chore: integrate upstream orchestration V2 into J5

.coderabbit.yaml

@@ -1,4 +1,4 @@
 reviews:
   review_status: false
   auto_review:
-    enabled: false
+    enabled: true

.devcontainer/devcontainer.json

@@ -1,29 +1,73 @@
+// Dev container for T3 Code. Mirrors CI (ubuntu-24.04, Node 24, Rust stable)
+// and the canonical setup in docs/operations/development.md: global `vp`, `vp i`.
+// Contributor doc: docs/internals/devcontainer.md
 {
-  "name": "T3 Code Dev",
-  "image": "debian:bookworm",
+  "name": "T3 Code",
+  "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04",
   "features": {
-    "ghcr.io/devcontainers/features/git:1": {},
-    "ghcr.io/devcontainers-extra/features/bun:1": {
-      "version": "1.3.11"
+    // nodeGypDependencies (default true) brings python3/make/g++, which Linux
+    // needs for node-pty's node-gyp fallback (its prebuilds are mac/win only).
+    "ghcr.io/devcontainers/features/node:2": {
+      "version": "24"
     },
-    "ghcr.io/devcontainers/features/node:1": {
-      "version": "24.13.1"
-    },
-    "ghcr.io/devcontainers/features/python:1": {
-      "version": "3.10",
-      "installTools": false
-    }
+    // native/resource-monitor (edition 2024, needs stable >= 1.85). The server
+    // degrades gracefully without the binary, but CI checks cargo fmt + test.
+    "ghcr.io/devcontainers/features/rust:1": {},
+    "ghcr.io/devcontainers/features/github-cli:1": {}
+  },
+  "hostRequirements": {
+    "cpus": 4,
+    "memory": "8gb",
+    "storage": "32gb"
+  },
+  "containerEnv": {
+    // Keep all runtime state inside the (gitignored) workspace .t3, matching
+    // the worktree default. An explicit --home-dir still wins.
+    "T3CODE_HOME": "${containerWorkspaceFolder}/.t3"
   },
-  "overrideFeatureInstallOrder": [
-    "ghcr.io/devcontainers/features/git",
-    "ghcr.io/devcontainers-extra/features/bun"
+  "mounts": [
+    // vp keeps the pnpm content-addressable store and metadata cache under
+    // ~/.cache/pnpm (verified: the v11 store dir lives there); mounting a
+    // volume there lets installs survive container rebuilds.
+    "source=t3code-pnpm-store,target=/home/vscode/.cache/pnpm,type=volume",
+    // Root node_modules holds the whole pnpm virtual store (.pnpm), so one
+    // volume keeps the heavy tree off the slow macOS/Windows bind mount.
+    // Scoped by devcontainerId so parallel checkouts do not share it.
+    // Codespaces note: prebuild snapshots exclude volumes; drop these mounts
+    // if prebuilt codespaces become the primary workflow.
+    "source=t3code-node-modules-${devcontainerId},target=${containerWorkspaceFolder}/node_modules,type=volume"
   ],
-  "postCreateCommand": {
-    "bun-install": "bun install --backend=copyfile --frozen-lockfile"
+  "onCreateCommand": "bash .devcontainer/on-create.sh",
+  "updateContentCommand": "bash .devcontainer/update-content.sh",
+  "forwardPorts": [5733, 13773],
+  "portsAttributes": {
+    "5733": {
+      "label": "t3 web (open via the pairing URL, not the bare origin)",
+      "onAutoForward": "notify"
+    },
+    "13773": {
+      "label": "t3 server",
+      "onAutoForward": "silent"
+    }
   },
   "customizations": {
+    "codespaces": {
+      "openFiles": ["docs/internals/devcontainer.md"]
+    },
     "vscode": {
-      "extensions": ["oxc.oxc-vscode"]
+      "extensions": ["oxc.oxc-vscode", "rust-lang.rust-analyzer"],
+      "settings": {
+        // .repos is a large vendored read-only reference tree; watching it
+        // burns CPU and file handles.
+        "files.watcherExclude": {
+          "**/.repos/**": true,
+          "**/.t3/**": true
+        },
+        "search.exclude": {
+          "**/.repos": true
+        }
+      }
     }
-  }
+  },
+  "remoteUser": "vscode"
 }

