chore(coil): merge upstream/main 960d5761c1 (57 commits)

.agents/skills/test-t3-mobile/SKILL.md

@@ -38,8 +38,8 @@ This installs the dev client for the checkout's native fingerprint: from the
 device, the local cache, or the shared cache in seconds, building once only
 when no machine has that fingerprint yet (5-15 minutes, logged to the file it
 names). The device id may be omitted when exactly one device is booted. It
-prints one JSON line; on failure it names the next command. Authorized mobile
-verification includes that step unless the user prohibits it.
+prints one JSON line; on failure it names the next command. Mobile verification
+includes that step unless the user prohibits it.
 
 For a device you opened in an agent-device session elsewhere (a device pool,
 cloud, or remote host), run `vp run mobile:install <ios|android> --session <s>`

.github/VOUCHED.td

@@ -59,6 +59,7 @@ github:myacoub91
 github:naMqe-h
 github:nateEc
 github:naveed949
+github:nexxeln
 github:nmggithub
 github:Noojuno
 github:notkainoa

.github/workflows/agent-context-budget.yml

@@ -51,5 +51,5 @@ jobs:
             echo "Accepted by the agent-context-increase label."
             exit 0
           fi
-          echo "::error file=$BUDGET::Agent context grew compared to main. Cut the added text, or ask a maintainer to add the agent-context-increase label."
+          echo "::error file=$BUDGET::Agent context grew compared to main. Cut the added text and rerun the evals that cover it (evals/README.md), or ask a maintainer to add the agent-context-increase label."
           exit 1

.github/workflows/mobile-fingerprint-label.yml

@@ -0,0 +1,189 @@
+name: Mobile Fingerprint Label
+
+# Trusted half of mobile-fingerprint-check.yml. That workflow runs PR code
+# (fork PRs included) with a read-only token and records which platforms'
+# fingerprints changed. This one runs from main with a write token and syncs
+# the "📱 Native Change" label. It never checks out or runs PR code.
+#
+# A PR can edit the check workflow it runs under, so the recorded result is
+# untrusted data: it is validated, and at worst a PR mislabels itself.
+
+on:
+  workflow_run:
+    workflows: [Mobile Fingerprint Check]
+    types: [completed]
+
+permissions:
+  contents: read
+
+jobs:
+  label:
+    name: Sync native change label
+    # A cancelled run was superseded by a newer push, whose run labels instead.
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - id: pr
+        name: Resolve the pull request behind the check
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          script: |
+            const run = context.payload.workflow_run;
+            const { owner, repo } = context.repo;
+
+            const artifacts = await github.paginate(github.rest.actions.listWorkflowRunArtifacts, {
+              owner,
+              repo,
+              run_id: run.id,
+              per_page: 100,
+            });
+            const results = artifacts.filter(
+              (artifact) => artifact.name === "fingerprint-result" && !artifact.expired,
+            );
+            if (results.length !== 1) {
+              core.info(`Expected one fingerprint-result artifact; found ${results.length}. Skipping.`);
+              return;
+            }
+
+            // workflow_run.pull_requests and the commit-to-PR lookup are both
+            // empty for fork PRs, so list open PRs by head owner and branch.
+            // Requiring the PR's current head to be the checked commit keeps a
+            // slow run for an older push from overwriting a newer result.
+            const open = await github.paginate(github.rest.pulls.list, {
+              owner,
+              repo,
+              state: "open",
+              head: `${run.head_repository?.owner?.login}:${run.head_branch}`,
+              per_page: 100,
+            });
+            const matching = open.filter(
+              (candidate) =>
+                candidate.state === "open" &&
+                candidate.head.sha === run.head_sha &&
+                candidate.head.ref === run.head_branch &&
+                candidate.head.repo?.full_name === run.head_repository?.full_name,
+            );
+            if (matching.length !== 1) {
