chore(upstream): sync 2026-09-04

.github/VOUCHED.td

@@ -12,22 +12,28 @@
 github:0x4bs3nt
 github:Adamulek123
 github:adityavardhansharma
+github:aoright
 github:arhxam
 github:bil0000
 github:binbandit
 github:Brechard
+github:btsouth
 github:chrisdeeming
 github:chuks-qua
 github:cursoragent
 github:D3OXY
+github:dbalders
 github:eggfriedrice24
 github:extoci
+github:flamboh
+github:FllipEis
 github:gbarros-dev
 github:gfsaaser24
 github:github-actions[bot]
 github:gsimone
 github:GuilhermeVieiraDev
 github:hwanseoc
+github:inayayousfi
 github:ipanasenko
 github:jakeleventhal
 github:jamesx0416
@@ -36,13 +42,18 @@ github:jasonLaster
 github:JoeEverest
 github:justsomelegs
 github:kridaydave
+github:lgwacker
 github:lnieuwenhuis
 github:Lucenx9
 github:mackinleysmith
 github:maria-rcks
+github:MatthewFeroz
 github:maxwellyoung
 github:mwolson
+github:myacoub91
+github:naMqe-h
 github:nateEc
+github:naveed949
 github:nmggithub
 github:Noojuno
 github:notkainoa
@@ -64,6 +75,7 @@ github:tarik02
 github:tris203
 github:tsouth89
 github:UtkarshUsername
+github:vitalyiegorov
 github:Yash-Singh1
 github:yashranaway
 github:Ymit24

.github/workflows/ci.yml

@@ -51,6 +51,9 @@ jobs:
       - name: Typecheck
         run: vpr typecheck
 
+      - name: Install browser secret helper build libraries
+        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+
       - name: Build desktop pipeline
         run: vp run build:desktop
 
@@ -85,6 +88,9 @@ jobs:
       - name: Ensure Electron runtime is installed
         run: vp run --filter @t3tools/desktop ensure:electron
 
+      - name: Install browser secret helper build libraries
+        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+
       - name: Test
         run: vp run --parallel --concurrency-limit 4 --filter '!t3' --filter '!@t3tools/monorepo' test
 

.github/workflows/cursor-hygiene-webhook.yml

@@ -0,0 +1,36 @@
+name: Forward to Cursor hygiene
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, reopened, ready_for_review]
+  issues:
+    types: [opened, closed, reopened]
+  discussion:
+    types: [created, closed, reopened]
+
+permissions:
+  contents: read
+
+jobs:
+  forward:
+    name: POST to Cursor
+    runs-on: ubuntu-24.04
+    steps:
+      - name: POST to Cursor
+        env:
+          URL: ${{ secrets.CURSOR_T3CODE_WEBHOOK_URL }}
+          AUTH: ${{ secrets.CURSOR_T3CODE_WEBHOOK_AUTH }}
+        run: |
+          set -euo pipefail
+          if [ -z "${URL:-}" ] || [ -z "${AUTH:-}" ]; then
+            echo "Missing CURSOR_T3CODE_WEBHOOK_URL or CURSOR_T3CODE_WEBHOOK_AUTH — skipping."
+            exit 0
+          fi
+          curl -fsS --max-time 60 -X POST "$URL" \
+            -H "Authorization: $AUTH" \
+            -H "Content-Type: application/json" \
+            -H "X-GitHub-Event: ${{ github.event_name }}" \
+            -H "X-GitHub-Delivery: ${{ github.run_id }}-${{ github.run_attempt }}" \
+            --data-binary @"${{ github.event_path }}"

.github/workflows/release.yml

@@ -111,6 +111,8 @@ jobs:
           node-version-file: package.json
           cache: true
           run-install: true
+        env:
+          pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
 
       - id: release_meta
         name: Resolve release version
@@ -174,6 +176,14 @@ jobs:
             --current-tag "${{ steps.release_meta.outputs.tag }}" \
             --github-output
 
+      # Share only the verification results, not the large registry metadata cache.
+      - name: Upload dependency verification
+        continue-on-error: true
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-dependency-verification
+          path: ${{ runner.temp }}/pnpm-metadata/lockfile-verified.jsonl
+
   quality:
     name: Release quality checks
     needs: [preflight]
@@ -206,6 +216,9 @@ jobs:
       - name: Typecheck
         run: vp run typecheck
 
+      - name: Install browser secret helper build libraries
+        run: sudo apt-get update && sudo apt-get install -y libsecret-1-dev pkg-config
+
       - name: Test
         run: vp run test
 