.devcontainer/on-create.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# One-time container setup, baked into prebuilds. Content-dependent work
+# (dependency install, Chromium) lives in update-content.sh.
+set -euo pipefail
+
+# The Vite+ CLI is the repo task runner (vp i, vp run dev, vp test run).
+# Download to a file first: a curl failure inside $( ) would yield an empty
+# script and a false success. VP_NODE_MANAGER=no skips the installer's node
+# shims; Node comes from the devcontainer feature. The VP_*_DIR group (set
+# together, absolute) pins the install location instead of the installer's
+# XDG platform defaults, which moved the binary from ~/.vite-plus/bin to
+# ~/.local/share/vite-plus/bin between releases and would break the check
+# below either way.
+export VP_BIN_DIR="$HOME/.local/share/vite-plus/bin"
+export VP_DATA_DIR="$HOME/.local/share/vite-plus"
+export VP_CACHE_DIR="$HOME/.cache/vite-plus"
+installer=$(mktemp)
+curl -fsSL https://vite.plus -o "$installer"
+VP_NODE_MANAGER=no bash "$installer"
+rm -f "$installer"
+
+# Non-login lifecycle shells never source the profile the installer edits,
+# so expose vp on the default PATH. test -x keeps a bad install loud.
+test -x "$VP_BIN_DIR/vp"
+sudo ln -sf "$VP_BIN_DIR/vp" /usr/local/bin/vp
+
+# First-run terminal notice, rendered by the devcontainers base image.
+sudo mkdir -p /usr/local/etc/vscode-dev-containers
+sudo tee /usr/local/etc/vscode-dev-containers/first-run-notice.txt >/dev/null <<'EOF'
+T3 Code devcontainer
+
+  vp run dev            start server + web, then open the pairing URL it
+                        prints (the bare forwarded port will not authenticate)
+  cp .env.example .env  optional: enable T3 Connect cloud features
+                        (public identifiers, not secrets)
+
+Details: docs/internals/devcontainer.md
+EOF

.devcontainer/update-content.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Runs at creation and on every prebuild content refresh, so codespaces start
+# with deps installed and caches warm. Everything here is idempotent.
+set -euo pipefail
+
+# Volume mounts (pnpm store, node_modules) and the directories docker creates
+# for them arrive root-owned; hand them to the dev user before installing.
+for dir in "$HOME/.cache" "$HOME/.cache/pnpm" node_modules; do
+  if [ -d "$dir" ] && [ "$(stat -c %U "$dir")" != "$(id -un)" ]; then
+    sudo chown "$(id -un):$(id -gn)" "$dir"
+  fi
+done
+
+CI=true vp i
+# Repairs electron's path.txt and exec bits after install, same as CI.
+vp run --filter @t3tools/desktop ensure:electron
+# Pre-warms Vite's dep optimizer (cache is keyed on the absolute path, which
+# is stable inside the container).
+node apps/web/scripts/warm-dep-cache.ts

.github/SECURITY.md

@@ -0,0 +1,8 @@
+# Security policy
+
+Report security vulnerabilities affecting T3 Code or T3 Tools-operated infrastructure to
+[security@ping.gg](mailto:security@ping.gg). Please do not disclose them publicly until we have had
+a reasonable opportunity to investigate and remediate them.
+
+See the [full security policy](https://t3.codes/security-policy) for reporting details, scope,
+and safe harbor terms for good-faith research.

