Merge main into fix/gitactions-hunt

Author: github-actions[bot]

.agents/skills/test-t3-app/SKILL.md

@@ -5,10 +5,10 @@ description: Test T3 Code's web and desktop UI through its built-in Browser pane
 
 # Test T3 web and desktop
 
-Use T3's built-in Browser panel for verification. If its tools are absent or
-the panel reports unavailable, explain the blocker and stop verification.
-Do not install or switch to another automation system. For native mobile
-testing, use [test-t3-mobile](../test-t3-mobile/SKILL.md).
+Use T3's built-in Browser panel for verification. Follow the recovery steps
+below before declaring it unavailable. Do not install or switch to another
+automation system. For native mobile testing, use
+[test-t3-mobile](../test-t3-mobile/SKILL.md).
 
 ## Start the app
 
@@ -36,8 +36,13 @@ model, such as Haiku for Claude or Luna for Codex.
 
 ## Use the Browser panel
 
-Call `preview_status`, then `preview_open` if the Browser panel is
-closed. Navigate to the complete startup pairing URL once with
+Call `preview_status`. If no tab can be automated, call `preview_open`, including
+when status reports `available: false` or `tabId: null`. Status can report
+unavailable simply because no tab exists yet; opening a tab needs no user action.
+Stop verification and explain the blocker only if the tools are absent or
+`preview_open` reports unavailable or fails.
+
+Navigate to the complete startup pairing URL once with
 `preview_navigate`, then use `preview_snapshot` and T3's interaction tools.
 If the token was consumed or expired, run `node apps/server/src/bin.ts pair`
 for a fresh one. Keep using the same tab.

.agents/skills/test-t3-mobile/SKILL.md

@@ -36,8 +36,9 @@ vp run mobile:install <ios|android> <device-id>
 
 This installs the dev client for the checkout's native fingerprint: from the
 device, the local cache, or the shared cache in seconds, building once only
-when no machine has that fingerprint yet (5-15 minutes, logged to the file it
-names). The device id may be omitted when exactly one device is booted. It
+when no machine has that fingerprint yet: in the `Mobile Dev Client` workflow
+on Blacksmith when HEAD is pushed and `gh` may dispatch it (the command waits),
+otherwise here (5-15 minutes, logged to the file it names). The device id may be omitted when exactly one device is booted. It
 prints one JSON line; on failure it names the next command. Mobile verification
 includes that step unless the user prohibits it.
 

.github/SECURITY.md

@@ -1,7 +1,7 @@
 # Security policy
 
 Report security vulnerabilities affecting T3 Code or T3 Tools-operated infrastructure to
-[security@ping.gg](mailto:security@ping.gg). Please do not disclose them publicly until we have had
+[security@t3.codes](mailto:security@t3.codes). Please do not disclose them publicly until we have had
 a reasonable opportunity to investigate and remediate them.
 
 See the [full security policy](https://t3.codes/security-policy) for reporting details, scope,

.github/actions/ci-changes/action.yml

@@ -5,6 +5,8 @@ outputs:
     value: ${{ steps.detect.outputs.typecheck }}
   build:
     value: ${{ steps.detect.outputs.build }}
+  desktop_launch:
+    value: ${{ steps.detect.outputs.desktop_launch }}
   test:
     value: ${{ steps.detect.outputs.test }}
   test_packages:

.github/actions/setup-ci-deps/action.yml

@@ -13,6 +13,10 @@ inputs:
     description: Arguments for `vp install`, such as filters. Empty installs the whole workspace.
     required: false
     default: ""
+  save-pnpm-store:
+    description: Set to "false" when a concurrent job with the same install args saves the pnpm store
+    required: false
+    default: "true"
 runs:
   using: composite
   steps:
@@ -123,10 +127,14 @@ runs:
         key: ${{ steps.pnpm_verified.outputs.cache-primary-key }}
 
     # A filtered install that started from the current full store adds nothing
-    # worth a second copy of it.
+    # worth a second copy of it. A stacked PR, based on a branch other than the
+    # default, saves a ~1 GB store only its own reruns can read, so it only restores.
+    # Concurrent jobs with the same install args reserve one key, so the losers
+    # compress the store for nothing; all but one pass save-pnpm-store: false.
     - name: Save pnpm store
       if: >-
-        inputs.install == 'true' &&
+        inputs.install == 'true' && inputs.save-pnpm-store == 'true' &&
+        (github.event_name != 'pull_request' || github.base_ref == github.event.repository.default_branch) &&
         steps.pnpm_cache.outputs.cache-hit != 'true' &&
         (steps.pnpm_store.outputs.namespace == 'full' ||
           steps.pnpm_cache.outputs.cache-matched-key != format('pnpm-full-v1-{0}-{1}-{2}', runner.os, runner.arch, hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml', 'package.json')))

