fix(acp): keep idle permissions on their session policy

.agents/skills/test-t3-app/SKILL.md

@@ -5,10 +5,10 @@ description: Test T3 Code's web and desktop UI through its built-in Browser pane
 
 # Test T3 web and desktop
 
-Use T3's built-in Browser panel for verification. If its tools are absent or
-the panel reports unavailable, explain the blocker and stop verification.
-Do not install or switch to another automation system. For native mobile
-testing, use [test-t3-mobile](../test-t3-mobile/SKILL.md).
+Use T3's built-in Browser panel for verification. Follow the recovery steps
+below before declaring it unavailable. Do not install or switch to another
+automation system. For native mobile testing, use
+[test-t3-mobile](../test-t3-mobile/SKILL.md).
 
 ## Start the app
 
@@ -36,8 +36,13 @@ model, such as Haiku for Claude or Luna for Codex.
 
 ## Use the Browser panel
 
-Call `preview_status`, then `preview_open` if the Browser panel is
-closed. Navigate to the complete startup pairing URL once with
+Call `preview_status`. If no tab can be automated, call `preview_open`, including
+when status reports `available: false` or `tabId: null`. Status can report
+unavailable simply because no tab exists yet; opening a tab needs no user action.
+Stop verification and explain the blocker only if the tools are absent or
+`preview_open` reports unavailable or fails.
+
+Navigate to the complete startup pairing URL once with
 `preview_navigate`, then use `preview_snapshot` and T3's interaction tools.
 If the token was consumed or expired, run `node apps/server/src/bin.ts pair`
 for a fresh one. Keep using the same tab.

.github/scripts/ci-changes.cjs

@@ -14,7 +14,7 @@ const INERT = [
 
 // Shared test setup and vendored mobile dependencies affect every package.
 const RUNS_EVERYTHING = [
-  /^packages\/shared\/src\/(HostProcess|testing\/longTempDir)\.ts$/,
+  /^packages\/shared\/src\/(HostProcess|testing\/(longTempDir|providerEnv))\.ts$/,
   /^apps\/mobile\/deps\//,
 ];
 
@@ -27,6 +27,8 @@ const EXTRA_OWNERS = [
   [/^native\/browser-secret\//, ["@t3tools/desktop"]],
   [/^native\/kde-snap-shot\//, ["@t3tools/desktop"]],
   [/^native\/libghostty-vt\//, ["@t3tools/web"]],
+  // apps/server/src/cloud/ConnectReachability.test.ts checks the guide's headings.
+  [/^docs\/user\/t3-connect-troubleshooting\.md$/, ["t3"]],
 ];
 const RUST = /^native\/(resource-monitor|kde-snap-shot|hyprland-snap-shot)\//;
 
@@ -92,11 +94,11 @@ function readWorkspace() {
 
 // [] means inert; null means unknown and requires every job.
 function ownersOf(file, packages) {
-  if (INERT.some((pattern) => pattern.test(file))) return [];
+  const extra = EXTRA_OWNERS.flatMap(([pattern, names]) => (pattern.test(file) ? names : []));
+  if (INERT.some((pattern) => pattern.test(file))) return extra;
   // A manifest can change dependencies or versions other packages read.
   if (path.posix.basename(file) === "package.json") return null;
   if (RUNS_EVERYTHING.some((pattern) => pattern.test(file))) return null;
-  const extra = EXTRA_OWNERS.flatMap(([pattern, names]) => (pattern.test(file) ? names : []));
   // scripts/build-desktop-artifact.test.ts reads the crates' sources.
   if (RUST.test(file)) return ["@t3tools/scripts", ...extra];
 