+              core.info(`Expected one open PR at ${run.head_sha}; found ${matching.length}. Skipping.`);
+              return;
+            }
+
+            core.setOutput("artifact_id", String(results[0].id));
+            core.setOutput("pr_number", String(matching[0].number));
+
+      # Read the archive as bytes; never extract PR-produced files into a
+      # workspace this job runs code from.
+      - id: result
+        name: Read changed platforms
+        if: steps.pr.outputs.pr_number != ''
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ARTIFACT_ID: ${{ steps.pr.outputs.artifact_id }}
+        run: |
+          set -euo pipefail
+          gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts/${ARTIFACT_ID}/zip" > "$RUNNER_TEMP/fingerprint-result.zip"
+          changed="$(unzip -p "$RUNNER_TEMP/fingerprint-result.zip" changed-platforms)"
+          if [[ ! "$changed" =~ ^((ios|android)( (ios|android))?)?$ ]]; then
+            echo "Unexpected changed-platforms value '$changed'." >&2
+            exit 1
+          fi
+          echo "changed_platforms=$changed" >> "$GITHUB_OUTPUT"
+
+      - name: Sync native change label
+        if: steps.pr.outputs.pr_number != ''
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        env:
+          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
+          CHANGED_PLATFORMS: ${{ steps.result.outputs.changed_platforms }}
+        with:
+          script: |
+            const managedLabel = {
+              name: "📱 Native Change",
+              color: "d93f0b",
+              description:
+                "Changes the native fingerprint; merging blocks production OTAs until a new store build ships.",
+            };
+            const nativeChanged = (process.env.CHANGED_PLATFORMS ?? "").trim() !== "";
+            const issueNumber = Number(process.env.PR_NUMBER);
+
+            try {
+              const { data: existing } = await github.rest.issues.getLabel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                name: managedLabel.name,
+              });
+
+              if (
+                existing.color !== managedLabel.color ||
+                (existing.description ?? "") !== managedLabel.description
+              ) {
+                await github.rest.issues.updateLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  name: managedLabel.name,
+                  color: managedLabel.color,
+                  description: managedLabel.description,
+                });
+              }
+            } catch (error) {
+              if (error.status !== 404) {
+                throw error;
+              }
+
+              try {
+                await github.rest.issues.createLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  name: managedLabel.name,
+                  color: managedLabel.color,
+                  description: managedLabel.description,
+                });
+              } catch (createError) {
+                if (createError.status !== 422) {
+                  throw createError;
+                }
+              }
+            }
+
+            const { data: currentLabels } = await github.rest.issues.listLabelsOnIssue({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issueNumber,
+              per_page: 100,
+            });
+            const hasLabel = currentLabels.some((label) => label.name === managedLabel.name);
+
+            if (nativeChanged && !hasLabel) {
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issueNumber,
+                labels: [managedLabel.name],
+              });
+            } else if (!nativeChanged && hasLabel) {
+              try {
+                await github.rest.issues.removeLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issueNumber,
+                  name: managedLabel.name,
+                });
+              } catch (removeError) {
+                if (removeError.status !== 404) {
+                  throw removeError;
+                }
+              }
+            }
+
+            core.info(
+              `PR #${issueNumber}: native fingerprint ${nativeChanged ? `changed (${process.env.CHANGED_PLATFORMS})` : "unchanged"}`,
+            );

