fix: recover stale thread state and transferred sessions

.dockerignore

@@ -0,0 +1,15 @@
+node_modules
+.bun
+.turbo
+.git
+.env
+.env.*
+release
+release-mock
+build
+dist
+dist-electron
+apps/*/dist
+packages/*/dist
+*.log
+*.tsbuildinfo

.github/workflows/ci.yml

@@ -9,8 +9,8 @@ on:
 jobs:
   check:
     name: Check
-    runs-on: blacksmith-8vcpu-ubuntu-2404
-    timeout-minutes: 10
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -25,11 +25,14 @@ jobs:
       - name: Ensure Electron runtime is installed
         run: vp run --filter @t3tools/desktop ensure:electron
 
+      - name: Build oxlint plugin
+        run: vp run --filter @t3tools/oxlint-plugin-t3code build
+
       - name: Check
         run: vp check
 
       - name: Typecheck
-        run: vpr typecheck
+        run: vp run typecheck
 
       - name: Build desktop pipeline
         run: vp run build:desktop
@@ -42,8 +45,8 @@ jobs:
 
   test:
     name: Test
-    runs-on: blacksmith-8vcpu-ubuntu-2404
-    timeout-minutes: 10
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v6
@@ -63,7 +66,7 @@ jobs:
 
   mobile_native_static_analysis:
     name: Mobile Native Static Analysis
-    runs-on: blacksmith-12vcpu-macos-26
+    runs-on: macos-15
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -84,7 +87,7 @@ jobs:
 
   release_smoke:
     name: Release Smoke
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout

.github/workflows/deploy-relay.yml

@@ -17,7 +17,7 @@ concurrency:
 jobs:
   deploy_relay:
     name: Deploy production relay
-    runs-on: blacksmith-8vcpu-ubuntu-2404
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     environment:
       name: production
@@ -36,17 +36,73 @@ jobs:
       APNS_BUNDLE_ID: ${{ vars.APNS_BUNDLE_ID }}
       ALCHEMY_TELEMETRY_DISABLED: "1"
     steps:
+      - name: Check relay deployment config
+        id: relay-config
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          PLANETSCALE_API_TOKEN_ID: ${{ secrets.PLANETSCALE_API_TOKEN_ID }}
+          PLANETSCALE_API_TOKEN: ${{ secrets.PLANETSCALE_API_TOKEN }}
+          AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }}
+          CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
+          APNS_PRIVATE_KEY: ${{ secrets.APNS_PRIVATE_KEY }}
+        run: |
+          required=(
+            CLOUDFLARE_ACCOUNT_ID
+            PLANETSCALE_ORGANIZATION
+            AXIOM_ORG_ID
+            RELAY_API_ZONE_NAME
+            RELAY_TUNNEL_ZONE_NAME
+            CLERK_PUBLISHABLE_KEY
+            CLERK_JWT_AUDIENCE
+            APNS_ENVIRONMENT
+            APNS_TEAM_ID
+            APNS_KEY_ID
+            APNS_BUNDLE_ID
+            CLOUDFLARE_API_TOKEN
+            PLANETSCALE_API_TOKEN_ID
+            PLANETSCALE_API_TOKEN
+            AXIOM_TOKEN
+            CLERK_SECRET_KEY
+            APNS_PRIVATE_KEY
+          )
+
+          present=0
+          missing=()
+          for name in "${required[@]}"; do
+            if [ -n "${!name}" ]; then
+              present=$((present + 1))
+            else
+              missing+=("$name")
+            fi
+          done
+
+          if [ "$present" -eq 0 ]; then
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::Relay production deploy is skipped because production relay Actions variables and secrets are not configured."
+            exit 0
+          fi
+
+          if [ "${#missing[@]}" -gt 0 ]; then
+            echo "::error::Relay production deploy config is incomplete. Missing: ${missing[*]}"
+            exit 1
+          fi
+
+          echo "configured=true" >> "$GITHUB_OUTPUT"
+
       - name: Checkout
+        if: steps.relay-config.outputs.configured == 'true'
         uses: actions/checkout@v6
 