.github/scripts/thread-transfer-report.cjs

@@ -300,18 +300,28 @@ async function resolve({ github, context, core }) {
     core.setOutput("publish", "false");
     return;
   }
-  const workflowRuns = await github.paginate(github.rest.actions.listWorkflowRuns, {
-    owner,
-    repo,
-    workflow_id: source.workflow_id,
-    branch: pull.base.ref,
-    event: "push",
-    status: "success",
-    per_page: 100,
-  });
+  // One page each for the exact base and the newest runs; paging through
+  // every successful main run costs up to ten requests to keep 20.
+  const listRuns = async (filters) => {
+    const { data } = await github.rest.actions.listWorkflowRuns({
+      owner,
+      repo,
+      workflow_id: source.workflow_id,
+      branch: pull.base.ref,
+      event: "push",
+      status: "success",
+      per_page: 20,
+      ...filters,
+    });
+    return data.workflow_runs;
+  };
+  const [baseRuns, recentRuns] = await Promise.all([
+    listRuns({ head_sha: pull.base.sha }),
+    listRuns({}),
+  ]);
   const orderedRuns = [
-    ...workflowRuns.filter((run) => run.head_sha === pull.base.sha),
-    ...workflowRuns.filter((run) => run.head_sha !== pull.base.sha),
+    ...baseRuns,
+    ...recentRuns.filter((run) => run.head_sha !== pull.base.sha),
   ].slice(0, 20);
 
   let baselineRun;

.github/scripts/thread-transfer-report.test.cjs

@@ -55,7 +55,18 @@ test("validates the fixed artifact schema", () => {
 test("resolves a fallback PR with a redacted head repo and exact main baseline", async () => {
   const outputs = {};
   const listWorkflowRunArtifacts = () => {};
-  const listWorkflowRuns = () => {};
+  // The exact base run sits far past the newest page of main CI runs.
+  const mainRuns = Array.from({ length: 1_000 }, (_, index) => ({
+    id: 1_000 - index,
+    head_sha: index === 900 ? "base-sha" : `main-sha-${index}`,
+  }));
+  const listWorkflowRuns = async ({ head_sha, per_page }) => ({
+    data: {
+      workflow_runs: mainRuns
+        .filter((run) => head_sha === undefined || run.head_sha === head_sha)
+        .slice(0, per_page),
+    },
+  });
   const listPullRequestsAssociatedWithCommit = () => {};
   const github = {
     paginate: async (method, input) => {
@@ -77,9 +88,6 @@ test("resolves a fallback PR with a redacted head repo and exact main baseline",
           },
         ];
       }
-      if (method === listWorkflowRuns) {
-        return [{ id: 1, head_sha: "base-sha" }];
-      }
       throw new Error("unexpected pagination call");
     },
     rest: {
@@ -123,7 +131,7 @@ test("resolves a fallback PR with a redacted head repo and exact main baseline",
   assert.equal(outputs.publish, "true");
   assert.equal(outputs.pull_number, "5350");
   assert.equal(outputs.pr_artifact, "true");
-  assert.equal(outputs.baseline_run_id, "1");
+  assert.equal(outputs.baseline_run_id, "100");
   assert.equal(outputs.baseline_matches_base, "true");
 });
 

.github/triage/PLAYBOOK.md

@@ -125,10 +125,16 @@ of `main` for that work, never the tag-pinned diagnosis clone.
 - Show the user the complete final issue text and get an explicit yes before
   posting. Never post without it.
 - Note at the end of the issue which model and agent produced it.
-- If `gh` is not authenticated, offer `gh auth login`, or build a prefilled
-  https://github.com/pingdotgg/t3code/issues/new URL with title and body query
-  parameters; print the URL, and open it in their browser only after they
-  approve.
+- Post with `gh issue create --repo pingdotgg/t3code --label via-triage` only
+  if `gh api repos/pingdotgg/t3code --jq .permissions.triage` prints `true`.
+- Otherwise, or if `gh` is not authenticated, build a prefilled
+  https://github.com/pingdotgg/t3code/issues/new?template=via-triage.yml URL.
+  The form applies the label whoever submits it. Add `title` plus one
+  URL-encoded query parameter per form field id: `what-happened`, `diagnosis`,
+  `steps`, `version`, `environment`, `evidence`, `related`, `workaround` and
+  `agent`. Keep the full encoded URL below 6,000 characters by shortening any
+  fields as needed. Give the user any omitted text to paste into the form before
+  submitting. Print the URL, and open it in their browser only after they approve.
 - If the user pasted screenshots, remind them to drag the images into the issue
   after it is created; they cannot be attached from here.
 