.github/scripts/check-nightly-release.cjs

@@ -0,0 +1,67 @@
+const MINIMUM_RELEASE_GAP_MS = 6 * 60 * 60 * 1000;
+
+const isNightlyTag = (tag) => /^v.*-nightly\./.test(tag) || tag.startsWith("nightly-v");
+
+// Newest published nightly by publication time, or undefined when none exists.
+async function findLatestNightly({ github, context }) {
+  const releases = await github.paginate(github.rest.repos.listReleases, {
+    ...context.repo,
+    per_page: 100,
+  });
+  return releases
+    .filter((release) => !release.draft && release.published_at && isNightlyTag(release.tag_name))
+    .sort((a, b) => Date.parse(b.published_at) - Date.parse(a.published_at))[0];
+}
+
+// Runs after the workflow acquires the nightly concurrency lock.
+async function shouldReleaseNightly({ github, context, core, now = Date.now() }) {
+  const lastNightly = await findLatestNightly({ github, context });
+
+  if (!lastNightly) {
+    core.info("No published nightly found. Proceeding with release.");
+    return true;
+  }
+
+  if (now - Date.parse(lastNightly.published_at) < MINIMUM_RELEASE_GAP_MS) {
+    core.info(`Nightly ${lastNightly.tag_name} was published less than six hours ago. Skipping.`);
+    return false;
+  }
+
+  const { data: comparison } = await github.rest.repos.compareCommitsWithBasehead({
+    ...context.repo,
+    basehead: `${lastNightly.tag_name}...${context.sha}`,
+    per_page: 1,
+  });
+  if (comparison.status !== "ahead") {
+    core.info(
+      `Candidate commit is ${comparison.status} relative to ${lastNightly.tag_name}. Skipping.`,
+    );
+    return false;
+  }
+
+  core.info(`New commits since ${lastNightly.tag_name}, and the six-hour gap has passed.`);
+  return true;
+}
+
+// Stable releases build the commit the latest nightly shipped, so the stable
+// build is one nightly users already ran. Returns the nightly tag, its commit,
+// and the stable version that nightly was a preview of.
+async function resolveLatestNightlyCommit({ github, context, core }) {
+  const lastNightly = await findLatestNightly({ github, context });
+  if (!lastNightly) {
+    throw new Error("No published nightly found. Stable releases build the latest nightly commit.");
+  }
+
+  const tag = lastNightly.tag_name;
+  // repos.getCommit dereferences annotated tags, so this is the commit either way.
+  const { data: commit } = await github.rest.repos.getCommit({ ...context.repo, ref: tag });
+  const version = /^(?:nightly-)?v(\d+\.\d+\.\d+)-nightly\./.exec(tag)?.[1];
+  if (!version) {
+    throw new Error(`Cannot derive a stable version from nightly tag ${tag}.`);
+  }
+
+  core.info(`Latest nightly ${tag} shipped ${commit.sha} as a preview of ${version}.`);
+  return { tag, sha: commit.sha, version };
+}
+
+module.exports = { shouldReleaseNightly, resolveLatestNightlyCommit };

