Merge upstream e6987965f into Marcode

.agents/skills/marcode-upstream-integration/SKILL.md

@@ -0,0 +1,108 @@
+---
+name: marcode-upstream-integration
+description: Safely plan, resolve, verify, and hand off upstream T3 Code integrations into Marcode while preserving Marcode customizations, merge metadata, and recoverable work. Use for upstream plans, conflict resolution, merge audits, integration branches, or future fork-sync automation.
+---
+
+# Marcode Upstream Integration
+
+Use this skill with `$marcode-fork-maintenance` and `$marcode-customizations`. Add
+`$marcode-skill-upkeep`, `$unified-workspace-sidebar`, `$test-t3-app`, or `$test-t3-mobile`
+when the touched paths require them.
+
+## Non-negotiable invariant
+
+An upstream integration must preserve both:
+
+- upstream correctness, security, protocol, dependency, and operational behavior;
+- Marcode's intentional product behavior, branding, compatibility identifiers, and source-of-truth
+  architecture.
+
+Never solve a conflict with a whole-file ours/theirs choice, a mass replacement, or an assumption
+that every Marcode change should win.
+
+## Protected merge state
+
+Treat the integration checkout as a protected state machine. During an active merge:
+
+- Never run `git stash`, `git reset`, `git restore`, `git clean`, force push, or broad checkout.
+- Never use stash as a temporary baseline comparison or as a way to test whether an error is
+  pre-existing. Use `git show <sha>:<path>`, `git diff <sha>...HEAD`, or a separate detached
+  worktree created from the baseline.
+- Never run a command that can implicitly clean up the checkout without checking its effect on
+  `MERGE_HEAD` first.
+- Do not let an agent or wrapper “normalize” the tree after an audit. A clean audit means the
+  merge state and staged resolution remain intact.
+
+Before and after every stateful edit, test, install, formatter, or audit command, verify:
+
+```sh
+git rev-parse --abbrev-ref HEAD
+git rev-parse --verify MERGE_HEAD
+git diff --name-only --diff-filter=U
+git status --short
+```
+
+The `MERGE_HEAD` SHA must remain unchanged until the merge is intentionally concluded. If it
+disappears, stop immediately, report the command that preceded it, and do not continue editing or
+declare success. Do not apply a recovery stash without Marco's explicit approval.
+
+## Workflow
+
+1. Read `AGENTS.md`, `.github/upstream-sync.yml`, and the upstream-sync runbook.
+2. Run the read-only upstream status/plan command and record source SHA, target SHA, merge base,
+   changed paths, hotspots, and conflicts.
+3. Create or use `integrate/upstream-<short-sha>` from the intended Marcode target. Confirm the
+   target branch and worktree before merging.
+4. Merge the exact upstream SHA with the repository's guarded workflow. Record `MERGE_HEAD`.
+5. Resolve conflicts path by path. For each path, write down upstream intent, Marcode intent, the
+   smallest combined rule, and the focused verification.
+6. Stage only reviewed resolutions. Do not stage unrelated dirty work or generated backups.
+7. Run focused tests and typechecks. Preserve the merge sentinel before and after each check.
+8. Audit conflict markers, unmerged paths, staged diffs, `.bak` artifacts, compatibility names,
+   hotspot coverage, and the sibling surfaces named by the customization map.
+9. Keep the integration branch uncommitted or unpushed until Marco explicitly authorizes the
+   final commit/push. Do not push on behalf of Marco.
+
+## Safe baseline verification
+
+To prove a failure is pre-existing, do not touch the active integration state. Prefer:
+
+```sh
+git show <target-sha>:<path>
+git diff <target-sha>...HEAD -- <path>
+```
+
+If a command must execute against the baseline checkout, use a disposable detached worktree
+outside the integration worktree, run the focused check there, then remove only that exact
+temporary worktree after recording its result. Never stash the integration worktree to make room.
+
+## Conflict rules
+
+- Preserve upstream security and correctness changes even in hotspot files.
+- Preserve Marcode's floating editor, unified workspace tree, branding, and other documented
+  product contracts when upstream assumes a different surface.
+- Keep upstream-shaped compatibility identifiers such as `@t3tools/*`, storage keys, schemes,
+  bundle identifiers, protocol names, and internal labels unless a deliberate migration says
+  otherwise.
+- Add comments only where ownership or an intentional divergence is non-obvious; explain the
+  invariant, not the merge history.
+- Remove temporary `.bak` artifacts before the audit. `*.bak` is already ignored, but ignored does
+  not mean acceptable residue.
+- Regenerate lockfiles with the repository's package manager; do not hand-edit them.
+
+## Completion gate
+
+Before reporting the integration ready, provide evidence for:
+
+- exact source, target, merge-base, branch, and `MERGE_HEAD` SHAs;
+- every conflict path and the combined upstream/Marcode decision;
+- zero unmerged paths and zero conflict markers;
+- expected staged diff, no unexpected deletions, no `.bak` files, and `git diff --cached --check`;
+- focused tests, typechecks, and relevant live client verification;
+- compatibility identifiers and sibling customizations checked;
+- no force push, reset, restore, stash, clean, wholesale ours/theirs choice, or direct merge into
+  `main` occurred;
+- anything still unverified or blocked.
+
+If the merge sentinel changed unexpectedly, the completion gate fails even if the files look
+resolved.

