[pull] main from pingdotgg:main

.github/triage/PLAYBOOK.md

@@ -59,8 +59,9 @@ different code depending on it:
 
 Then work from evidence, not assumption. In rough order of value:
 
-- The server log and the trace file (`server.trace.ndjson`) around the time of the
-  problem. Recent failures usually leave a trail here.
+- The trace file (`server.trace.ndjson`) around the time of the problem, plus the
+  service log or desktop backend logs from the context file if they exist. Recent
+  failures usually leave a trail here.
 - The provider event log, for problems with claude/codex/cursor sessions.
 - The SQLite database. Read it freely, but only write when a write is necessary
   to fix the problem the user described, and get their explicit permission

apps/mobile/src/features/threads/ThreadDetailScreen.tsx

@@ -679,10 +679,12 @@ export const ThreadDetailScreen = memo(function ThreadDetailScreen(props: Thread
   const isSplitLayout = layoutVariant === "split";
   const contentMaxWidth = isSplitLayout ? CHAT_CONTENT_MAX_WIDTH : undefined;
   const workspaceContentWidth = useWorkspaceContentWidth();
+  // Clearing animated width can retain the unfolded width after Android resumes folded.
+  // Assign both layouts explicitly so the dock always follows its current parent.
   const composerWidthStyle = useAnimatedStyle(() =>
     isSplitLayout && workspaceContentWidth !== null
-      ? { width: workspaceContentWidth.value, right: undefined }
-      : { width: undefined, right: 0 },
+      ? { width: workspaceContentWidth.value }
+      : { width: "100%" },
   );
   const selectedInstanceId = props.selectedThread.modelSelection.instanceId;
   useStreamingHaptics(props.selectedThread.id, props.selectedThreadFeed);
@@ -964,7 +966,7 @@ export const ThreadDetailScreen = memo(function ThreadDetailScreen(props: Thread
           <Animated.View
             layout={COMPOSER_LAYOUT_TRANSITION}
             pointerEvents="box-none"
-            style={[{ position: "absolute", bottom: 0, left: 0, right: 0 }, composerWidthStyle]}
+            style={[{ position: "absolute", bottom: 0, left: 0 }, composerWidthStyle]}
           >
             {/* No paddingTop here: the overlay's measured height becomes the
                 list's bottom inset, so any padding above the pill/composer

apps/mobile/src/features/threads/ThreadFeed.tsx

@@ -2477,7 +2477,10 @@ export const ThreadFeed = memo(function ThreadFeed(props: ThreadFeedProps) {
   // content-inset override. Seed the fresh instance synchronously with the
   // current overlay height before the scroll integration's next reaction;
   // on Android the declarative contentInset floor covers this same window.
-  const listMountKey = `${feedThreadKey}:${presentedFeed.length === 0 ? "empty" : "filled"}`;
+  // The thinking row a running thread shows while its messages load is not
+  // content: the list must still remount, and so open at the end, when they
+  // arrive.
+  const listMountKey = `${feedThreadKey}:${presentedFeed.some((entry) => entry.type !== "thinking") ? "filled" : "empty"}`;
   useLayoutEffect(() => {
     const bottom = props.contentInsetEndAdjustment.value;
     if (bottom > 0) {

apps/mobile/src/features/usage/UsageRouteScreen.tsx

@@ -101,8 +101,8 @@ export function UsageRouteScreen() {
   );
   const isFocused = useIsFocused();
   const limits = useRefreshLimits(selectedEnvironmentIds, isFocused && tab === "limits");
-  const cursorAccessEnvironments = selectedEnvironments.filter((environment) =>
-    environment.summary?.sources.some((source) => source.action === "enableCursorKeychain"),
+  const cursorAccessEnvironments = selectedEnvironments.filter(
+    (environment) => environment.needsCursorKeychainAccess,
   );
   const refreshAfterCursorEnable = () => {
     void refresh();

apps/mobile/src/state/usage.ts

@@ -16,7 +16,7 @@ import {
   type UsageSummary,
   type UsageSummaryInput,
 } from "@t3tools/contracts";
-import { refreshUsage } from "@t3tools/client-runtime/state/usage";
+import { needsCursorKeychainAccess, refreshUsage } from "@t3tools/client-runtime/state/usage";
 import { mergeUsage, type EnvironmentUsage, type MergedUsage } from "@t3tools/shared/usageMerge";
 import * as Option from "effect/Option";
 import { AsyncResult, Atom } from "effect/unstable/reactivity";
@@ -33,6 +33,7 @@ export interface EnvironmentUsageStatus {
   readonly isConnected: boolean;
   readonly error: string | null;
   readonly summary: UsageSummary | null;
+  readonly needsCursorKeychainAccess: boolean;
 }
 
