chore: sync with upstream pingdotgg/t3code main

.agents/skills/ios-debugger-agent/SKILL.md

@@ -31,6 +31,8 @@ Avoid generic Mac window automation for switching among Simulator windows. Expli
 
 ## Choose build or launch
 
+For T3 Code Mobile, run `node scripts/mobile-native-client.ts ensure ios <simulator-udid>` from the checkout on the simulator host first. It checks the local Expo native fingerprint against the installed client and builds/installs when stale, missing, or unknown. Then launch with the intended Metro bundle. Authorized verification includes native builds and installs; do not stop because the existing client is old. Use `check` instead of `ensure` only when the user explicitly prohibits rebuilding or requests a read-only check.
+
 - Use `build_run_sim` when native source, native dependencies, entitlements, or project configuration changed.
 - Use `test_sim` for the smallest relevant native test target or test cases; do not run an entire workspace test matrix routinely.
 - Use `launch_app_sim` when a compatible app is already installed and no native rebuild is needed.

.agents/skills/test-t3-mobile/SKILL.md

@@ -15,24 +15,28 @@ Inspect the host and the affected code before launching processes:
 
 - On macOS with Xcode, prefer one representative iOS Simulator when the change is cross-platform so the user can watch through serve-sim. Load and follow [`ios-debugger-agent`](../ios-debugger-agent/SKILL.md), and load [`ios-simulator-browser`](../ios-simulator-browser/SKILL.md) when live streaming is available.
 - On macOS, Linux, or Windows with the Android SDK, use one Android Emulator when Android is the affected surface or iOS tooling is unavailable.
-- When the change is platform-specific, test that platform. When neither platform is viable, report the missing SDK, emulator, or dev-client prerequisite rather than claiming verification.
+- When the change is platform-specific, test that platform. When neither platform is viable, report the missing SDK or emulator prerequisite rather than claiming verification. A missing development client is a build step, not a blocker.
 
 Do not treat unavailable iOS tooling as a blocker when Android is a valid representative target.
 
-## Choose the lightest valid launch path
+## Ensure a compatible native client
 
-- For JavaScript, TypeScript, or asset-only changes, reuse a compatible installed development client and start Metro. Do not rebuild native code merely to load a new bundle.
-- For native source, native dependencies, entitlements, config plugins, or generated project changes, rebuild the affected platform.
-- Use `vp run ios:dev` or `vp run android:dev` only when an Expo clean prebuild is actually required; both commands regenerate the native project.
-- If the user requested no native rebuild and no compatible app is installed, reuse an existing compatible `.app` or `.apk` artifact when available. Otherwise report the missing dev client instead of silently rebuilding.
+Authorized mobile verification includes building and installing a development client. A missing, stale, or unknown native client is not a reason to skip verification or leave a PR in draft. Build and install it, then continue. Respect an explicit user instruction not to rebuild; otherwise do not ask for separate permission.
 
-The development identity on both platforms is:
+Run this from the checkout being tested, on the machine that hosts the selected simulator or emulator. Select and boot one explicit iOS UDID or Android emulator serial first:
 
-- App: `T3 Code Dev`
-- Bundle/package identifier: `com.t3tools.t3code.dev`
-- URL scheme: `t3code-dev`
+```bash
+node scripts/mobile-native-client.ts ensure ios <simulator-udid>
+node scripts/mobile-native-client.ts ensure android <emulator-serial>
+```
+
+`ensure` compares the checkout's local Expo development fingerprint and the installed app's binary contents against the last successful build record. It reuses a matching client; otherwise it runs a clean prebuild, builds and installs the development app, and records the successful result. It does not start Metro. Start Metro below after it succeeds. On hosts with an `agent-job` requirement, run the entire `ensure` command through that queue.
+
+For a read-only decision, use `check` in place of `ensure`. Exit 0 means compatible, 2 means build required, and 1 means an operational error. An app installed outside this helper is initially unknown and gets rebuilt once. Records are local to the simulator host under `~/.cache/t3code/native-clients` and work across checkouts. Do not copy records between machines or write them manually.
+
+A JavaScript-only diff, bundle identifier, app version, or recent install date does not prove native compatibility. Always check the whole checkout. Expo fingerprints are computed locally with `APP_VARIANT=development`; no EAS credentials or cloud build are required. Generated `ios/` and `android/` directories are excluded by `.fingerprintignore`, so edit native source modules or config plugins rather than generated output.
 
-Bundle or package presence proves the correct variant, not native compatibility. Reuse it only when the current changes did not alter its Expo SDK, native dependencies, config plugins, entitlements, generated project, or native source.
+The development identity is `T3 Code Dev`, bundle/package `com.t3tools.t3code.dev`, scheme `t3code-dev`. If a build fails, investigate the build error and fix the local prerequisites. Report the concrete failure if it cannot be resolved, not “no compatible client.”
 
 ## Start one disposable T3 environment
 
@@ -98,21 +102,19 @@ Use `ios-debugger-agent` to select one UDID and set these XcodeBuildMCP session
 - Simulator ID: the selected UDID
 - Bundle ID: `com.t3tools.t3code.dev`
 
-Check the installed client with:
+After `ensure` succeeds, open the Metro URL:
 
 ```bash
-xcrun simctl get_app_container <simulator-udid> com.t3tools.t3code.dev app
 xcrun simctl openurl <simulator-udid> <printed-dev-client-url>
 ```
 
 Accept the iOS confirmation prompt and dismiss the developer menu when it obscures the app.
 
 ### Android launch
 
-Select one running emulator serial from `adb devices` and check the installed client:
+Use the emulator serial already checked by `ensure`:
 
 ```bash
-adb -s <emulator-serial> shell pm path com.t3tools.t3code.dev
 adb -s <emulator-serial> reverse tcp:<metro-port> tcp:<metro-port>
 adb -s <emulator-serial> shell am start -W \
   -a android.intent.action.VIEW \

.github/VOUCHED.td

@@ -25,6 +25,7 @@ github:D3OXY
 github:dbalders
 github:eggfriedrice24
 github:extoci
+github:f-trycua
 github:flamboh
 github:FllipEis
 github:gbarros-dev

.github/scripts/check-nightly-release.cjs

@@ -1,5 +1,43 @@
 const MINIMUM_RELEASE_GAP_MS = 6 * 60 * 60 * 1000;
 
+function repositoryDefaultBranch(context) {
+  const branch = context.payload.repository?.default_branch;
+  if (!branch) {
+    throw new Error("GitHub did not provide the repository default branch.");
+  }
+  return branch;
+}
+
+async function assertCommitOnDefaultBranch({ github, context, sha }) {
+  const defaultBranch = repositoryDefaultBranch(context);
+  const { data: comparison } = await github.rest.repos.compareCommitsWithBasehead({
+    ...context.repo,
+    basehead: `${sha}...${defaultBranch}`,
+    per_page: 1,
+  });
+  if (comparison.status !== "ahead" && comparison.status !== "identical") {
+    throw new Error(
+      `Release commit ${sha} is not contained in ${defaultBranch} (${comparison.status}).`,
+    );
+  }
+}
+
+async function assertReleaseSource({ github, context, releaseChannel }) {
+  if (releaseChannel === "preview") return;
+  if (releaseChannel !== "stable" && releaseChannel !== "nightly") {
+    throw new Error(`Unsupported release channel: ${releaseChannel}`);
+  }
+
+  const defaultBranch = repositoryDefaultBranch(context);
+  if (context.eventName === "workflow_dispatch" && context.ref !== `refs/heads/${defaultBranch}`) {
+    throw new Error(
+      `${releaseChannel} releases must be dispatched from ${defaultBranch}; selected ${context.ref}. Use the preview channel for branch builds.`,
+    );
+  }
+
+  await assertCommitOnDefaultBranch({ github, context, sha: context.sha });
+}
+
 const isNightlyTag = (tag) => /^v.*-nightly\./.test(tag) || tag.startsWith("nightly-v");
 
 // Newest published nightly by publication time, or undefined when none exists.
@@ -64,4 +102,9 @@ async function resolveLatestNightlyCommit({ github, context, core }) {
   return { tag, sha: commit.sha, version };
 }
 
-module.exports = { shouldReleaseNightly, resolveLatestNightlyCommit };
+module.exports = {
+  assertCommitOnDefaultBranch,
+  assertReleaseSource,
+  shouldReleaseNightly,
+  resolveLatestNightlyCommit,
+};

.github/scripts/check-nightly-release.test.cjs

@@ -1,6 +1,10 @@
 const assert = require("node:assert/strict");
 const test = require("node:test");
-const { shouldReleaseNightly } = require("./check-nightly-release.cjs");
+const {
+  assertCommitOnDefaultBranch,
+  assertReleaseSource,
+  shouldReleaseNightly,
+} = require("./check-nightly-release.cjs");
 
 const now = Date.parse("2026-09-05T12:00:00Z");
 const hour = 60 * 60 * 1000;
@@ -11,6 +15,77 @@ const nightly = (hoursAgo, overrides = {}) => ({
   ...overrides,
 });
 
+function releaseSourceFixture({
+  comparisonStatus = "ahead",
+  eventName = "workflow_dispatch",
+  ref = "refs/heads/main",
+  sha = "candidate",
+} = {}) {
+  const calls = [];
+  return {
+    calls,
+    options: {
+      context: {
+        eventName,
+        payload: { repository: { default_branch: "main" } },
+        ref,
+        repo: { owner: "example", repo: "app" },
+        sha,
+      },
+      github: {
+        rest: {
+          repos: {
+            async compareCommitsWithBasehead(params) {
+              calls.push(params);
+              return { data: { status: comparisonStatus } };
+            },
+          },
+        },
+      },
+    },
+  };
+}
+
+test("allows preview releases from any branch without consulting main", async () => {
+  const { options, calls } = releaseSourceFixture({ ref: "refs/heads/feature" });
+  await assertReleaseSource({ ...options, releaseChannel: "preview" });
+  assert.equal(calls.length, 0);
+});
+
+for (const releaseChannel of ["stable", "nightly"]) {
+  test(`rejects a manual ${releaseChannel} release from a feature branch`, async () => {
