024
+MAX_ENTRIES = 50_000
+
+
+def stage_bundle(archive: Path, destination: Path):
+    if archive.stat().st_size > MAX_ARCHIVE_BYTES:
+        raise ValueError("Preview archive is too large")
+    with zipfile.ZipFile(archive) as bundle:
+        entries = bundle.infolist()
+        if len(entries) > MAX_ENTRIES:
+            raise ValueError("Preview archive has too many entries")
+        if sum(entry.file_size for entry in entries) > MAX_EXPANDED_BYTES:
+            raise ValueError("Expanded preview bundle is too large")
+        seen = set()
+        files = set()
+        for entry in entries:
+            name = entry.filename.removesuffix("/")
+            parts = name.split("/")
+            # Reject ambiguous paths before normalization, including names
+            # that would alias on the macOS signing runner.
+            if (
+                entry.orig_filename != entry.filename
+                or any(part in ("", ".", "..") for part in parts)
+                or any(char in name for char in "\\:")
+                or not name.isascii()
+                or any(ord(char) < 32 or ord(char) == 127 for char in name)
+            ):
+                raise ValueError(f"Unsafe preview path: {entry.filename!r}")
+            allowed = any(name.startswith(root + "/") for root in ROOTS)
+            if entry.is_dir():
+                allowed |= any(root == name or root.startswith(name + "/") for root in ROOTS)
+            if not allowed:
+                raise ValueError(f"Unexpected preview path: {name!r}")
+            kind = stat.S_IFMT(entry.external_attr >> 16)
+            if kind not in (0, stat.S_IFDIR if entry.is_dir() else stat.S_IFREG):
+                raise ValueError(f"Non-regular preview entry: {name!r}")
+            if name.casefold() in seen:
+                raise ValueError(f"Duplicate preview path: {name!r}")
+            seen.add(name.casefold())
+            if not entry.is_dir():
+                files.add(name)
+        if not REQUIRED_FILES <= files:
+            raise ValueError("Preview bundle is missing required entry points")
+        # Validate all names before writing anything. This is a fresh directory
+        # outside the checkout; neither pre-existing links nor trusted files
+        # can be followed or overwritten. ZIP permissions are never restored.
+        destination.mkdir(parents=True, exist_ok=False)
+        for entry in entries:
+            target = destination / entry.filename
+            if entry.is_dir():
+                target.mkdir(parents=True, exist_ok=True)
+            else:
+                target.parent.mkdir(parents=True, exist_ok=True)
+                with bundle.open(entry) as source, target.open("xb") as output:
+                    shutil.copyfileobj(source, output)
+
+
+if __name__ == "__main__":
+    stage_bundle(Path(sys.argv[1]), Path(sys.argv[2]))