AGENTS.md

@@ -98,7 +98,7 @@ An empty database is a bad test. Seed your worktree's `.t3` with a copy of real
 
 ## Verifying
 
-- Before you push, run `vp run check:changed`. It runs CI's fast checks for changed files: format, lint, knip, typecheck of affected packages and dependents, and tests beside changes. CI still runs the full test suites.
+- Before you push, run `vp run check:changed`. It runs CI's fast checks for changed files: format, lint, knip, typecheck of affected packages and dependents, tests beside changes, and the cross-file checks those miss. CI still runs the full test suites.
 - While you iterate, run `vp test run <files>`. For big files, add `-t "<name>"`.
 - Use `vp run typecheck`, not `npx tsc`; it caches per package. Both run tsc-rs (`typescript` is the `@tsc-rs/typescript` drop-in).
 - Run `node -e` snippets from `apps/server` or the owning package. `effect` does not resolve from the repo root.
@@ -135,11 +135,11 @@ An empty database is a bad test. Seed your worktree's `.t3` with a copy of real
   });
   ```
 
-- Upon request, user-visible frontend changes should get one integrated pass in a real client: `test-t3-app` for web, `test-t3-mobile` for mobile. The primary agent does this once after integrating. Subagents do not launch their own dev servers. Ask permission before doing computer use or spinning up browsers.
+- User-visible frontend changes should get one integrated pass in a real client: `test-t3-app` for web, `test-t3-mobile` for mobile. The primary agent does this once after integrating. Subagents do not launch their own dev servers.
 
 - Real agent turns cost money. To watch a turn stream through the pipeline and UI, use the free `Replay (dev)` provider that `vp run dev` registers; [test-t3-app](.agents/skills/test-t3-app/SKILL.md) shows how to start one. Use a real provider only when the change depends on that provider's behavior, and then pick its cheapest model, such as Haiku for Claude or Luna for Codex.
 
-For authorized mobile verification, a missing or outdated native client is an install step, not a blocker. Run `vp run mobile:install <ios|android> [device-id]` on the device host before starting Metro; it targets the only booted simulator or connected Android device when the id is omitted. It installs the dev client for this checkout's native fingerprint from the shared cache in seconds and builds only when no machine has built it yet, so prefer it over `expo run:*`, `xcodebuild`, or `gradlew`, which rebuild from scratch. Its stdout is one JSON line; build output goes to the log it names. See `test-t3-mobile` for the full workflow.
+For mobile verification, a missing or outdated native client is an install step, not a blocker. Run `vp run mobile:install <ios|android> [device-id]` on the device host before starting Metro; it targets the only booted simulator or connected Android device when the id is omitted. It installs the dev client for this checkout's native fingerprint from the shared cache in seconds and builds only when no machine has built it yet, so prefer it over `expo run:*`, `xcodebuild`, or `gradlew`, which rebuild from scratch. Its stdout is one JSON line; build output goes to the log it names. See `test-t3-mobile` for the full workflow.
 
 ## Evals
 
@@ -215,5 +215,4 @@ Architecture and its constraints: `docs/internals/overview.md`. Glossary: `docs/
 
 ## Additional tips
 
-- Don't verify with browsers or computer use unless the user explicitly agrees or requests it.
 - Security is important, but should not be over-indexed on, especially for dev mode/maintainer-only features.

README.md

@@ -84,6 +84,16 @@ yay -S t3code-nightly-bin
 
 The AUR packaging is maintained in this repository under [`packaging/aur`](./packaging/aur).
 
+#### Nix (nixpkgs)
+
+```bash
+nix profile add github:NixOS/nixpkgs/nixos-unstable#t3code
+```
+
+The package is maintained in [nixpkgs](https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/t3/t3code)
+and includes the desktop app (`t3code-desktop`) and the `t3` command.
+See [Nix installation](./docs/user/install.md#nix-nixpkgs) for NixOS configuration and updates.
+
 ## Some notes
 
 We are very very early in this project. Expect bugs.

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t3tools/desktop",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "private": true,
   "type": "module",
   "main": "dist-electron/boot.cjs",
@@ -22,7 +22,7 @@
     "@t3tools/tailscale": "workspace:*",
     "dbus-next": "0.10.2",
     "effect": "catalog:",
-    "electron": "44.9.3",
+    "electron": "44.10.0",
     "electron-store": "^8.2.0",
     "electron-updater": "^6.8.9",
     "electron-webauthn": "catalog:",

apps/desktop/src/coil/updateDelivery/UpdateDelivery.ts

@@ -93,7 +93,7 @@ type DeliveryServices =
   | FileSystem.FileSystem
   | HttpClient.HttpClient;
 
-export const make = Effect.gen(function* () {
+const make = Effect.gen(function* () {
   const environment = yield* DesktopEnvironment.DesktopEnvironment;
   const fileSystem = yield* FileSystem.FileSystem;
   const electronWindow = yield* ElectronWindow.ElectronWindow;

apps/desktop/src/coil/updateDelivery/connectionHealth.ts