.github/scripts/check-nightly-release.cjs

@@ -40,42 +40,67 @@ async function assertReleaseSource({ github, context, releaseChannel }) {
 
 const isNightlyTag = (tag) => /^v.*-nightly\./.test(tag) || tag.startsWith("nightly-v");
 
-async function findLatestNightly({ github, context }) {
-  const releases = await github.paginate(github.rest.repos.listReleases, {
-    ...context.repo,
-    per_page: 100,
-  });
-  return releases
-    .filter((release) => !release.draft && release.published_at && isNightlyTag(release.tag_name))
-    .sort((a, b) => Date.parse(b.published_at) - Date.parse(a.published_at))[0];
+// Only the three fields the gate reads. The REST list also returns every asset,
+// which made a full scan tens of megabytes.
+const RELEASES_QUERY = `
+  query ($owner: String!, $repo: String!, $cursor: String) {
+    repository(owner: $owner, name: $repo) {
+      releases(first: 100, after: $cursor, orderBy: { field: CREATED_AT, direction: DESC }) {
+        pageInfo { hasNextPage endCursor }
+        nodes { tagName isDraft publishedAt }
+      }
+    }
+  }
+`;
+
+// Returns the nightly with the newest publishedAt. Release order follows the
+// tagged commit date, not publication, so every page is read unless `isSettled`
+// says the newest nightly seen so far already decides the caller's answer.
+async function findLatestNightly({ github, context, isSettled = () => false }) {
+  let latest;
+  let cursor = null;
+  do {
+    const { repository } = await github.graphql(RELEASES_QUERY, { ...context.repo, cursor });
+    const { nodes, pageInfo } = repository.releases;
+    for (const release of nodes) {
+      if (release.isDraft || !release.publishedAt || !isNightlyTag(release.tagName)) continue;
+      if (!latest || Date.parse(release.publishedAt) > Date.parse(latest.publishedAt)) {
+        latest = release;
+      }
+    }
+    if (latest && isSettled(latest)) return latest;
+    cursor = pageInfo.hasNextPage ? pageInfo.endCursor : null;
+  } while (cursor);
+  return latest;
 }
 
 async function shouldReleaseNightly({ github, context, core, now = Date.now() }) {
-  const lastNightly = await findLatestNightly({ github, context });
+  const isInGap = (release) => now - Date.parse(release.publishedAt) < MINIMUM_RELEASE_GAP_MS;
+  // Any nightly inside the gap means the newest one is too, so stop reading.
+  const lastNightly = await findLatestNightly({ github, context, isSettled: isInGap });
 
   if (!lastNightly) {
     core.info("No published nightly found. Proceeding with release.");
     return true;
   }
 
-  if (now - Date.parse(lastNightly.published_at) < MINIMUM_RELEASE_GAP_MS) {
-    core.info(`Nightly ${lastNightly.tag_name} was published less than six hours ago. Skipping.`);
+  const tag = lastNightly.tagName;
+  if (isInGap(lastNightly)) {
+    core.info(`Nightly ${tag} was published less than six hours ago. Skipping.`);
     return false;
   }
 
   const { data: comparison } = await github.rest.repos.compareCommitsWithBasehead({
     ...context.repo,
-    basehead: `${lastNightly.tag_name}...${context.sha}`,
+    basehead: `${tag}...${context.sha}`,
     per_page: 1,
   });
   if (comparison.status !== "ahead") {
-    core.info(
-      `Candidate commit is ${comparison.status} relative to ${lastNightly.tag_name}. Skipping.`,
-    );
+    core.info(`Candidate commit is ${comparison.status} relative to ${tag}. Skipping.`);
     return false;
   }
 
-  core.info(`New commits since ${lastNightly.tag_name}, and the six-hour gap has passed.`);
+  core.info(`New commits since ${tag}, and the six-hour gap has passed.`);
   return true;
 }
 