.github/scripts/stage-preview-bundle.test.py

@@ -0,0 +1,97 @@
+import importlib.util
+import stat
+import tempfile
+import unittest
+import zipfile
+from pathlib import Path
+from unittest.mock import patch
+
+spec = importlib.util.spec_from_file_location(
+    "stage_preview_bundle", Path(__file__).with_name("stage-preview-bundle.py")
+)
+staging = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(staging)
+
+
+class StagePreviewBundleTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.root = Path(self.temp.name)
+        self.archive = self.root / "bundle.zip"
+        self.destination = self.root / "staged"
+
+    def bundle(self, extra=(), missing=None):
+        with zipfile.ZipFile(self.archive, "w") as bundle:
+            for name in sorted(staging.REQUIRED_FILES - {missing}):
+                bundle.writestr(name, b"bundle data, never executed")
+            for name, content in extra:
+                bundle.writestr(name, content)
+
+    def stage(self):
+        staging.stage_bundle(self.archive, self.destination)
+
+    def test_preserves_valid_bundle_layout_and_bytes(self):
+        self.bundle([("server/", b""), ("server/dist/", b""),
+                     ("desktop/dist-electron/chunks/helper.cjs", b"chunk")])
+        self.stage()
+        for name in staging.REQUIRED_FILES:
+            self.assertEqual((self.destination / name).read_bytes(), b"bundle data, never executed")
+        self.assertEqual((self.destination / "desktop/dist-electron/chunks/helper.cjs").read_bytes(), b"chunk")
+
+    def test_rejects_builder_overwrite_and_unsafe_paths_before_writing(self):
+        for name in [
+            "desktop/node_modules/electron-builder/cli.js",
+            "desktop/package.json",
+            "server/dist/../../desktop/package.json",
+            "../package.json",
+            "/server/dist/absolute",
+            "server/dist/./alias",
+            "server/dist//alias",
+            "server/dist/back\\slash",
+            "server/dist/file:stream",
+            "server/dist/BIN.MJS",
+        ]:
+            with self.subTest(name=name):
+                self.bundle([(name, b"untrusted")])
+                with self.assertRaises(ValueError):
+                    self.stage()
+                self.assertFalse(self.destination.exists())
+
+    def test_rejects_links_and_special_files(self):
+        for mode in [stat.S_IFLNK, stat.S_IFIFO, stat.S_IFCHR]:
+            with self.subTest(mode=mode):
+                entry = zipfile.ZipInfo("server/dist/link")
+                entry.create_system = 3
+                entry.external_attr = (mode | 0o777) << 16
+                self.bundle([(entry, b"../../../desktop/node_modules")])
+                with self.assertRaises(ValueError):
+                    self.stage()
+                self.assertFalse(self.destination.exists())
+
+    def test_requires_entry_points(self):
+        self.bundle(missing="desktop/dist-electron/main.cjs")
+        with self.assertRaises(ValueError):
+            self.stage()
+        self.assertFalse(self.destination.exists())
+
+    def test_bounds_archive_size_expanded_size_and_entry_count(self):
+        for limit in ["MAX_ARCHIVE_BYTES", "MAX_EXPANDED_BYTES", "MAX_ENTRIES"]:
+            with self.subTest(limit=limit), patch.object(staging, limit, 1):
+                self.bundle()
+                with self.assertRaises(ValueError):
+                    self.stage()
+                self.assertFalse(self.destination.exists())
+
+    def test_refuses_existing_destination(self):
+        self.bundle()
+        self.destination.mkdir()
+        sentinel = self.destination / "trusted"
+        sentinel.write_text("untouched")
+        with self.assertRaises(FileExistsError):
+            self.stage()
+        self.assertEqual(sentinel.read_text(), "untouched")
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/workflows/ci.yml

@@ -88,6 +88,9 @@ jobs:
         run: |
           sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
 
+      - name: Test preview artifact validation
+        run: python3 -B .github/scripts/stage-preview-bundle.test.py
+
       - name: Test workflow scripts
         run: node --test .github/scripts/*.test.cjs
 

.gitignore

@@ -5,6 +5,7 @@ node_modules
 *.log
 *.tsbuildinfo
 apps/*/dist
+apps/*/dist-exe
 infra/*/dist
 .astro
 packages/*/dist

.macroscope/check-run-agents/effect-service-conventions.md

@@ -2,7 +2,7 @@
 title: Effect Service Conventions
 model: gpt-5-6-sol
 effort: medium
-input: full_diff
+input: incremental
 tools:
   - browse_code
   - modify_pr

.macroscope/check-run-agents/ui-consistency.md

@@ -1,8 +1,8 @@
 ---
 title: UI Consistency
-model: gpt-5-6-terra
+model: gpt-5-6-sol
 effort: medium
-input: full_diff
+input: incremental
 tools:
   - browse_code
   - modify_pr

AGENTS.md

@@ -79,8 +79,8 @@ The most common defect in this repo is a change that works on the path you teste
 - `vp i` installs. Worktrees get this from the t3.json setup script; if module resolution looks broken, it probably did not run.
 - `vp run dev` starts server and web. In a worktree, state defaults to that worktree's gitignored `.t3`, which deliberately outranks an ambient `T3CODE_HOME` so you cannot land on shared state by accident. An explicit `--home-dir` still wins.
 - Ports derive from the worktree path and are stable across restarts, but read the real ones from the `[dev-runner]` line since occupied ports shift.
-- Sharing over the tailnet is three steps: run `vp run dev --share` in the background, wait for the `pairingUrl:` line in its output, paste that full URL (token included) in your reply. Do not wire up `tailscale serve` by hand for this, and do not open the URL yourself.
-- The web app requires pairing. Hand over the pairing URL, not the bare origin. A URL without its token is useless to whoever you gave it to. If the token got consumed, mint a fresh one with `node apps/server/src/bin.ts pair` — note it carries standard scopes, while the startup URL carries admin scopes (needed for Settings → Connections management).
+- Sharing over the tailnet is three steps: run `vp run dev --share` in the background, wait for the `pairingUrl:` line in its output, then give that full URL to an unpaired browser. Do not wire up `tailscale serve` by hand, open the URL yourself, or consume the user's pairing link. A browser with the reusable dev cookie can use the bare origin. If a normal one-time token was consumed, mint a fresh one with `node apps/server/src/bin.ts pair`. It carries standard scopes, while the startup URL carries admin scopes needed for Connections settings.
+- To reuse web dev auth across worktrees, configure one fixed `T3CODE_DEV_AUTH_TOKEN` in the main checkout's gitignored `.env`. The `t3.json` setup links that file into worktrees. Never commit or publish the token or a startup URL. See [Reusable dev credential](docs/operations/development.md#reusable-dev-credential).
 - Stop what you started, by the PID you tracked. See rule 1.
 