@@ -26,7 +26,7 @@ export const WATCHDOG_TIMEOUT_MS = SERVER_HEARTBEAT_INTERVAL_MS * 2.5;
 export const FLOOR_POLL_INTERVAL_MS = 15 * 60_000;
 
 /** Reconnect backoff. Capped low because the relay closes streams every 15 min by design. */
-export const RECONNECT_BASE_DELAY_MS = 1_000;
+const RECONNECT_BASE_DELAY_MS = 1_000;
 export const RECONNECT_MAX_DELAY_MS = 60_000;
 
 export type ConnectionVerdict =

apps/desktop/src/coil/updateDelivery/decision.ts

@@ -19,7 +19,7 @@ import {
  * fails during a build. It must never be treated as a commit hash — an app that believes its own
  * commit is "unknown" differs from every real manifest and would update on every payload, forever.
  */
-export const UNKNOWN_COMMIT_HASH = "unknown";
+const UNKNOWN_COMMIT_HASH = "unknown";
 
 export interface InstalledBuild {
   /** From `DesktopAppIdentity`. Absent for any build that has no embedded hash. */

apps/desktop/src/coil/updateDelivery/manifest.ts

@@ -57,7 +57,6 @@ export const UpdateManifest = Schema.Struct({
 });
 export type UpdateManifest = typeof UpdateManifest.Type;
 
-export const decodeUpdateManifest = Schema.decodeUnknownEffect(UpdateManifest);
 export const decodeUpdateManifestJson = Schema.decodeEffect(Schema.fromJsonString(UpdateManifest));
 
 export function findAssetForPlatform(

apps/desktop/src/coil/updateDelivery/restart.ts

@@ -18,7 +18,7 @@ import * as DesktopShutdown from "../../app/DesktopShutdown.ts";
  * enough that a hung one costs the user ten seconds rather than their whole session. The relaunch
  * is armed before the timer starts, so a forced exit still comes back up.
  */
-export const SHUTDOWN_GRACE = Duration.seconds(10);
+const SHUTDOWN_GRACE = Duration.seconds(10);
 
 export type RestartOutcome = "graceful" | "forced-after-timeout";
 

apps/desktop/src/ipc/methods/updates.ts

@@ -23,11 +23,14 @@ export const getUpdateState = DesktopIpc.makeIpcMethod({
 
 export const setUpdateChannel = DesktopIpc.makeIpcMethod({
   channel: IpcChannels.UPDATE_SET_CHANNEL_CHANNEL,
-  payload: DesktopUpdateChannelSchema,
+  payload: Schema.Struct({
+    channel: DesktopUpdateChannelSchema,
+    minimumVersion: Schema.optional(Schema.String),
+  }),
   result: DesktopUpdateStateSchema,
-  handler: Effect.fn("desktop.ipc.updates.setChannel")(function* (channel) {
+  handler: Effect.fn("desktop.ipc.updates.setChannel")(function* ({ channel, minimumVersion }) {
     const updates = yield* DesktopUpdates.DesktopUpdates;
-    return yield* updates.setChannel(channel);
+    return yield* updates.setChannel(channel, { minimumVersion });
   }),
 });
 
@@ -43,11 +46,14 @@ export const downloadUpdate = DesktopIpc.makeIpcMethod({
 
 export const installUpdate = DesktopIpc.makeIpcMethod({
   channel: IpcChannels.UPDATE_INSTALL_CHANNEL,
-  payload: Schema.Void,
+  /** A version installs only that downloaded build, never one that replaced it. */
+  payload: Schema.UndefinedOr(Schema.String),
   result: DesktopUpdateActionResultSchema,
-  handler: Effect.fn("desktop.ipc.updates.install")(function* () {
+  handler: Effect.fn("desktop.ipc.updates.install")(function* (expectedVersion) {
     const updates = yield* DesktopUpdates.DesktopUpdates;
-    return yield* updates.install;
+    if (expectedVersion === undefined) return yield* updates.install;
+    const { accepted, completed, state } = yield* updates.installPrepared(expectedVersion);
+    return { accepted, completed, state };
   }),
 });
 

apps/desktop/src/preload.ts

@@ -278,11 +278,12 @@ contextBridge.exposeInMainWorld("desktopBridge", {
     };
   },
   getUpdateState: () => ipcRenderer.invoke(IpcChannels.UPDATE_GET_STATE_CHANNEL),
-  setUpdateChannel: (channel) =>
-    ipcRenderer.invoke(IpcChannels.UPDATE_SET_CHANNEL_CHANNEL, channel),
+  setUpdateChannel: (channel, minimumVersion) =>
+    ipcRenderer.invoke(IpcChannels.UPDATE_SET_CHANNEL_CHANNEL, { channel, minimumVersion }),
   checkForUpdate: () => ipcRenderer.invoke(IpcChannels.UPDATE_CHECK_CHANNEL),
   downloadUpdate: () => ipcRenderer.invoke(IpcChannels.UPDATE_DOWNLOAD_CHANNEL),
-  installUpdate: () => ipcRenderer.invoke(IpcChannels.UPDATE_INSTALL_CHANNEL),
+  installUpdate: (expectedVersion) =>
+    ipcRenderer.invoke(IpcChannels.UPDATE_INSTALL_CHANNEL, expectedVersion),
   cliCommand: {
     getState: () => ipcRenderer.invoke(IpcChannels.CLI_COMMAND_GET_STATE_CHANNEL),
     install: () => ipcRenderer.invoke(IpcChannels.CLI_COMMAND_INSTALL_CHANNEL),

apps/desktop/src/settings/DesktopAppSettings.ts

@@ -22,7 +22,7 @@ import {
   normalizeLinuxPasswordStorePreference,
   type LinuxPasswordStorePreference,
 } from "../linuxSecretStorage.ts";
-import { resolveDefaultDesktopUpdateChannel } from "../updates/updateChannels.ts";
+import { desktopUpdateChannelOf } from "@t3tools/shared/cliRelease";
 import { isValidDistroName } from "../wsl/wslPathParsing.ts";
 
 export interface DesktopSettings {
@@ -180,7 +180,7 @@ export class DesktopAppSettings extends Context.Service<
 export function resolveDefaultDesktopSettings(appVersion: string): DesktopSettings {
   return {
     ...DEFAULT_DESKTOP_SETTINGS,
-    updateChannel: resolveDefaultDesktopUpdateChannel(appVersion),
+    updateChannel: desktopUpdateChannelOf(appVersion),
   };
 }