chore: sync with upstream pingdotgg/t3code main (#43)

Author: yordis

.agents/skills/test-t3-mobile/SKILL.md

@@ -80,7 +80,6 @@ Run Metro from `apps/mobile`.
    APP_VARIANT=development vp exec expo start \
      --dev-client \
      --scheme t3code-dev \
-     --clear \
      --lan \
      --port <metro-port>
    ```
@@ -179,6 +178,7 @@ Keep local verification focused. Do not turn this workflow into a full repositor
 ## Troubleshoot predictable failures
 
 - **Old UI or an old error appears:** verify Metro's worktree, variant, URL, and port before diagnosing the app.
+- **Metro serves stale or invalid transforms after those checks:** stop the owned Metro process and run `vp run dev:client:reset` once on the standard port. For a custom port, add `--clear` to the complete explicit `expo start` command above.
 - **The environment remains empty:** verify the platform-specific HTTP origin, use a fresh token, and confirm project seeding used the identical base directory.
 - **A second client cannot pair:** pairing tokens are single-use; issue another token.
 - **The pairing form opens but does not connect:** confirm the deep link uses the existing `connections/new` route, includes `autoConnect=1`, and carries a freshly minted encoded `pairingUrl`.

.coderabbit.yaml

@@ -0,0 +1,4 @@
+reviews:
+  review_status: false
+  auto_review:
+    enabled: false

.github/VOUCHED.td

@@ -9,6 +9,8 @@
 #   -github:username reason for denouncement
 #
 # Keep entries sorted alphabetically.
+github:0x4bs3nt
+github:Adamulek123
 github:adityavardhansharma
 github:arhxam
 github:bil0000
@@ -26,6 +28,7 @@ github:github-actions[bot]
 github:gsimone
 github:GuilhermeVieiraDev
 github:hwanseoc
+github:ipanasenko
 github:jakeleventhal
 github:jamesx0416
 github:jappyjan
@@ -37,7 +40,9 @@ github:lnieuwenhuis
 github:Lucenx9
 github:mackinleysmith
 github:maria-rcks
+github:maxwellyoung
 github:mwolson
+github:nateEc
 github:nmggithub
 github:Noojuno
 github:notkainoa
@@ -48,6 +53,7 @@ github:PollyGlot
 github:RakshithBhat03
 github:realAhmedRoach
 github:Rishet11
+github:ryanrhughes
 github:saphid
 github:sethwebster
 github:shiroyasha9
@@ -56,6 +62,7 @@ github:StiensWout
 github:SunkenInTime
 github:tarik02
 github:tris203
+github:tsouth89
 github:UtkarshUsername
 github:Yash-Singh1
 github:yashranaway

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -52,10 +55,7 @@ jobs:
         run: vp run build:desktop
 
       - name: Verify preload bundle output
-        run: |
-          test -f apps/desktop/dist-electron/preload.cjs
-          grep -nE "desktopBridge|getLocalEnvironmentBootstrap|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.cjs
-          grep -n "__clerk_internal_electron_passkeys" apps/desktop/dist-electron/preload.cjs
+        run: node apps/desktop/scripts/verify-preload-bundle.mjs
 
   # Everything except `t3` (apps/server). `--parallel` drops the package
   # dependency ordering that `vp run` applies by default: these `test` tasks

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
       - "!v*-nightly.*"
   schedule:
     # Off minute zero: GitHub delays scheduled runs most at the top of the hour.
-    - cron: "7 */3 * * *"
+    - cron: "38 */3 * * *"
   workflow_dispatch:
     inputs:
       channel:
@@ -867,35 +867,6 @@ jobs:
             fi
           done
 
-      # - name: Merge Windows updater manifests
-      #   run: |
-      #     shopt -s nullglob
-      #     found_windows_manifest=false
-      #     for x64_manifest in release-assets/*-win-x64.yml; do
-      #       if [[ "$(basename "$x64_manifest")" == builder-debug-* ]]; then
-      #         continue
-      #       fi
-
-      #       arm64_manifest="${x64_manifest/-x64.yml/-arm64.yml}"
-      #       output_manifest="${x64_manifest/-win-x64.yml/.yml}"
-      #       if [[ ! -f "$arm64_manifest" ]]; then
-      #         echo "Missing matching arm64 Windows manifest for $x64_manifest" >&2
-      #         exit 1
-      #       fi
-
-      #       found_windows_manifest=true
-      #       node scripts/merge-update-manifests.ts --platform win \
-      #         "$arm64_manifest" \
-      #         "$x64_manifest" \
-      #         "$output_manifest"
-      #       rm -f "$arm64_manifest" "$x64_manifest"
-      #     done
-
-      #     if [[ "$found_windows_manifest" != true ]]; then
-      #       echo "No Windows updater manifests found to merge." >&2
-      #       exit 1
-      #     fi
-
       - name: Publish release
         if: needs.preflight.outputs.previous_tag != ''
         uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3

.macroscope/approvability.md

@@ -1 +1,7 @@
 Use Macroscope's default approvability criteria.
+
+Additionally, any pull request that changes product defaults is not auto-approvable and requires human review.
+
+Any pull request that adds or broadens a directive that disables or suppresses a lint,
+type-checker, LSP, or other static-analysis diagnostic is not auto-approvable and requires
+human review. This includes file-level, line-level, and configuration-level overrides.

.macroscope/check-run-agents/effect-service-conventions.md

@@ -82,6 +82,7 @@ Review changed TypeScript and directly affected call sites for the conventions b
 ## Change discipline
 
 - Preserve useful comments, invariants, and specification documentation while moving code.
+- Require every new or broadened directive that disables or suppresses a lint, type-checker, LSP, or other static-analysis diagnostic to have an adjacent comment explaining why that diagnostic must be disabled there. The directive itself is not an explanation. Report a missing explanation as a concrete violation.
 - Do not add large tests solely to prove a mechanical refactor. Update existing tests and imports as needed.
 - If backend behavior changes, require focused tests. Use test implementations/layers for external services only; do not mock out core business logic.
 - Do not require `Layer.effect`, universal namespace imports, generic `make`/`layer` names for abstract-port implementations, separate error classes for diagnostic-only fields, or new tests for import-only changes.

AGENTS.md

@@ -104,6 +104,7 @@ An empty database is a bad test. Seed your worktree's `.t3` with a copy of real
 ## Verifying
 
 - Smallest proof that the change works. `vp test run <files>` for the tests you touched, targeted lint and typecheck for the scope you changed.
+- Test meaningful logic or observable behavior. Do not render components to static markup to assert props or attributes, or add tests that merely assert callback wiring or mirror the implementation.
 - **Do not run repo-wide checks.** No `vp check`, no `vp run -r test`, no `vp run -r typecheck` unless I ask. CI owns the full suite.
 - Backend behavior changes ship with focused tests for that behavior.
 - The server is event-sourced and its async flows emit typed receipts. Wait on receipts and worker drains, never on sleeps or polling. A test that needs a timeout to pass is wrong.

CONTRIBUTING.md

@@ -1,5 +1,10 @@
 # Contributing
 
+## Developer Setup
+
+See the [maintainer scripts guide](docs/internals/scripts.md#first-checkout) for the initial checkout,
+development commands, tests, and platform-specific desktop packaging prerequisites.
+
 ## Read This First
 
 We are not actively accepting contributions right now.