       - name: Setup Vite+
+        if: steps.relay-config.outputs.configured == 'true'
         uses: voidzero-dev/setup-vp@v1
         with:
           node-version-file: package.json
           cache: true
           run-install: true
 
       - name: Deploy production relay stage
+        if: steps.relay-config.outputs.configured == 'true'
         id: deploy
         run: vp run --filter t3code-relay deploy --stage prod --yes --github-output
         env:
@@ -58,6 +114,7 @@ jobs:
           APNS_PRIVATE_KEY: ${{ secrets.APNS_PRIVATE_KEY }}
 
       - name: Publish relay deploy commit status
+        if: steps.relay-config.outputs.configured == 'true'
         uses: actions/github-script@v8
         with:
           script: |
@@ -78,3 +135,18 @@ jobs:
               description,
               target_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
             });
+
+      - name: Publish skipped relay deploy commit status
+        if: steps.relay-config.outputs.configured == 'false'
+        uses: actions/github-script@v8
+        with:
+          script: |
+            await github.rest.repos.createCommitStatus({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              sha: context.sha,
+              state: "success",
+              context: "Relay deploy / production",
+              description: "Relay production deploy skipped; config is not present.",
+              target_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+            });

.github/workflows/fork-push-nightly.yml

@@ -0,0 +1,134 @@
+name: Fork Push Nightly
+
+# Creates updater-visible nightly fork releases for Brad-authored changes.
+# Normal pushes to main should ship through the nightly feed only. The next
+# upstream stable sync still rebases these fork commits onto the upstream stable
+# tag and publishes the integrated stable release.
+
+on:
+  push:
+    branches:
+      - main
+    # Keep this allowlist narrow. Helper-script/docs/workflow maintenance should
+    # not publish an updater-visible desktop release.
+    paths:
+      - "apps/desktop/**"
+      - "apps/server/**"
+      - "apps/web/**"
+      - "assets/**"
+      - "packages/**"
+      - "scripts/build-desktop-artifact.ts"
+      - "scripts/build-headless-artifact.ts"
+      - "scripts/lib/brand-assets.ts"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+  workflow_dispatch:
+
+permissions:
+  actions: write
+  contents: write
+
+concurrency:
+  group: fork-push-nightly
+  cancel-in-progress: false
+
+jobs:
+  tag:
+    name: Tag fork push nightly
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout fork
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          # Fork nightly rebases can include upstream workflow changes.
+          token: ${{ secrets.GH_PAT || github.token }}
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: false
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Resolve and push next fork tag
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT || github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          HEAD_MESSAGE: ${{ github.event.head_commit.message }}
+        run: |
+          set -euo pipefail
+
+          if [[ "$EVENT_NAME" == "push" && "$HEAD_MESSAGE" == chore\(release\):\ prepare* ]]; then
+            echo "Release finalize version-bump commit; no fork push nightly tag needed."
+            exit 0
+          fi
+
+          # sync-upstream pushes main and then a release tag. Give the tag push
+          # a moment to appear so sync-created commits do not get double-tagged
+          # as push nightlies.
+          sleep 30
+          git fetch --tags origin
+
+          existing_head_tags=$(git tag --points-at HEAD --list 'v*')
+          if [[ -n "$existing_head_tags" ]]; then
+            echo "HEAD already has release tag(s); no fork push nightly tag needed:"
+            echo "$existing_head_tags" | sed 's/^/  /'
+            exit 0
+          fi
+
+          upstream_tag=$(gh release list --repo pingdotgg/t3code --limit 50 \
+            --json tagName,isPrerelease,publishedAt \
+            --jq '[.[] | select(.isPrerelease and (.tagName | test("(^|-)v[0-9]+\\.[0-9]+\\.[0-9]+-nightly\\.")))] | sort_by(.publishedAt) | reverse | .[0].tagName')
+          if [[ -z "$upstream_tag" || "$upstream_tag" == "null" ]]; then
+            echo "::error::No nightly release found on upstream."
+            exit 1
+          fi
+          echo "Latest upstream nightly release: $upstream_tag"
+
+          export CI_REPAIR_BOT_UPSTREAM_TARGET="refs/tags/upstream/${upstream_tag}"
+          export CI_REPAIR_BOT_UPSTREAM_SOURCE_REF="refs/tags/${upstream_tag}"
+          export CI_REPAIR_BOT_CONFLICT_MODE=fail
+          scripts/ci/reproduce-sync-upstream
+
+          mapfile -t existing_numbers < <(git tag --list "${upstream_tag}-fork.*" \
+            | awk -F '-fork\\.' 'NF==2 && $2 ~ /^[0-9]+$/ { print $2 }' \
+            | sort -n)
+
+          if [[ ${#existing_numbers[@]} -eq 0 ]]; then
+            next_n=1
+          else
+            last="${existing_numbers[-1]}"
+            next_n=$((last + 1))
+          fi
+
+          new_tag="${upstream_tag}-fork.${next_n}"
+          version="${new_tag#v}"
+          # A freshly rebased upstream may change package manifests before the
+          # fork release-version stamp. Refresh the lockfile first so the
+          # install used to run the stamping script is not blocked by stale
+          # pre-rebase lock metadata.
+          vp install --lockfile-only --ignore-scripts
+          vp install --frozen-lockfile --ignore-scripts
+          node scripts/update-release-package-versions.ts "$version"
+          vp fmt apps/server/package.json apps/desktop/package.json apps/web/package.json packages/contracts/package.json
+          vp install --lockfile-only --ignore-scripts
+
+          if ! git diff --quiet -- apps/server/package.json apps/desktop/package.json apps/web/package.json packages/contracts/package.json pnpm-lock.yaml; then
+            git add apps/server/package.json apps/desktop/package.json apps/web/package.json packages/contracts/package.json pnpm-lock.yaml
+            git commit -m "chore(release): prepare $new_tag"
+          else
+            echo "Package versions already match $version."
+          fi
+
+          git tag "$new_tag" HEAD
+          git push origin HEAD:main --force-with-lease
+          git push origin "$new_tag"
+          echo "Pushed $new_tag for fork push nightly update. release.yml will publish it to the nightly feed."