@@ -85,7 +110,7 @@ async function resolveLatestNightlyCommit({ github, context, core }) {
     throw new Error("No published nightly found. Stable releases build the latest nightly commit.");
   }
 
-  const tag = lastNightly.tag_name;
+  const tag = lastNightly.tagName;
   const { data: commit } = await github.rest.repos.getCommit({ ...context.repo, ref: tag });
   const version = /^(?:nightly-)?v(\d+\.\d+\.\d+)-nightly\./.exec(tag)?.[1];
   if (!version) {

.github/scripts/check-nightly-release.test.cjs

@@ -9,9 +9,9 @@ const {
 const now = Date.parse("2026-09-05T12:00:00Z");
 const hour = 60 * 60 * 1000;
 const nightly = (hoursAgo, overrides = {}) => ({
-  tag_name: "v1.0.1-nightly.20260905.123",
-  draft: false,
-  published_at: new Date(now - hoursAgo * hour).toISOString(),
+  tagName: "v1.0.1-nightly.20260905.123",
+  isDraft: false,
+  publishedAt: new Date(now - hoursAgo * hour).toISOString(),
   ...overrides,
 });
 
@@ -73,26 +73,39 @@ for (const comparisonStatus of ["behind", "diverged"]) {
   });
 }
 
-function fixture({ releases = [nightly(7)], comparisonStatus = "ahead" } = {}) {
+// `pages` holds the GraphQL release pages; `releases` is shorthand for one page.
+function fixture({ releases = [nightly(7)], pages = [releases], comparisonStatus = "ahead" } = {}) {
   const calls = [];
+  const cursors = [];
   return {
     calls,
+    cursors,
     options: {
       now,
       context: { repo: { owner: "example", repo: "app" }, sha: "new" },
       core: { info() {} },
       github: {
         rest: {
           repos: {
-            listReleases() {},
             async compareCommitsWithBasehead(params) {
               calls.push(params);
               return { data: { status: comparisonStatus } };
             },
           },
         },
-        async paginate() {
-          return releases;
+        async graphql(_query, { owner, repo, cursor }) {
+          assert.deepEqual({ owner, repo }, { owner: "example", repo: "app" });
+          cursors.push(cursor);
+          const index = cursor === null ? 0 : Number(cursor);
+          const hasNextPage = index + 1 < pages.length;
+          return {
+            repository: {
+              releases: {
+                nodes: pages[index],
+                pageInfo: { hasNextPage, endCursor: hasNextPage ? String(index + 1) : null },
+              },
+            },
+          };
         },
       },
     },
@@ -101,28 +114,65 @@ function fixture({ releases = [nightly(7)], comparisonStatus = "ahead" } = {}) {
 
 test("releases the first nightly when no nightly is published", async () => {
   const { options } = fixture({
-    releases: [nightly(0, { tag_name: "v1.0.0" }), nightly(0, { draft: true })],
+    releases: [nightly(0, { tagName: "v1.0.0" }), nightly(0, { isDraft: true })],
   });
   assert.equal(await shouldReleaseNightly(options), true);
 });
 
 test("uses publication time, not release order or the tagged commit date", async () => {
   const { options } = fixture({
-    releases: [nightly(10), nightly(1), nightly(20, { tag_name: "nightly-v0.9.0" })],
+    releases: [nightly(10), nightly(1), nightly(20, { tagName: "nightly-v0.9.0" })],
+  });
+  assert.equal(await shouldReleaseNightly(options), false);
+});
+
+test("the six-hour gap ends exactly six hours after publication", async () => {
+  const atBoundary = fixture({ releases: [nightly(6)] });
+  assert.equal(await shouldReleaseNightly(atBoundary.options), true);
+  const justInside = fixture({ releases: [nightly(6 - 1 / 3_600_000)] });
+  assert.equal(await shouldReleaseNightly(justInside.options), false);
+  assert.equal(justInside.calls.length, 0);
+});
+
+test("stops reading releases once a nightly inside the gap is seen", async () => {
+  const { options, cursors } = fixture({ pages: [[nightly(10), nightly(2)], [nightly(30)]] });
+  assert.equal(await shouldReleaseNightly(options), false);
+  assert.deepEqual(cursors, [null]);
+});
+
+test("reads every page when no nightly seen so far settles the gap", async () => {
+  const { options, cursors, calls } = fixture({
+    pages: [
+      [nightly(10), nightly(0, { tagName: "v1.0.0" })],
+      [nightly(1, { tagName: "nightly-v0.9.0" })],
+    ],
   });
   assert.equal(await shouldReleaseNightly(options), false);
+  assert.deepEqual(cursors, [null, "1"]);
+  assert.equal(calls.length, 0);
+});
+
+test("compares against the newest nightly across pages once the gap has passed", async () => {
+  const { options, calls } = fixture({
+    pages: [[nightly(10, { tagName: "v1.0.1-nightly.20260905.100" })], [nightly(8)]],
+  });
+  assert.equal(await shouldReleaseNightly(options), true);
+  assert.deepEqual(
+    calls.map((call) => call.basehead),
+    ["v1.0.1-nightly.20260905.123...new"],
+  );
 });
 