.agents/skills/marcode-upstream-integration/agents/openai.yaml

@@ -0,0 +1,3 @@
+display_name: "Marcode Upstream Integration"
+short_description: "Safely merge upstream changes into Marcode"
+default_prompt: "Use $marcode-upstream-integration to plan, resolve, verify, and hand off an upstream sync without losing Marcode behavior or merge state."

.github/upstream-sync.yml

@@ -26,7 +26,7 @@ schedule:
 
 pullRequest:
   draft: true
-  titleTemplate: "chore(upstream): sync t3code through {upstreamShortSha}"
+  titleTemplate: "chore(upstream): sync marcode through {upstreamShortSha}"
   labels:
     - upstream-sync
   reviewers: []

.github/workflows/ci.yml

@@ -22,6 +22,11 @@ jobs:
           cache: true
           run-install: true
 
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+
       - name: Ensure Electron runtime is installed
         run: vp run --filter @t3tools/desktop ensure:electron
 
@@ -31,6 +36,9 @@ jobs:
       - name: Typecheck
         run: vpr typecheck
 
+      - name: Check resource monitor formatting
+        run: cargo fmt --manifest-path native/resource-monitor/Cargo.toml -- --check
+
       - name: Build desktop pipeline
         run: vp run build:desktop
 
@@ -55,6 +63,9 @@ jobs:
           cache: true
           run-install: true
 
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+
       - name: Ensure Electron runtime is installed
         run: vp run --filter @t3tools/desktop ensure:electron
 
@@ -64,6 +75,9 @@ jobs:
       - name: Test
         run: vp run test
 
+      - name: Test resource monitor
+        run: cargo test --locked --manifest-path native/resource-monitor/Cargo.toml
+
   mobile_native_static_analysis:
     name: Mobile Native Static Analysis
     runs-on: macos-26

.github/workflows/release.yml

@@ -326,21 +326,29 @@ jobs:
             platform: mac
             target: dmg
             arch: arm64
+            rust_target: aarch64-apple-darwin
+            resource_key: darwin-arm64
           - label: macOS x64
             runner: blacksmith-12vcpu-macos-26
             platform: mac
             target: dmg
             arch: x64
+            rust_target: x86_64-apple-darwin
+            resource_key: darwin-x64
           - label: Linux x64
             runner: blacksmith-32vcpu-ubuntu-2404
             platform: linux
             target: AppImage
             arch: x64
+            rust_target: x86_64-unknown-linux-gnu
+            resource_key: linux-x64
           - label: Windows x64
             runner: blacksmith-32vcpu-windows-2025
             platform: win
             target: nsis
             arch: x64
+            rust_target: x86_64-pc-windows-msvc
+            resource_key: win32-x64
           # - label: Windows arm64
           #   runner: windows-11-arm
           #   platform: win
@@ -360,6 +368,11 @@ jobs:
           cache: true
           run-install: true
 
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.rust_target }}
+
       - name: Download relay client tracing config
         uses: actions/download-artifact@v8
         with:
@@ -600,13 +613,33 @@ jobs:
           #   done
           # fi
 
+      - name: Collect resource monitor
+        shell: bash
+        run: |
+          set -euo pipefail
+          binary_name="t3-resource-monitor"
+          if [[ "${{ matrix.platform }}" == "win" ]]; then
+            binary_name="${binary_name}.exe"
+          fi
+          source_path="native/resource-monitor/target/${{ matrix.rust_target }}/release/${binary_name}"
+          target_dir="resource-monitor-publish/${{ matrix.resource_key }}"
+          mkdir -p "$target_dir"
+          cp "$source_path" "$target_dir/$binary_name"
+
       - name: Upload build artifacts
         uses: actions/upload-artifact@v7
         with:
           name: desktop-${{ matrix.platform }}-${{ matrix.arch }}
           path: release-publish/*
           if-no-files-found: error
 
+      - name: Upload resource monitor
+        uses: actions/upload-artifact@v7
+        with:
+          name: resource-monitor-${{ matrix.resource_key }}
+          path: resource-monitor-publish/${{ matrix.resource_key }}/*
+          if-no-files-found: error
+
   publish_cli:
     name: Publish CLI to npm
     needs: [preflight, relay_public_config, build]
@@ -661,6 +694,24 @@ jobs:
       - name: Build CLI package
         run: vp run --filter t3 build
 