.github/workflows/agent-context-budget.yml

@@ -51,5 +51,5 @@ jobs:
             echo "Accepted by the agent-context-increase label."
             exit 0
           fi
-          echo "::error file=$BUDGET::Agent context grew compared to main. Cut the added text, or ask a maintainer to add the agent-context-increase label."
+          echo "::error file=$BUDGET::Agent context grew compared to main. Cut the added text and rerun the evals that cover it (evals/README.md), or ask a maintainer to add the agent-context-increase label."
           exit 1

.github/workflows/mobile-eas-preview-fork.yml

@@ -0,0 +1,145 @@
+name: Mobile EAS Preview (Fork)
+
+# EAS previews for fork PRs. This runs the PR's code with an Expo token: the
+# app config and plugins run on this runner, and native builds run on EAS
+# with preview signing credentials. The label is the maintainer's sign-off
+# that they reviewed that code, so it covers exactly the commit it was applied
+# to: this pins that commit and consumes the label before running anything. A
+# later push deploys nothing until the label is applied again.
+#
+# Same-repo PRs deploy on every push while labeled, via mobile-eas-preview.yml.
+
+on:
+  pull_request_target:
+    types: [labeled]
+
+permissions:
+  contents: read
+
+jobs:
+  preview:
+    name: EAS Preview
+    if: >-
+      github.event.pull_request.head.repo.full_name != github.repository &&
+      github.event.label.name == '🚀 Mobile Continuous Deployment'
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    concurrency:
+      group: mobile-eas-preview-fork-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+    permissions:
+      contents: read
+      pull-requests: write
+    env:
+      APP_VARIANT: preview
+      NODE_OPTIONS: --max-old-space-size=8192
+      MOBILE_VERSION_POLICY: fingerprint
+    steps:
+      # If a maintainer removed the label first, that removal wins.
+      - id: consume
+        name: Consume the deployment label
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        with:
+          script: |
+            try {
+              await github.rest.issues.removeLabel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                name: context.payload.label.name,
+              });
+              core.setOutput("consumed", "true");
+            } catch (error) {
+              if (error.status !== 404) throw error;
+              core.info("The label was removed before this run could consume it. Skipping.");
+              core.setOutput("consumed", "false");
+            }
+
+      - id: expo-token
+        name: Check for EXPO_PREVIEW_TOKEN
+        if: steps.consume.outputs.consumed == 'true'
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
+        run: |
+          if [ -n "$EXPO_TOKEN" ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "EXPO_PREVIEW_TOKEN is not set; skipping EAS preview."
+          fi
+
+      # The head SHA from the label event, not the branch, so a push after the
+      # label cannot swap in unreviewed code. No credentials stay in .git for
+      # the PR's scripts to read.
+      - name: Checkout reviewed commit
+        if: steps.expo-token.outputs.present == 'true'
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+          # No sparse-checkout: see mobile-eas-preview.yml.
+
+      # No caches: pull_request_target saves them under main's scope, where
+      # trusted workflows with other secrets would restore what PR code wrote.
+      - name: Setup Vite+
+        if: steps.expo-token.outputs.present == 'true'
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: false
+          run-install: |
+            args:
+              - --filter=@t3tools/mobile...
+
+      - name: Expose pnpm
+        if: steps.expo-token.outputs.present == 'true'
+        run: |
+          pnpm_version="$(node --print "require('./package.json').packageManager.split('@').pop()")"
+          vp_pnpm_bin="$HOME/.vite-plus/package_manager/pnpm/$pnpm_version/pnpm/bin"
+          echo "$vp_pnpm_bin" >> "$GITHUB_PATH"
+          "$vp_pnpm_bin/pnpm" --version
+
+      - name: Setup EAS
+        if: steps.expo-token.outputs.present == 'true'
+        uses: expo/expo-github-action@v8
+        with:
+          # Pinned and installed with npm for the same reasons as mobile-eas-preview.yml.
+          eas-version: 21.8.0
+          eas-cache: false
+          token: ${{ secrets.EXPO_PREVIEW_TOKEN }}
+          packager: npm
+
+      - name: Pull preview environment variables
+        if: steps.expo-token.outputs.present == 'true'
+        working-directory: apps/mobile
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
+        run: |
+          eas env:pull preview --non-interactive
+          # See mobile-eas-preview.yml: keeps Android build and OTA fingerprints matching.
+          node --input-type=module <<'NODE'
+          import { appendFileSync, readFileSync } from "node:fs";
+          import { parseEnv } from "node:util";
+          const env = parseEnv(readFileSync(".env.local", "utf8"));
+          const googleServicesFile = env.T3CODE_ANDROID_GOOGLE_SERVICES_FILE;
+          if (googleServicesFile) {
+            appendFileSync(process.env.GITHUB_ENV, `T3CODE_ANDROID_GOOGLE_SERVICES_FILE=${googleServicesFile}\n`);
+          }
+          NODE
+
+      - name: Deploy with fingerprint check
+        if: steps.expo-token.outputs.present == 'true'
+        uses: expo/expo-github-action/continuous-deploy-fingerprint@main
+        env:
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
+          RUNNER_DEBUG: "1"
+          # The action only comments for pull_request events; this hook gives
+          # it the PR under pull_request_target. Without it, it skips the comment.
+          EXPO_TEST_GITHUB_PULL: ${{ github.event.pull_request.number }}
+        with:
+          profile: preview:dev
+          branch: pr-${{ github.event.pull_request.number }}
+          platform: all
+          environment: preview
+          working-directory: apps/mobile
+          github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/mobile-eas-preview.yml