 test("ignores stable releases and drafts when checking the gap", async () => {
   const { options } = fixture({
-    releases: [nightly(0, { tag_name: "v1.0.0" }), nightly(0, { draft: true }), nightly(7)],
+    releases: [nightly(0, { tagName: "v1.0.0" }), nightly(0, { isDraft: true }), nightly(7)],
   });
   assert.equal(await shouldReleaseNightly(options), true);
 });
 
 test("fails instead of releasing when GitHub cannot supply release state", async () => {
   const { options } = fixture();
-  options.github.paginate = async () => {
+  options.github.graphql = async () => {
     throw new Error("GitHub unavailable");
   };
   await assert.rejects(shouldReleaseNightly(options), /GitHub unavailable/);
@@ -137,9 +187,9 @@ for (const status of ["behind", "diverged"]) {
 
 const { resolveLatestNightlyCommit } = require("./check-nightly-release.cjs");
 
-function nightlyCommitFixture({ releases, commitSha = "abc123" }) {
+function nightlyCommitFixture({ releases, pages, commitSha = "abc123" }) {
   const refs = [];
-  const { options } = fixture({ releases });
+  const { options } = fixture({ releases, pages });
   options.github.rest.repos.getCommit = async ({ ref }) => {
     refs.push(ref);
     return { data: { sha: commitSha } };
@@ -150,10 +200,10 @@ function nightlyCommitFixture({ releases, commitSha = "abc123" }) {
 test("stable releases resolve the commit of the newest published nightly", async () => {
   const { options, refs } = nightlyCommitFixture({
     releases: [
-      nightly(10, { tag_name: "v1.0.1-nightly.20260905.100" }),
-      nightly(1, { tag_name: "v1.0.1-nightly.20260905.123" }),
-      nightly(0, { tag_name: "v1.0.0" }),
-      nightly(0, { draft: true, tag_name: "v1.0.1-nightly.20260905.999" }),
+      nightly(10, { tagName: "v1.0.1-nightly.20260905.100" }),
+      nightly(1, { tagName: "v1.0.1-nightly.20260905.123" }),
+      nightly(0, { tagName: "v1.0.0" }),
+      nightly(0, { isDraft: true, tagName: "v1.0.1-nightly.20260905.999" }),
     ],
     commitSha: "deadbeef",
   });
@@ -167,7 +217,23 @@ test("stable releases resolve the commit of the newest published nightly", async
 
 test("stable releases derive the version from legacy nightly tags", async () => {
   const { options } = nightlyCommitFixture({
-    releases: [nightly(1, { tag_name: "nightly-v0.9.0-nightly.20260905.5" })],
+    releases: [nightly(1, { tagName: "nightly-v0.9.0-nightly.20260905.5" })],
   });
   assert.equal((await resolveLatestNightlyCommit(options)).version, "0.9.0");
 });
+
+test("stable releases read every page, even after a recent nightly", async () => {
+  const { options, refs } = nightlyCommitFixture({
+    pages: [
+      [nightly(2, { tagName: "v1.0.1-nightly.20260905.100" })],
+      [nightly(1, { tagName: "v1.0.1-nightly.20260905.123" })],
+    ],
+  });
+  assert.equal((await resolveLatestNightlyCommit(options)).tag, "v1.0.1-nightly.20260905.123");
+  assert.deepEqual(refs, ["v1.0.1-nightly.20260905.123"]);
+});
+
+test("stable releases fail when no nightly is published", async () => {
+  const { options } = nightlyCommitFixture({ releases: [nightly(1, { tagName: "v1.0.0" })] });
+  await assert.rejects(resolveLatestNightlyCommit(options), /No published nightly found/);
+});