chore: merge upstream/main into fork

.github/scripts/ci-changes.cjs

@@ -5,6 +5,8 @@
 //   node ci-changes.cjs --paths <file> --full   run every Linux job, gate only the macOS lint
 //   node ci-changes.cjs                         changed paths unknown: run everything
 //
+// scripts/check-changed.ts requires the same decisions so local runs match CI.
+//
 // Every changed path maps to workspace packages, which then pull in their
 // dependents from package.json. A path this file does not recognize runs
 // everything, so a new root file or directory can only cost minutes.
@@ -201,4 +203,6 @@ function main() {
   for (const [key, value] of Object.entries(outputs)) console.log(`${key}=${value}`);
 }
 
-main();
+module.exports = { readWorkspace, decide };
+
+if (require.main === module) main();

.github/scripts/ci-changes.d.cts

@@ -0,0 +1,27 @@
+interface WorkspacePackage {
+  readonly name: string;
+  readonly dir: string;
+  readonly hasTest: boolean;
+  readonly deps: ReadonlyArray<string>;
+}
+
+export function readWorkspace(): Array<WorkspacePackage>;
+
+export function decide(
+  files: ReadonlyArray<string> | null,
+  packages: ReadonlyArray<WorkspacePackage>,
+  full: boolean,
+): {
+  affected: Array<string>;
+  outputs: {
+    typecheck: boolean;
+    build: boolean;
+    test: boolean;
+    test_packages: string;
+    test_web: boolean;
+    test_server: boolean;
+    rust: boolean;
+    release_smoke: boolean;
+    mobile_native: boolean;
+  };
+};

.github/scripts/vercel-deployment-output.test.cjs

@@ -0,0 +1,87 @@
+const assert = require("node:assert/strict");
+const { spawnSync } = require("node:child_process");
+const { mkdtempSync, readFileSync, rmSync, existsSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+const { test } = require("node:test");
+
+const release = readFileSync(join(__dirname, "../workflows/release.yml"), "utf8");
+const preview = readFileSync(join(__dirname, "../workflows/web-preview.yml"), "utf8");
+const stepPattern =
+  /        name: (?:Build staged deployment|Deploy preview)\n        shell: bash\n        run: \|\n((?:          .*\n|\n)+)/g;
+const steps = [
+  ...Array.from(release.matchAll(stepPattern), (match, index) => [
+    index === 0 ? "hosted web" : "marketing",
+    match[1],
+  ]),
+  ...Array.from(preview.matchAll(stepPattern), (match) => ["web preview", match[1]]),
+];
+assert.equal(steps.length, 3, "Expected both release steps and the preview step");
+
+const url = "https://t3code-fixture-pinglabs.vercel.app";
+const warning = 'Error while parsing config file: "/runner/t3code/pnpm-lock.yaml"';
+
+function runStep(script, stdout, exitCode = 0) {
+  const directory = mkdtempSync(join(tmpdir(), "t3-vercel-output-"));
+  const outputFile = join(directory, "output");
+  try {
+    const result = spawnSync(
+      "bash",
+      [
+        "-c",
+        'vp() { printf "%s\\n" "$FIXTURE_STDOUT"; return "$FIXTURE_EXIT"; }\n' +
+          'curl() { printf \'{"id":"fixture-project"}\\n\'; }\n' +
+          script.replace(/^          /gm, "").replace(/\$\{\{.*?\}\}/g, "fixture"),
+      ],
+      {
+        encoding: "utf8",
+        env: {
+          PATH: process.env.PATH,
+          VERCEL_TOKEN: "fixture-token",
+          VERCEL_ORG_ID: "fixture-org",
+          VERCEL_PROJECT_ID: "fixture-project",
+          GITHUB_OUTPUT: outputFile,
+          FIXTURE_STDOUT: stdout,
+          FIXTURE_EXIT: String(exitCode),
+        },
+      },
+    );
+    assert.ifError(result.error);
+    return {
+      ...result,
+      output: existsSync(outputFile) ? readFileSync(outputFile, "utf8") : "",
+    };
+  } finally {
+    rmSync(directory, { recursive: true, force: true });
+  }
+}
+
+for (const [name, script] of steps) {
+  for (const [label, stdout] of [
+    ["plain URL", url],
+    ["lockfile warning", `${warning}\n${url}`],
+    ["trailing diagnostic", `${url}\nDone`],
+  ]) {
+    test(`${name}: saves one deployment URL after ${label}`, () => {
+      const result = runStep(script, stdout);
+      assert.equal(result.status, 0, result.stderr);
+      assert.deepEqual(
+        result.output.split("\n").filter((line) => !line.startsWith("project_id=")),
+        [`deployment_url=${url}`, ""],
+      );
+    });
+  }
+
+  for (const [label, stdout, exitCode] of [
+    ["missing URL", warning, 0],
+    ["invalid URL", "https://example.invalid/deployment", 0],
+    ["multiple URLs", `${url}\nhttps://other.vercel.app`, 0],
+    ["failed deployment", url, 1],
+  ]) {
+    test(`${name}: rejects ${label} without saving output`, () => {
+      const result = runStep(script, stdout, exitCode);
+      assert.notEqual(result.status, 0);
+      assert.equal(result.output, "");
+    });
+  }
+}

.github/workflows/ci.yml

@@ -256,7 +256,7 @@ jobs:
         run: python3 -B .github/scripts/stage-preview-bundle.test.py
 
       - name: Test release checks
-        run: node --test .github/scripts/check-nightly-release.test.cjs
+        run: node --test .github/scripts/check-nightly-release.test.cjs .github/scripts/vercel-deployment-output.test.cjs
 
       - name: Finish installing browser secret helper build libraries
         timeout-minutes: 5

.github/workflows/release-desktop.yml

@@ -253,18 +253,13 @@ jobs:
           if [[ "${{ inputs.version }}" =~ -nightly\.[0-9]{8}\.[0-9]+$ ]]; then brand=nightly; fi
           node scripts/apply-web-brand-assets.ts "$brand" apps/server/dist/client
 
-      # The single-executable is built with a Node that supports --build-sea
-      # (25.7+); the repo itself stays on the engines.node version. A native
-      # build injects into the runner's own Node; a Windows target downloads its
-      # node.exe.
+      # Setup Vite+ selects the exact engines.node version from package.json.
+      # Native builds embed that executable; cross-target builds download the
+      # same version for their target.
       - name: Build CLI single-executable
         if: inputs.cli_archive
         shell: bash
         env:
-          # The exact version, not a major: vp downloads it from nodejs.org/dist on
-          # the runner, and only exact versions have a dist directory. Keep in
-          # step with SEA_NODE_VERSION in apps/server/vite.config.ts.
-          VP_NODE_VERSION: "26.8.2"
           # The executable bundles the server again, so it needs the same stamp
           # as release.yml's JS bundle.
           T3CODE_TELEMETRY_CHANNEL: ${{ github.repository == 'pingdotgg/t3code' && inputs.release_channel || 'dev' }}

.github/workflows/release.yml

@@ -1072,7 +1072,7 @@ jobs:
           fi
 
           echo "Building hosted web app for $channel_name channel."
-          deployment_url="$(
+          deployment_output="$(
             vp dlx vercel@53.1.1 deploy \
               --archive=tgz \
               --prod \
@@ -1091,6 +1091,13 @@ jobs:
               --build-env "VITE_HOSTED_APP_URL=$router_url" \
               --build-env "VITE_HOSTED_APP_CHANNEL=$channel_name"
           )"
+          printf '%s\n' "$deployment_output"
+          # Vercel can print lockfile warnings to stdout before the deployment URL.
+          deployment_url="$(printf '%s\n' "$deployment_output" | grep -E '^https://[[:alnum:].-]+\.vercel\.app$')"
+          if [[ "$deployment_url" == *$'\n'* ]]; then
+            echo "Vercel returned multiple deployment URLs." >&2
+            exit 1
+          fi
           echo "Staged $deployment_url."
           echo "deployment_url=$deployment_url" >> "$GITHUB_OUTPUT"
 
@@ -1219,7 +1226,7 @@ jobs:
           )"
           export VERCEL_PROJECT_ID
 
-          deployment_url="$(
+          deployment_output="$(
             vp dlx vercel@53.1.1 deploy \
               --archive=tgz \
               --prod \
@@ -1228,6 +1235,13 @@ jobs:
               --token "$VERCEL_TOKEN" \
               --scope "${VERCEL_TEAM_SLUG:-$VERCEL_ORG_ID}"
           )"
+          printf '%s\n' "$deployment_output"
+          # Vercel can print lockfile warnings to stdout before the deployment URL.
+          deployment_url="$(printf '%s\n' "$deployment_output" | grep -E '^https://[[:alnum:].-]+\.vercel\.app$')"
+          if [[ "$deployment_url" == *$'\n'* ]]; then
+            echo "Vercel returned multiple deployment URLs." >&2
+            exit 1
+          fi
           echo "Staged $deployment_url."
           echo "deployment_url=$deployment_url" >> "$GITHUB_OUTPUT"
           echo "project_id=$VERCEL_PROJECT_ID" >> "$GITHUB_OUTPUT"

.github/workflows/web-preview.yml

@@ -77,13 +77,20 @@ jobs:
 
           vercel_scope="${VERCEL_TEAM_SLUG:-$VERCEL_ORG_ID}"
 
-          deployment_url="$(
+          deployment_output="$(
             vp dlx vercel@53.1.1 deploy \
               --archive=tgz \
               --yes \
               --token "$VERCEL_TOKEN" \
               --scope "$vercel_scope"
           )"
+          printf '%s\n' "$deployment_output"
+          # Vercel can print lockfile warnings to stdout before the deployment URL.
+          deployment_url="$(printf '%s\n' "$deployment_output" | grep -E '^https://[[:alnum:].-]+\.vercel\.app$')"
+          if [[ "$deployment_url" == *$'\n'* ]]; then
+            echo "Vercel returned multiple deployment URLs." >&2
+            exit 1
+          fi
 
           echo "Deployed $deployment_url"
           echo "deployment_url=$deployment_url" >> "$GITHUB_OUTPUT"