 ## Test data

apps/desktop/scripts/electron-launcher.mjs

@@ -116,6 +116,8 @@ export function makeDevelopmentEnvironmentScript(environment) {
     ["T3CODE_COMMIT_HASH", environment.T3CODE_COMMIT_HASH],
     ["T3CODE_OTLP_TRACES_URL", environment.T3CODE_OTLP_TRACES_URL],
     ["T3CODE_OTLP_EXPORT_INTERVAL_MS", environment.T3CODE_OTLP_EXPORT_INTERVAL_MS],
+    ["T3CODE_OTLP_HEADERS", environment.T3CODE_OTLP_HEADERS],
+    ["T3CODE_OTLP_PROTOCOL", environment.T3CODE_OTLP_PROTOCOL],
     ["T3CODE_DESKTOP_APP_USER_MODEL_ID", APP_BUNDLE_ID],
   ].filter((entry) => typeof entry[1] === "string" && entry[1].trim().length > 0);
   return [

apps/desktop/scripts/electron-launcher.test.mjs

@@ -21,12 +21,17 @@ describe("electron development launcher", () => {
       VITE_DEV_SERVER_URL: "http://127.0.0.1:8526",
       T3CODE_PORT: "16566",
       T3CODE_HOME: "/tmp/t3",
+      T3CODE_OTLP_PROTOCOL: "http/protobuf",
     });
 
     assert.include(
       environmentScript,
       "if [ -z \"${VITE_DEV_SERVER_URL:-}\" ]; then export VITE_DEV_SERVER_URL='http://127.0.0.1:8526'; fi",
     );
+    assert.include(
+      environmentScript,
+      "if [ -z \"${T3CODE_OTLP_PROTOCOL:-}\" ]; then export T3CODE_OTLP_PROTOCOL='http/protobuf'; fi",
+    );
     assert.notInclude(environmentScript, "\nexport VITE_DEV_SERVER_URL=");
   });
 

apps/desktop/src/app/DesktopApp.ts

@@ -158,18 +158,43 @@ export const stopAllPoolInstances = Effect.fn("desktop.app.stopAllPoolInstances"
 );
 
 const bootstrap = Effect.gen(function* () {
-  const pool = yield* DesktopBackendPool.DesktopBackendPool;
-  const primaryBackend = yield* pool.primary;
   const state = yield* DesktopState.DesktopState;
   const environment = yield* DesktopEnvironment.DesktopEnvironment;
   const desktopSettings = yield* DesktopAppSettings.DesktopAppSettings;
-  const serverExposure = yield* DesktopServerExposure.DesktopServerExposure;
-  const wslBackend = yield* DesktopWslBackend.DesktopWslBackend;
   const desktopWindow = yield* DesktopWindow.DesktopWindow;
   const snapShot = yield* DesktopSnapShot.DesktopSnapShot;
   const appActivation = yield* DesktopAppActivation.DesktopAppActivation;
   yield* logBootstrapInfo("bootstrap start");
 