+      - name: Download resource monitors
+        uses: actions/download-artifact@v8
+        with:
+          pattern: resource-monitor-*
+          path: ${{ runner.temp }}/resource-monitors
+
+      - name: Bundle resource monitors into CLI package
+        shell: bash
+        run: |
+          set -euo pipefail
+          for artifact_dir in "$RUNNER_TEMP"/resource-monitors/resource-monitor-*; do
+            resource_key="${artifact_dir##*/resource-monitor-}"
+            target_dir="apps/server/dist/resource-monitor/${resource_key}"
+            mkdir -p "$target_dir"
+            cp "$artifact_dir"/t3-resource-monitor* "$target_dir/"
+            chmod +x "$target_dir"/t3-resource-monitor 2>/dev/null || true
+          done
+
       - name: Publish CLI package
         run: node apps/server/scripts/cli.ts publish --tag "${{ needs.preflight.outputs.cli_dist_tag }}" --app-version "${{ needs.preflight.outputs.version }}" --verbose
 
@@ -866,6 +917,7 @@ jobs:
           echo "Deploying hosted web app for $channel_name channel."
           deployment_url="$(
             vp dlx vercel@53.1.1 deploy \
+              --archive=tgz \
               --prod \
               --skip-domain \
               --yes \

.gitignore

@@ -30,6 +30,7 @@ dist-electron/
 .showcase/
 apps/mobile/.showcase/
 artifacts/app-store/screenshots/
+native/**/target/
 node_modules/
 .alchemy/
 *.log

.macroscope/check-run-agents/effect-service-conventions.md

@@ -1,6 +1,6 @@
 ---
 title: Effect Service Conventions
-model: claude-opus-4-8
+model: claude-opus-5
 effort: high
 input: full_diff
 tools:

.repos/alchemy-effect/.eslintignore

@@ -1 +1 @@
-alchemy/test/**
+alchemy/test/**

.repos/alchemy-effect/.github/pr-assets/update-screenshots.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Regenerate the PR screenshots from the built site and commit them if changed.
+# Usage: .github/pr-assets/update-screenshots.sh [pr-number]
+# Assumes website/dist is freshly built (DOCS_FAST=1 bun astro build).
+set -euo pipefail
+
+PR="${1:-721}"
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+OUT="$ROOT/.github/pr-assets/$PR"
+DIST="$ROOT/website/dist"
+CHROME="/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
+PORT=4899
+
+[ -d "$DIST" ] || { echo "website/dist missing — build first"; exit 1; }
+mkdir -p "$OUT"
+
+python3 -m http.server "$PORT" --directory "$DIST" >/dev/null 2>&1 &
+SERVER_PID=$!
+trap 'kill $SERVER_PID 2>/dev/null || true' EXIT
+sleep 1
+
+shot() { # shot <file> <path> [extra chrome flags...]
+  local file="$1" path="$2"; shift 2
+  "$CHROME" --headless=new --disable-gpu --hide-scrollbars \
+    --window-size=1600,1000 --virtual-time-budget=6000 \
+    "$@" --screenshot="$OUT/$file" "http://localhost:$PORT$path" 2>/dev/null
+  echo "$file: $(wc -c <"$OUT/$file" | tr -d ' ') bytes"
+}
+
+shot landing.png /
+shot docs-tab.png /getting-started/
+shot cloudflare-hub.png /cloudflare/
+shot aws-hub.png /aws/
+shot planetscale-hub.png /planetscale/
+shot axiom-hub.png /axiom/
+shot reference.png /providers/cloudflare/workers/durableobject/
+shot cloudflare-hub-dark.png /cloudflare/ --force-dark-mode --blink-settings=preferredColorScheme=2
+
+cd "$ROOT"
+if git status --porcelain -- ".github/pr-assets/$PR" | grep -q .; then
+  git add ".github/pr-assets/$PR"
+  git commit -q -m "chore(website): refresh PR screenshots
+
+Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>"
+  git push
+  echo "screenshots refreshed and pushed"
+else
+  echo "screenshots unchanged"
+fi

.repos/alchemy-effect/.github/workflows/check.yml

@@ -0,0 +1,41 @@
+name: check
+
+# Runs the website docs validator (`bun run docs:check`) on every PR
+# so broken links / missing API references fail fast before merge.
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: "24"
+
+jobs:
+  check:
+    runs-on: ubuntu-22-large
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # `bun install` needs the distilled submodule (workspace member)
+          submodules: true
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: latest
+
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.bun/install/cache
+          key: bun-${{ runner.os }}-${{ hashFiles('bun.lock') }}
+          restore-keys: bun-${{ runner.os }}-
+
+      - run: bun install
+      - run: bun tsc -b
+      - run: bun run docs:check