.pnpmfile.cjs

@@ -5,6 +5,15 @@
 // Release scripts stage their own installs with explicit architectures.
 module.exports = {
   hooks: {
+    // `typescript` is @tsc-rs/typescript (the catalog entry). Its npm version (0.8.x) is outside
+    // vite-plus-core's typescript peer range, so pnpm gave the vite-plus that @effect/vitest
+    // imports apps/marketing's typescript@6.0.3 instead, and tests loaded a second vitest.
+    readPackage(pkg) {
+      if (pkg.name === "@voidzero-dev/vite-plus-core" && pkg.peerDependencies?.typescript) {
+        pkg.peerDependencies.typescript = "*";
+      }
+      return pkg;
+    },
     updateConfig(config) {
       // oxlint-disable-next-line t3code/no-global-process-runtime -- pnpm loads this file before any Effect runtime exists.
       if (process.platform !== "win32") return config;

.vercelignore

@@ -0,0 +1,2 @@
+# Vercel's default .pnp* rule also excludes pnpm's hook, whose checksum is in the lockfile.
+!/.pnpmfile.cjs

AGENTS.md

@@ -98,12 +98,14 @@ An empty database is a bad test. Seed your worktree's `.t3` with a copy of real
 
 ## Verifying
 
-- Smallest proof that the change works. `vp test run <files>` for the tests you touched (`-t "<name>"` in big files), `vp lint <files>`, and `vp run typecheck` in the package you changed. Not `npx tsc`; it is 3x slower than tsc-rs.
-- Run `vp run knip:check` (about 35 s) when you add, remove, or rename exports, files, or dependencies.
+- Before you push, run `vp run check:changed`. It runs CI's fast checks for changed files: format, lint, knip, typecheck of affected packages and dependents, and tests beside changes. CI still runs the full test suites.
+- While you iterate, run `vp test run <files>`. For big files, add `-t "<name>"`.
+- Use `vp run typecheck`, not `npx tsc`; it caches per package. Both run tsc-rs (`typescript` is the `@tsc-rs/typescript` drop-in).
 - Run `node -e` snippets from `apps/server` or the owning package. `effect` does not resolve from the repo root.
 - Test meaningful logic or observable behavior. Do not render components to static markup to assert props or attributes, or add tests that merely assert callback wiring or mirror the implementation.
 - **Do not run repo-wide checks.** No `vp check`, no `vp run -r test`, no `vp run -r typecheck` unless I ask. CI owns the full suite.
 - Backend behavior changes ship with focused tests for that behavior.
+- Proof for a bug fix depends on the bug. Logic, data, state, and protocol bugs get a failing test first (the fewest that fail on `main` for that reason, in the module's existing test file), then the fix. Purely visual bugs (spacing, colour, alignment, a layout shift) get before/after captures as their proof and no test: do not add UI tests for nitpicks, and do not ask for one in review when a capture already shows it. A server-only fix with no visible surface ships the test plus a short runtime transcript.
 - The server is event-sourced, and side effects run after the command commits. In tests, drain the effect worker (`OrchestrationEffectWorkerV2.drain`) or await the specific persisted event or `Deferred` that marks the milestone. Never wait on sleeps or polling. A test that needs a timeout to pass is wrong. Concretely:
   - `it.effect` runs on a `TestClock`; `Effect.sleep` only advances through `TestClock.adjust`. `it.live` is wall-clock and only for subprocess or network fixtures.
   - No `yieldNow` or `sleep` polling loops. Await the `Deferred`, take from the `Queue`, or drain the worker.
@@ -184,7 +186,7 @@ Architecture and its constraints: `docs/internals/overview.md`. Glossary: `docs/
 - `packages/contracts` - Effect/Schema contracts plus small derived helpers. No heavy runtime logic.
 - `packages/shared` - shared runtime utils, subpath exports, no barrel.
 - `packages/client-runtime` - client code shared by web and mobile.
-- `.repos/` - vendored read-only references. Prefer their patterns over invented ones. Never edit or import from them. Sync with `vpr sync:repos` when bumping the matching dependency.
+- `.repos/` - vendored read-only references. Prefer their patterns over invented ones. Never edit or import from them. Sync with `vpr sync:repos` when bumping the matching dependency. If it is missing (sparse checkout), read a file with `git show origin/main:.repos/<path>`.
 
 ## Taste
 

apps/desktop/vite.config.ts

@@ -43,9 +43,9 @@ export default defineConfig({
         dependsOn: ["t3#build"],
         cache: false,
       },
-      // tsc-rs rewrites the tsbuildinfo it reads, which keeps a task out of the cache.
+      // tsc (tsc-rs) rewrites the tsbuildinfo it reads, which keeps a task out of the cache.
       typecheck: {
-        command: "tsc-rs --noEmit",
+        command: "tsc --noEmit",
         cache: { input: [{ auto: true }, "!*.tsbuildinfo"] },
       },
     },