@@ -446,7 +459,18 @@ jobs:
           path: ${{ steps.package_cache_path.outputs.path }}
           key: windows-release-packages-v1-${{ matrix.arch }}-${{ hashFiles('pnpm-lock.yaml') }}
 
+      # pnpm checks the lockfile and policy before reusing this result. A missing
+      # artifact leaves the cache empty, so installation runs the checks again.
+      - name: Download dependency verification
+        continue-on-error: true
+        uses: actions/download-artifact@v8
+        with:
+          name: release-dependency-verification
+          path: ${{ runner.temp }}/pnpm-metadata
+
       - name: Install desktop dependencies
+        env:
+          pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
         run: vp install --filter=@t3tools/desktop... --filter=t3... --filter=@t3tools/scripts...
 
       - name: Cache resource monitor
@@ -503,12 +527,13 @@ jobs:
             exit $code
           }
 
-      - name: Install ImageMagick
+      - name: Install Linux desktop build libraries
         if: matrix.platform == 'linux'
         shell: bash
         run: |
+          sudo apt-get update
+          sudo apt-get install -y libsecret-1-dev pkg-config
           if ! command -v magick >/dev/null 2>&1 && ! command -v convert >/dev/null 2>&1; then
-              sudo apt-get update
               sudo apt-get install -y imagemagick
           fi
 
@@ -583,6 +608,7 @@ jobs:
       - name: Build desktop artifact
         shell: bash
         env:
+          pnpm_config_cache_dir: ${{ runner.temp }}/pnpm-metadata
           T3CODE_DESKTOP_REUSE_RESOURCE_MONITOR: ${{ steps.resource_monitor_cache.outputs.cache-hit == 'true' }}
           CSC_LINK: ${{ secrets.CSC_LINK }}
           CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}

.github/workflows/windows-tests.yml

@@ -0,0 +1,81 @@
+# On-demand Windows test lane. Manual only: nothing in the suite passes on
+# Windows yet, so this exists to give contributors (and agents) a cloud Windows
+# box to iterate against. Once the suite is green here, fold it into ci.yml.
+#
+#   gh workflow run windows-tests.yml --ref <branch> -f package=packages/shared
+#   gh workflow run windows-tests.yml --ref <branch> -f package=apps/server \
+#     -f files="src/process/externalLauncher.test.ts src/cli/theme.test.ts"
+#   gh run watch && gh run view --log-failed
+name: Windows Tests
+
+on:
+  workflow_dispatch:
+    inputs:
+      package:
+        description: "Workspace directory to test, e.g. apps/server or packages/shared. Empty runs every package except apps/server."
+        type: string
+        default: ""
+      files:
+        description: "Space-separated test files relative to the package directory. Empty runs the package's whole suite. Requires package."
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test (${{ inputs.package || 'all non-server' }})
+    runs-on: blacksmith-8vcpu-windows-2025
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            /*
+            !/.repos/
+          sparse-checkout-cone-mode: false
+
+      # setup-vp's own cache restores a Linux-shaped store on Windows, which is
+      # slower than no cache (see #7975). Cache pnpm's Windows store directly.
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: false
+          run-install: false
+
+      - name: Resolve package cache path
+        id: package_cache_path
+        shell: pwsh
+        run: '"path=$(vp pm cache dir)" >> $env:GITHUB_OUTPUT'
+
+      - name: Cache packages
+        uses: actions/cache@v6
+        with:
+          path: ${{ steps.package_cache_path.outputs.path }}
+          key: windows-tests-packages-v1-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Install
+        run: vp install
+
+      - name: Ensure Electron runtime is installed
+        if: inputs.package == '' || inputs.package == 'apps/desktop'
+        run: vp run --filter "@t3tools/desktop" ensure:electron
+
+      # `vp run ... test -- <files>` does not forward positional args to vitest,
+      # so file-scoped runs call `vp test run` inside the package instead.
+      - name: Test
+        shell: pwsh
+        run: |
+          $package = '${{ inputs.package }}'
+          $files = '${{ inputs.files }}'
+          if ($package -eq '') {
+            vp run --parallel --concurrency-limit 4 --filter '!t3' --filter '!@t3tools/monorepo' test
+          } elseif ($files -eq '') {
+            vp run --filter "./$package" test
+          } else {
+            Set-Location $package
+            vp test run $files.Split(' ')
+          }