+    const { options, calls } = releaseSourceFixture({ ref: "refs/heads/feature" });
+    await assert.rejects(
+      assertReleaseSource({ ...options, releaseChannel }),
+      new RegExp(`${releaseChannel} releases must be dispatched from main`),
+    );
+    assert.equal(calls.length, 0);
+  });
+
+  test(`allows a manual ${releaseChannel} release from main`, async () => {
+    const { options, calls } = releaseSourceFixture();
+    await assertReleaseSource({ ...options, releaseChannel });
+    assert.equal(calls[0].basehead, "candidate...main");
+  });
+}
+
+for (const comparisonStatus of ["behind", "diverged"]) {
+  test(`rejects a release commit that is ${comparisonStatus} from main`, async () => {
+    const { options } = releaseSourceFixture({ comparisonStatus, eventName: "push" });
+    await assert.rejects(
+      assertCommitOnDefaultBranch({ ...options, sha: "release-commit" }),
+      new RegExp(`not contained in main \\(${comparisonStatus}\\)`),
+    );
+  });
+}
+
+test("accepts a release commit already contained in main", async () => {
+  for (const comparisonStatus of ["ahead", "identical"]) {
+    const { options } = releaseSourceFixture({ comparisonStatus, eventName: "push" });
+    await assertCommitOnDefaultBranch({ ...options, sha: "release-commit" });
+  }
+});
+
 function fixture({ releases = [nightly(7)], comparisonStatus = "ahead" } = {}) {
   const calls = [];
   return {

.github/scripts/stage-preview-bundle.py

@@ -0,0 +1,76 @@
+"""Stage an untrusted preview ZIP without letting it replace packaging code."""
+
+import shutil
+import stat
+import sys
+import zipfile
+from pathlib import Path
+
+ROOTS = ("server/dist", "desktop/dist-electron")
+REQUIRED_FILES = {
+    "server/dist/bin.mjs",
+    "server/dist/client/index.html",
+    "desktop/dist-electron/main.cjs",
+}
+# The current bundle is about 32 MiB compressed. Bound extraction on the
+# trusted runner even when the PR replaces the uploader entirely.
+MAX_ARCHIVE_BYTES = 512 * 1024 * 1024
+MAX_EXPANDED_BYTES = 2 * 1024 * 1024 * 1024
+MAX_ENTRIES = 50_000
+
+
+def stage_bundle(archive: Path, destination: Path):
+    if archive.stat().st_size > MAX_ARCHIVE_BYTES:
+        raise ValueError("Preview archive is too large")
+    with zipfile.ZipFile(archive) as bundle:
+        entries = bundle.infolist()
+        if len(entries) > MAX_ENTRIES:
+            raise ValueError("Preview archive has too many entries")
+        if sum(entry.file_size for entry in entries) > MAX_EXPANDED_BYTES:
+            raise ValueError("Expanded preview bundle is too large")
+        seen = set()
+        files = set()
+        for entry in entries:
+            name = entry.filename.removesuffix("/")
+            parts = name.split("/")
+            # Reject ambiguous paths before normalization, including names
+            # that would alias on the macOS signing runner.
+            if (
+                entry.orig_filename != entry.filename
+                or any(part in ("", ".", "..") for part in parts)
+                or any(char in name for char in "\\:")
+                or not name.isascii()
+                or any(ord(char) < 32 or ord(char) == 127 for char in name)
+            ):
+                raise ValueError(f"Unsafe preview path: {entry.filename!r}")
+            allowed = any(name.startswith(root + "/") for root in ROOTS)
+            if entry.is_dir():
+                allowed |= any(root == name or root.startswith(name + "/") for root in ROOTS)
+            if not allowed:
+                raise ValueError(f"Unexpected preview path: {name!r}")
+            kind = stat.S_IFMT(entry.external_attr >> 16)
+            if kind not in (0, stat.S_IFDIR if entry.is_dir() else stat.S_IFREG):
+                raise ValueError(f"Non-regular preview entry: {name!r}")
+            if name.casefold() in seen:
+                raise ValueError(f"Duplicate preview path: {name!r}")
+            seen.add(name.casefold())
+            if not entry.is_dir():
+                files.add(name)
+        if not REQUIRED_FILES <= files:
+            raise ValueError("Preview bundle is missing required entry points")
+        # Validate all names before writing anything. This is a fresh directory
+        # outside the checkout; neither pre-existing links nor trusted files
+        # can be followed or overwritten. ZIP permissions are never restored.
+        destination.mkdir(parents=True, exist_ok=False)
+        for entry in entries:
+            target = destination / entry.filename
+            if entry.is_dir():
+                target.mkdir(parents=True, exist_ok=True)
+            else:
+                target.parent.mkdir(parents=True, exist_ok=True)
+                with bundle.open(entry) as source, target.open("xb") as output:
+                    shutil.copyfileobj(source, output)
+
+
+if __name__ == "__main__":
+    stage_bundle(Path(sys.argv[1]), Path(sys.argv[2]))