.github/workflows/mobile-eas-development-rollback.yml

@@ -0,0 +1,78 @@
+name: Mobile EAS Development Rollback
+
+on:
+  workflow_dispatch:
+    inputs:
+      runtime_version:
+        description: "Runtime version to roll back to the embedded update"
+        required: true
+        default: "0.1.0"
+        type: string
+      message:
+        description: "EAS rollback message"
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  rollback-development-update:
+    name: Roll back iOS development runtime to embedded
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    env:
+      APP_VARIANT: development
+      EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
+      NODE_OPTIONS: --max-old-space-size=8192
+    steps:
+      - name: Require Expo token
+        run: |
+          if [ -z "$EXPO_TOKEN" ]; then
+            echo "EXPO_TOKEN repository secret is required to roll back EAS updates." >&2
+            exit 1
+          fi
+
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Expose pnpm
+        run: |
+          pnpm_version="$(node --print "require('./package.json').packageManager.split('@').pop()")"
+          vp_pnpm_bin="$HOME/.vite-plus/package_manager/pnpm/$pnpm_version/pnpm/bin"
+          echo "$vp_pnpm_bin" >> "$GITHUB_PATH"
+          "$vp_pnpm_bin/pnpm" --version
+
+      - name: Setup EAS
+        uses: expo/expo-github-action@v8
+        with:
+          eas-version: latest
+          token: ${{ secrets.EXPO_TOKEN }}
+          packager: pnpm
+
+      - name: Roll back iOS development runtime to embedded
+        working-directory: apps/mobile
+        env:
+          RUNTIME_VERSION: ${{ inputs.runtime_version }}
+          ROLLBACK_MESSAGE: ${{ inputs.message }}
+        run: |
+          if [ -z "$ROLLBACK_MESSAGE" ]; then
+            ROLLBACK_MESSAGE="rollback development runtime ${RUNTIME_VERSION} to embedded"
+          fi
+
+          APP_VARIANT=development \
+          CI=1 \
+          EXPO_NO_GIT_STATUS=1 \
+          eas update:roll-back-to-embedded \
+            --channel development \
+            --runtime-version "$RUNTIME_VERSION" \
+            --platform ios \
+            --message "$ROLLBACK_MESSAGE" \
+            --non-interactive