.github/scripts/check-nightly-release.test.cjs

@@ -0,0 +1,143 @@
+const assert = require("node:assert/strict");
+const test = require("node:test");
+const { shouldReleaseNightly } = require("./check-nightly-release.cjs");
+
+const now = Date.parse("2026-09-05T12:00:00Z");
+const hour = 60 * 60 * 1000;
+const nightly = (hoursAgo, overrides = {}) => ({
+  tag_name: "v1.0.1-nightly.20260905.123",
+  draft: false,
+  published_at: new Date(now - hoursAgo * hour).toISOString(),
+  ...overrides,
+});
+
+function fixture({ releases = [nightly(7)], comparisonStatus = "ahead" } = {}) {
+  const calls = [];
+  return {
+    calls,
+    options: {
+      now,
+      context: { repo: { owner: "example", repo: "app" }, sha: "new" },
+      core: { info() {} },
+      github: {
+        rest: {
+          repos: {
+            listReleases() {},
+            async compareCommitsWithBasehead(params) {
+              calls.push(params);
+              return { data: { status: comparisonStatus } };
+            },
+          },
+        },
+        async paginate() {
+          return releases;
+        },
+      },
+    },
+  };
+}
+
+test("releases the first nightly when no nightly is published", async () => {
+  const { options } = fixture({
+    releases: [nightly(0, { tag_name: "v1.0.0" }), nightly(0, { draft: true })],
+  });
+  assert.equal(await shouldReleaseNightly(options), true);
+});
+
+test("waits six hours after publication, including manual nightlies", async () => {
+  for (const age of [0, 3, 6 - 1 / 3600]) {
+    const { options, calls } = fixture({ releases: [nightly(age)] });
+    assert.equal(await shouldReleaseNightly(options), false);
+    assert.equal(calls.length, 0);
+  }
+});
+
+test("releases new commits at six hours and after an idle period", async () => {
+  for (const age of [6, 7, 24]) {
+    const { options } = fixture({ releases: [nightly(age)] });
+    assert.equal(await shouldReleaseNightly(options), true);
+  }
+});
+
+test("skips unchanged commits after the gap", async () => {
+  const { options } = fixture({ comparisonStatus: "identical" });
+  assert.equal(await shouldReleaseNightly(options), false);
+});
+
+test("uses publication time, not release order or the tagged commit date", async () => {
+  const { options } = fixture({
+    releases: [nightly(10), nightly(1), nightly(20, { tag_name: "nightly-v0.9.0" })],
+  });
+  assert.equal(await shouldReleaseNightly(options), false);
+});
+
+test("ignores stable releases and drafts when checking the gap", async () => {
+  const { options } = fixture({
+    releases: [nightly(0, { tag_name: "v1.0.0" }), nightly(0, { draft: true }), nightly(7)],
+  });
+  assert.equal(await shouldReleaseNightly(options), true);
+});
+
+test("compares against the published tag, including legacy nightly tags", async () => {
+  const tag = "nightly-v0.9.0";
+  const { options, calls } = fixture({ releases: [nightly(7, { tag_name: tag })] });
+  assert.equal(await shouldReleaseNightly(options), true);
+  assert.equal(calls[0].basehead, `${tag}...new`);
+});
+
+test("fails instead of releasing when GitHub cannot supply release state", async () => {
+  const { options } = fixture();
+  options.github.paginate = async () => {
+    throw new Error("GitHub unavailable");
+  };
+  await assert.rejects(shouldReleaseNightly(options), /GitHub unavailable/);
+});
+
+for (const status of ["behind", "diverged"]) {
+  test(`skips a candidate commit that is ${status} relative to the last nightly`, async () => {
+    const { options } = fixture({ comparisonStatus: status });
+    assert.equal(await shouldReleaseNightly(options), false);
+  });
+}
+
+const { resolveLatestNightlyCommit } = require("./check-nightly-release.cjs");
+
+function nightlyCommitFixture({ releases, commitSha = "abc123" }) {
+  const refs = [];
+  const { options } = fixture({ releases });
+  options.github.rest.repos.getCommit = async ({ ref }) => {
+    refs.push(ref);
+    return { data: { sha: commitSha } };
+  };
+  return { options, refs };
+}
+
+test("stable releases resolve the commit of the newest published nightly", async () => {
+  const { options, refs } = nightlyCommitFixture({
+    releases: [
+      nightly(10, { tag_name: "v1.0.1-nightly.20260905.100" }),
+      nightly(1, { tag_name: "v1.0.1-nightly.20260905.123" }),
+      nightly(0, { tag_name: "v1.0.0" }),
+      nightly(0, { draft: true, tag_name: "v1.0.1-nightly.20260905.999" }),
+    ],
+    commitSha: "deadbeef",
+  });
+  assert.deepEqual(await resolveLatestNightlyCommit(options), {
+    tag: "v1.0.1-nightly.20260905.123",
+    sha: "deadbeef",
+    version: "1.0.1",
+  });
+  assert.deepEqual(refs, ["v1.0.1-nightly.20260905.123"]);
+});
+
+test("stable releases derive the version from legacy nightly tags", async () => {
+  const { options } = nightlyCommitFixture({
+    releases: [nightly(1, { tag_name: "nightly-v0.9.0-nightly.20260905.5" })],
+  });
+  assert.equal((await resolveLatestNightlyCommit(options)).version, "0.9.0");
+});
+
+test("stable releases fail without a published nightly", async () => {
+  const { options } = nightlyCommitFixture({ releases: [nightly(0, { tag_name: "v1.0.0" })] });
+  await assert.rejects(resolveLatestNightlyCommit(options), /No published nightly/);
+});