apps/desktop/package.json

@@ -15,6 +15,7 @@
     "@clerk/electron": "catalog:",
     "@clerk/electron-passkeys": "catalog:",
     "@effect/platform-node": "catalog:",
+    "@napi-rs/keyring": "^1.3.0",
     "@t3tools/client-runtime": "workspace:*",
     "@t3tools/contracts": "workspace:*",
     "@t3tools/shared": "workspace:*",

apps/desktop/scripts/browser-secret-native.test.mjs

@@ -0,0 +1,103 @@
+import * as NodeChildProcess from "node:child_process";
+import * as NodeFS from "node:fs";
+import * as NodeOS from "node:os";
+import * as NodePath from "node:path";
+import * as NodeURL from "node:url";
+import { afterAll, beforeAll, describe, expect, it } from "vite-plus/test";
+
+// oxlint-disable-next-line t3code/no-global-process-runtime -- The native compiler targets the actual host; this script has no Effect runtime.
+const hostArch = process.arch;
+// oxlint-disable-next-line t3code/no-global-process-runtime -- Native compilation only runs on the actual Linux host.
+const hostPlatform = process.platform;
+
+describe.skipIf(hostPlatform !== "linux")("bundled libsecret helper", () => {
+  let directory;
+  let executable;
+  beforeAll(() => {
+    directory = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-browser-secret-test-"));
+    executable = NodePath.join(directory, "t3-browser-secret");
+    const root = NodeURL.fileURLToPath(new URL("../../../native/browser-secret/", import.meta.url));
+    const flags = NodeChildProcess.execFileSync(
+      "pkg-config",
+      ["--cflags", "--libs", "libsecret-1"],
+      {
+        encoding: "utf8",
+      },
+    )
+      .trim()
+      .split(/\s+/);
+    NodeChildProcess.execFileSync(
+      process.env.CC || "cc",
+      [
+        "-std=c11",
+        "-Wall",
+        "-Wextra",
+        "-Werror",
+        NodePath.join(root, "main.c"),
+        NodePath.join(root, "test.c"),
+        "-Wl,--wrap=secret_service_search_sync",
+        "-Wl,--wrap=secret_item_get_locked",
+        "-Wl,--wrap=secret_item_get_secret",
+        "-o",
+        executable,
+        ...flags,
+      ],
+      { stdio: "pipe" },
+    );
+  });
+  afterAll(() => {
+    if (directory) NodeFS.rmSync(directory, { recursive: true, force: true });
+  });
+
+  const run = (args) =>
+    NodeChildProcess.spawnSync(executable, args, {
+      env: { ...process.env, DBUS_SESSION_BUS_ADDRESS: "unix:path=/unused-test-bus" },
+    });
+
+  it("builds an executable for the requested architecture into a staged resource directory", () => {
+    const output = NodePath.join(directory, "resources", "browser-secret", "t3-browser-secret");
+    NodeChildProcess.execFileSync(process.execPath, [
+      NodeURL.fileURLToPath(new URL("./build-browser-secret.mjs", import.meta.url)),
+      "--arch",
+      hostArch,
+      "--output",
+      output,
+    ]);
+    const header = NodeFS.readFileSync(output).subarray(0, 20);
+    expect(header.toString("hex", 0, 6)).toBe("7f454c460201");
+    expect(header.readUInt16LE(18)).toBe({ x64: 62, arm64: 183 }[hostArch]);
+    expect(NodeFS.statSync(output).mode & 0o111).not.toBe(0);
+    // Invalid arguments exit before the real executable could contact a keyring.
+    expect(NodeChildProcess.spawnSync(output, []).status).toBe(64);
+  });
+
+  it("preserves the exact secret bytes with no added or removed delimiter", () => {
+    const result = run(["success"]);
+    expect(result.status).toBe(0);
+    expect(result.stdout).toEqual(Buffer.from("secret\0with whitespace \t\r\n"));
+    expect(result.stderr.length).toBe(0);
+  });
+
+  for (const [scenario, code] of [
+    ["missing", 2],
+    ["empty", 2],
+    ["locked", 3],
+    ["cancelled", 3],
+    ["denied", 3],
+    ["unavailable", 4],
+    ["unloaded", 4],
+  ]) {
+    it(`reports ${scenario} without emitting a secret`, () => {
+      const result = run([scenario]);
+      expect(result.status).toBe(code);
+      expect(result.stdout.length).toBe(0);
+    });
+  }
+  it("rejects invalid arguments before accessing the keyring", () => {
+    for (const args of [[], [""], ["chrome", "extra"]]) {
+      const result = run(args);
+      expect(result.status).toBe(64);
+      expect(result.stdout.length).toBe(0);
+    }
+  });
+});