+  const settings = yield* desktopSettings.get;
+  // The renderer is served from the bundled client (or Vite in development)
+  // rather than through the local backend, so the window can open without one.
+  const electronProtocol = yield* ElectronProtocol.ElectronProtocol;
+  yield* electronProtocol.registerDesktopProtocol({
+    scheme: ElectronProtocol.getDesktopScheme(environment.isDevelopment),
+    ...(environment.isDevelopment
+      ? { targetOrigin: Option.getOrThrow(environment.devServerUrl) }
+      : { assetDirectory: environment.clientAssetsDir }),
+    clerkFrontendApiHostname: DesktopClerk.desktopClerkFrontendApiHostname,
+  });
+  yield* installDesktopIpcHandlers();
+  yield* logBootstrapInfo("bootstrap ipc handlers registered");
+
+  yield* snapShot.initialize;
+
+  if (!settings.localEnvironmentEnabled) {
+    yield* logBootstrapInfo("bootstrap skipping local environment (disabled in settings)");
+    if (!(yield* Ref.get(state.quitting))) {
+      yield* desktopWindow.createMainIfBackendReady;
+    }
+    return;
+  }
+
+  const pool = yield* DesktopBackendPool.DesktopBackendPool;
+  const primaryBackend = yield* pool.primary;
+  const serverExposure = yield* DesktopServerExposure.DesktopServerExposure;
+  const wslBackend = yield* DesktopWslBackend.DesktopWslBackend;
+
   if (environment.isDevelopment && Option.isNone(environment.configuredBackendPort)) {
     return yield* new DesktopDevelopmentBackendPortRequiredError();
   }
@@ -186,24 +211,13 @@ const bootstrap = Effect.gen(function* () {
     },
   );
 
-  const settings = yield* desktopSettings.get;
   if (settings.serverExposureMode !== environment.defaultDesktopSettings.serverExposureMode) {
     yield* logBootstrapInfo("bootstrap restoring persisted server exposure mode", {
       mode: settings.serverExposureMode,
     });
   }
   const serverExposureState = yield* serverExposure.configureFromSettings({ port: backendPort });
   const backendConfig = yield* serverExposure.backendConfig;
-  const electronProtocol = yield* ElectronProtocol.ElectronProtocol;
-  const rendererTarget = environment.isDevelopment
-    ? Option.getOrThrow(environment.devServerUrl)
-    : backendConfig.httpBaseUrl;
-  yield* electronProtocol.registerDesktopProtocol({
-    scheme: ElectronProtocol.getDesktopScheme(environment.isDevelopment),
-    targetOrigin: rendererTarget,
-    backendOrigin: backendConfig.httpBaseUrl,
-    clerkFrontendApiHostname: DesktopClerk.desktopClerkFrontendApiHostname,
-  });
   yield* logBootstrapInfo("bootstrap resolved backend endpoint", {
     baseUrl: backendConfig.httpBaseUrl.href,
   });
@@ -219,16 +233,13 @@ const bootstrap = Effect.gen(function* () {
       "bootstrap fell back to local-only because no advertised network host was available",
     );
   }
-  yield* snapShot.initialize;
-
-  yield* installDesktopIpcHandlers();
-  yield* logBootstrapInfo("bootstrap ipc handlers registered");
 
   if (!(yield* Ref.get(state.quitting))) {
-    // In wsl-only mode the renderer is served by the WSL backend, which can be
-    // slow to cold-boot — show a "Connecting to WSL" splash immediately so the
-    // app feels responsive instead of presenting no window until WSL is ready.
-    // (Dual mode opens fast off the Windows primary, so no splash there.)
+    // The main window waits for the primary backend. In wsl-only mode that is
+    // the WSL backend, which can be slow to cold-boot — show a "Connecting to
+    // WSL" splash immediately so the app feels responsive instead of presenting
+    // no window until WSL is ready. (Dual mode opens fast off the Windows
+    // primary, so no splash there.)
     if (settings.wslOnly === true && settings.wslBackendEnabled === true) {
       yield* desktopWindow.showConnectingSplash;
     }

apps/desktop/src/app/DesktopConfig.ts

@@ -1,3 +1,4 @@
+import { OtlpHeadersFromString, OtlpProtocol } from "@t3tools/shared/observability";
 import * as Config from "effect/Config";
 import * as ConfigProvider from "effect/ConfigProvider";
 import * as Option from "effect/Option";
@@ -48,6 +49,10 @@ export const DesktopConfig = Config.all({
   otlpExportIntervalMs: Config.int("T3CODE_OTLP_EXPORT_INTERVAL_MS").pipe(
     Config.withDefault(10_000),
   ),
+  otlpHeaders: Config.schema(OtlpHeadersFromString, "T3CODE_OTLP_HEADERS").pipe(Config.option),
+  otlpProtocol: Config.schema(OtlpProtocol, "T3CODE_OTLP_PROTOCOL").pipe(
+    Config.withDefault("http/json"),
+  ),
   appImagePath: trimmedString("APPIMAGE"),
   disableAutoUpdate: optionalBoolean("T3CODE_DISABLE_AUTO_UPDATE"),
   mockUpdates: optionalBoolean("T3CODE_DESKTOP_MOCK_UPDATES"),