 /**
@@ -50,13 +51,18 @@ const usageByWindowAtom = Atom.family((windowKey: string) =>
     const statuses: EnvironmentUsageStatus[] = [];
     for (const [environmentId, presentation] of presentations) {
       const result = get(serverEnvironment.usageSummary({ environmentId, input }));
+      const summary = Option.getOrNull(AsyncResult.value(result));
       statuses.push({
         environmentId,
         label: presentation.entry.target.label,
         isPending: result.waiting,
         isConnected: presentation.connection.phase === "connected",
         error: result._tag === "Failure" ? "This environment could not report usage." : null,
-        summary: Option.getOrNull(AsyncResult.value(result)),
+        summary,
+        needsCursorKeychainAccess: needsCursorKeychainAccess(
+          summary,
+          get(serverEnvironment.providersValueAtom(environmentId)),
+        ),
       });
     }
     return statuses;

apps/server/package.json

@@ -31,7 +31,7 @@
     "@opencode-ai/sdk": "^1.3.15",
     "diff": "8.0.3",
     "effect": "catalog:",
-    "node-pty": "^1.1.0",
+    "node-pty": "^1.2.0-beta.15",
     "stream-chain": "^4.2.5",
     "stream-json": "3.6.0",
     "yaml": "catalog:",

apps/server/src/auth/dpop.ts

@@ -18,6 +18,9 @@ import {
 } from "./EnvironmentAuth.ts";
 import * as ServerSecretStore from "./ServerSecretStore.ts";
 
+/** Secret store name prefix of DPoP replay markers. The server prunes expired ones. */
+export const DPOP_REPLAY_MARKER_PREFIX = "dpop-proof-";
+
 export const mapDpopFailureReason = (code: DpopVerificationFailureCodeType): DpopFailureReason => {
   switch (code) {
     case "time_window":
@@ -96,7 +99,7 @@ export const verifyRequestDpopProof = (input: {
     );
     yield* secretStore
       .create(
-        `dpop-proof-${replayKey}`,
+        `${DPOP_REPLAY_MARKER_PREFIX}${replayKey}`,
         new TextEncoder().encode(
           [
             `thumbprint=${result.thumbprint}`,

apps/server/src/auth/replayMarkers.test.ts

@@ -0,0 +1,92 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { assert, it } from "@effect/vitest";
+import * as DateTime from "effect/DateTime";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Path from "effect/Path";
+import * as TestClock from "effect/testing/TestClock";
+
+import * as ServerConfig from "../config.ts";
+import { pruneExpiredReplayMarkers, REPLAY_MARKER_MAX_AGE } from "./replayMarkers.ts";
+import * as ServerSecretStore from "./ServerSecretStore.ts";
+
+// Every secret name the server stores today. The last three stand for names
+// built from an id at runtime.
+const REAL_SECRET_NAMES = [
+  "server-signing-key",
+  "asset-access-signing-key",
+  "cloud-cli-oauth-token",
+  "cloud-cli-desired-link",
+  "cloud-link-ed25519-key-pair",
+  "cloud-link-ed25519-private-key",
+  "cloud-link-ed25519-public-key",
+  "cloud-mint-ed25519-public-key",
+  "cloud-endpoint-runtime-config",
+  "cloud-endpoint-confirmed-origin",
+  "cloud-linked-user-id",
+  "cloud-relay-url",
+  "cloud-relay-issuer",
+  "cloud-relay-environment-credential",
+  "cloud-publish-agent-activity",
+  "provider-env-Y29kZXg-T1BFTkFJX0FQSV9LRVk",
+  "provider-auth-0f1e2d3c4b5a69788796a5b4c3d2e1f00f1e2d3c4b5a69788796a5b4c3d2e1f0",
+  "usage-limit-source-aHVi",
+];
+
+it.layer(NodeServices.layer)("replayMarkers", (it) => {
+  it.effect("prunes only replay markers older than the max age", () =>
+    Effect.gen(function* () {
+      const secretStore = yield* ServerSecretStore.ServerSecretStore;
+      const { secretsDir } = yield* ServerConfig.ServerConfig;
+      const fileSystem = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const now = DateTime.makeUnsafe("2026-01-01T00:00:00Z");
+      const setAge = (fileName: string, age: Duration.Duration) => {
+        const mtime = DateTime.toDateUtc(DateTime.subtractDuration(now, age));
+        return fileSystem.utimes(path.join(secretsDir, fileName), mtime, mtime);
+      };
+      const writeAged = (name: string, age: Duration.Duration) =>
+        secretStore
+          .create(name, Uint8Array.from([1]))
+          .pipe(Effect.andThen(setAge(`${name}.bin`, age)));
+
+      const justExpired = Duration.sum(REPLAY_MARKER_MAX_AGE, Duration.seconds(1));
+      const expiredMarkers = [
+        "dpop-proof-old",
+        "cloud-mint-jti-old",
+        "cloud-mint-nonce-old",
+        "cloud-health-jti-old",
+        "cloud-health-nonce-old",
+      ];
+      for (const name of expiredMarkers) yield* writeAged(name, justExpired);
+      yield* writeAged("dpop-proof-at-max-age", REPLAY_MARKER_MAX_AGE);
+      for (const name of REAL_SECRET_NAMES) yield* writeAged(name, Duration.days(30));
+      const pendingSetFile = "dpop-proof-pending.bin.0000.tmp";
+      yield* fileSystem.writeFile(path.join(secretsDir, pendingSetFile), Uint8Array.from([1]));
+      yield* setAge(pendingSetFile, Duration.days(30));
+      yield* TestClock.setTime(DateTime.toEpochMillis(now));
+
+      yield* pruneExpiredReplayMarkers();
+
+      const remaining = yield* fileSystem.readDirectory(secretsDir);
+      assert.deepStrictEqual(
+        remaining.toSorted(),
+        [
+          ...REAL_SECRET_NAMES.map((name) => `${name}.bin`),
+          "dpop-proof-at-max-age.bin",
+          pendingSetFile,
+        ].toSorted(),
+      );
+    }).pipe(
+      Effect.provide(
+        ServerSecretStore.layer.pipe(
+          Layer.provideMerge(
+            ServerConfig.layerTest(process.cwd(), { prefix: "t3-replay-markers-test-" }),
+          ),
+        ),
+      ),
+    ),
+  );
+});

apps/server/src/auth/replayMarkers.ts

@@ -0,0 +1,77 @@
+import * as Clock from "effect/Clock";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import * as FileSystem from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as Path from "effect/Path";
+import * as Schedule from "effect/Schedule";
+
+import { CLOUD_REPLAY_MARKER_PREFIXES } from "../cloud/http.ts";
+import * as ServerConfig from "../config.ts";
+import { forkParked } from "../serverActivation.ts";
+import { DPOP_REPLAY_MARKER_PREFIX } from "./dpop.ts";
+
+const REPLAY_MARKER_PREFIXES = [DPOP_REPLAY_MARKER_PREFIX, ...CLOUD_REPLAY_MARKER_PREFIXES];
+
+/**
+ * How long a replay marker stays on disk. A marker only matters while its proof
+ * can pass the time check (about 5 minutes for DPoP, 7 for cloud proofs). After
+ * that, the time check rejects a replay by itself. The sweep and the time check
+ * both use the wall clock, so a pruned marker can let a replay through only if
+ * the clock moves back by almost a day, or if the filesystem stamps mtimes almost
+ * a day behind. Markers are files, so a restart does not reset them.
+ */
+export const REPLAY_MARKER_MAX_AGE = Duration.days(1);
+
+/**
+ * Deletes replay markers whose mtime is older than `REPLAY_MARKER_MAX_AGE`.
+ * `ServerSecretStore` saves each secret as `<name>.bin`, so only
+ * `<marker prefix>*.bin` names match. Other secrets and the `*.bin.<uuid>.tmp`
+ * files that `set` writes are never touched.
+ */
+export const pruneExpiredReplayMarkers = Effect.fn("replayMarkers.pruneExpired")(function* () {
+  const fileSystem = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const { secretsDir } = yield* ServerConfig.ServerConfig;
+  const cutoff = (yield* Clock.currentTimeMillis) - Duration.toMillis(REPLAY_MARKER_MAX_AGE);
+  const markers = (yield* fileSystem.readDirectory(secretsDir)).filter(
+    (name) =>
+      name.endsWith(".bin") && REPLAY_MARKER_PREFIXES.some((prefix) => name.startsWith(prefix)),
+  );
+  // `partition` visits every marker, so one locked file does not stop the sweep.
+  const [failures, removed] = yield* Effect.partition(markers, (name) => {
+    const markerPath = path.join(secretsDir, name);
+    return fileSystem.stat(markerPath).pipe(
+      Effect.flatMap((info) =>
+        Option.exists(info.mtime, (mtime) => mtime.getTime() < cutoff)
+          ? fileSystem.remove(markerPath).pipe(Effect.as(true))
+          : Effect.succeed(false),
+      ),
+      Effect.catchReason("PlatformError", "NotFound", () => Effect.succeed(false)),
+    );
+  });
+  yield* Effect.annotateCurrentSpan({
+    "replay_markers.matched": markers.length,
+    "replay_markers.removed": removed.filter(Boolean).length,
+    "replay_markers.failed": failures.length,
+  });
+  if (failures.length > 0) {
+    yield* Effect.logWarning("Failed to prune some replay markers", {
+      failed: failures.length,
+      cause: failures[0],
+    });
+  }
+});
+
+/** Prunes expired replay markers after server activation, then every hour. */
+export const layer = Layer.effectDiscard(
+  forkParked(
+    pruneExpiredReplayMarkers().pipe(
+      Effect.catch((cause) =>
+        Effect.logWarning("Failed to prune expired replay markers", { cause }),
+      ),
+      Effect.repeat(Schedule.spaced(Duration.hours(1))),
+    ),
+  ),
+);

apps/server/src/bin.ts

@@ -24,6 +24,7 @@ import { serviceLauncherCommand } from "./cli/serviceLauncher.ts";
 import { servicePreflightCommand } from "./cli/servicePreflight.ts";
 import { sshHelperCommand } from "./cli/sshHelper.ts";
 import { themeCommand } from "./cli/theme.ts";
+import { traceCommand } from "./cli/trace.ts";
 import { triageCommand } from "./cli/triage.ts";
 
 const CliRuntimeLayer = Layer.mergeAll(NodeServices.layer, NetService.layer);
@@ -71,6 +72,7 @@ export const makeCli = ({ cloudEnabled = hasCloudPublicConfig } = {}) =>
       servicePreflightCommand,
       sshHelperCommand,
       themeCommand,
+      traceCommand,
       triageCommand,
       cloudEnabled ? connectCommand : connectUnavailableCommand,
     ]),

apps/server/src/checkpointing/CheckpointDiffQuery.test.ts

@@ -84,6 +84,7 @@ describe("CheckpointDiffQuery.layer", () => {
             getShellSnapshot: () =>
               Effect.die("CheckpointDiffQuery should not request the orchestration shell snapshot"),
             getDeletedWorktreeThreads: () => Effect.die("unused"),
+            listThreadsWithPullRequests: () => Effect.die("unused"),
             getArchivedShellSnapshot: () =>
               Effect.die("CheckpointDiffQuery should not request archived shell snapshots"),
             getSnapshotSequence: () => Effect.succeed({ snapshotSequence: 0 }),
@@ -201,6 +202,7 @@ describe("CheckpointDiffQuery.layer", () => {
             getShellSnapshot: () =>
               Effect.die("CheckpointDiffQuery should not request the orchestration shell snapshot"),
             getDeletedWorktreeThreads: () => Effect.die("unused"),
+            listThreadsWithPullRequests: () => Effect.die("unused"),
             getArchivedShellSnapshot: () =>
               Effect.die("CheckpointDiffQuery should not request archived shell snapshots"),
             getSnapshotSequence: () => Effect.succeed({ snapshotSequence: 0 }),
@@ -293,6 +295,7 @@ describe("CheckpointDiffQuery.layer", () => {
             getShellSnapshot: () =>
               Effect.die("CheckpointDiffQuery should not request the orchestration shell snapshot"),
             getDeletedWorktreeThreads: () => Effect.die("unused"),
+            listThreadsWithPullRequests: () => Effect.die("unused"),
             getArchivedShellSnapshot: () =>
               Effect.die("CheckpointDiffQuery should not request archived shell snapshots"),
             getSnapshotSequence: () => Effect.succeed({ snapshotSequence: 0 }),
@@ -370,6 +373,7 @@ describe("CheckpointDiffQuery.layer", () => {
             getShellSnapshot: () =>
               Effect.die("CheckpointDiffQuery should not request the orchestration shell snapshot"),
             getDeletedWorktreeThreads: () => Effect.die("unused"),
+            listThreadsWithPullRequests: () => Effect.die("unused"),
             getArchivedShellSnapshot: () =>
               Effect.die("CheckpointDiffQuery should not request archived shell snapshots"),
             getSnapshotSequence: () => Effect.succeed({ snapshotSequence: 0 }),
@@ -432,6 +436,7 @@ describe("CheckpointDiffQuery.layer", () => {
             getShellSnapshot: () =>
               Effect.die("CheckpointDiffQuery should not request the orchestration shell snapshot"),
             getDeletedWorktreeThreads: () => Effect.die("unused"),
+            listThreadsWithPullRequests: () => Effect.die("unused"),
             getArchivedShellSnapshot: () =>
               Effect.die("CheckpointDiffQuery should not request archived shell snapshots"),
             getSnapshotSequence: () => Effect.succeed({ snapshotSequence: 0 }),

apps/server/src/cli/config.test.ts

@@ -508,7 +508,6 @@ it.layer(NodeServices.layer)("cli config resolution", (it) => {
         resolved.terminalLogsDir,
         resolved.attachmentsDir,
         resolved.worktreesDir,
-        path.dirname(resolved.serverLogPath),
         path.dirname(resolved.serverTracePath),
       ]) {
         expect(yield* fs.exists(directory)).toBe(true);

apps/server/src/cli/config.ts

@@ -82,16 +82,22 @@ const tailscaleServePortFlag = Flag.Int("tailscale-serve-port").pipe(
   Flag.optional,
 );
 
+// Trace file location, shared by the server and `t3 trace summary`.
+export const traceFileConfig = Config.String("T3CODE_TRACE_FILE").pipe(
+  Config.option,
+  Config.map(Option.getOrUndefined),
+);
+export const traceMaxFilesConfig = Config.Int("T3CODE_TRACE_MAX_FILES").pipe(
+  Config.withDefault(10),
+);
+
 const EnvServerConfig = Config.all({
   logLevel: Config.LogLevel("T3CODE_LOG_LEVEL").pipe(Config.withDefault("Info")),
   traceMinLevel: Config.LogLevel("T3CODE_TRACE_MIN_LEVEL").pipe(Config.withDefault("Info")),
   traceTimingEnabled: Config.Boolean("T3CODE_TRACE_TIMING_ENABLED").pipe(Config.withDefault(true)),
-  traceFile: Config.String("T3CODE_TRACE_FILE").pipe(
-    Config.option,
-    Config.map(Option.getOrUndefined),
-  ),
+  traceFile: traceFileConfig,
   traceMaxBytes: Config.Int("T3CODE_TRACE_MAX_BYTES").pipe(Config.withDefault(10 * 1024 * 1024)),
-  traceMaxFiles: Config.Int("T3CODE_TRACE_MAX_FILES").pipe(Config.withDefault(10)),
+  traceMaxFiles: traceMaxFilesConfig,
   traceBatchWindowMs: Config.Int("T3CODE_TRACE_BATCH_WINDOW_MS").pipe(Config.withDefault(1_000)),
   otlpTracesUrl: Config.String("T3CODE_OTLP_TRACES_URL").pipe(
     Config.option,