@@ -7,7 +7,9 @@ on:
 jobs:
   preview:
     name: EAS Preview
+    # Fork PRs deploy one reviewed commit per label through mobile-eas-preview-fork.yml.
     if: |
+      github.event.pull_request.head.repo.full_name == github.repository &&
       contains(github.event.pull_request.labels.*.name, '🚀 Mobile Continuous Deployment') &&
       (github.event.action != 'labeled' || github.event.label.name == '🚀 Mobile Continuous Deployment')
     runs-on: blacksmith-8vcpu-ubuntu-2404
@@ -23,15 +25,15 @@ jobs:
       MOBILE_VERSION_POLICY: fingerprint
     steps:
       - id: expo-token
-        name: Check for EXPO_TOKEN
+        name: Check for EXPO_PREVIEW_TOKEN
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
         run: |
           if [ -n "$EXPO_TOKEN" ]; then
             echo "present=true" >> "$GITHUB_OUTPUT"
           else
             echo "present=false" >> "$GITHUB_OUTPUT"
-            echo "EXPO_TOKEN is not available; skipping EAS preview."
+            echo "EXPO_PREVIEW_TOKEN is not available; skipping EAS preview."
           fi
 
       - name: Checkout
@@ -70,7 +72,7 @@ jobs:
           # continuous-deploy-fingerprint still reads `build.project.ownerAccount`.
           # Unpin once https://github.com/expo/expo-github-action/issues/358 is fixed.
           eas-version: 21.8.0
-          token: ${{ secrets.EXPO_TOKEN }}
+          token: ${{ secrets.EXPO_PREVIEW_TOKEN }}
           # npm, not pnpm: this only installs eas-cli into the action's own
           # tool dir, and pnpm 11 hard-fails that install on dtrace-provider's
           # ignored build script (no allowBuilds config outside the repo).
@@ -80,7 +82,7 @@ jobs:
         if: steps.expo-token.outputs.present == 'true'
         working-directory: apps/mobile
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
         run: |
           eas env:pull preview --non-interactive
           # EAS Update disables dotenv loading. Keep the downloaded native config
@@ -99,7 +101,7 @@ jobs:
         if: steps.expo-token.outputs.present == 'true'
         uses: expo/expo-github-action/continuous-deploy-fingerprint@main
         env:
-          EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+          EXPO_TOKEN: ${{ secrets.EXPO_PREVIEW_TOKEN }}
           # The Expo action otherwise suppresses the EAS command's failure output.
           RUNNER_DEBUG: "1"
         with: