Merge upstream main and preserve Copilot provider support

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ on:
 jobs:
   quality:
     name: Format, Lint, Typecheck, Test, Browser Test, Build
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
       - name: Checkout
@@ -76,7 +76,7 @@ jobs:
 
   release_smoke:
     name: Release Smoke
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
       - name: Checkout

.github/workflows/release.yml

@@ -5,7 +5,7 @@ on:
     tags:
       - "v*.*.*"
   schedule:
-    - cron: "0 9 * * *"
+    - cron: "0 */3 * * *"
   workflow_dispatch:
     inputs:
       channel:
@@ -26,9 +26,46 @@ permissions:
   id-token: write
 
 jobs:
+  check_changes:
+    name: Check for changes since last nightly
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-24.04
+    outputs:
+      has_changes: ${{ steps.check.outputs.has_changes }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - id: check
+        name: Compare HEAD to last nightly tag
+        run: |
+          last_nightly_tag=$(git tag --list 'nightly-v*' --sort=-creatordate | head -n 1)
+          if [[ -z "$last_nightly_tag" ]]; then
+            echo "No previous nightly tag found. Proceeding with release."
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          last_nightly_sha=$(git rev-parse "$last_nightly_tag^{commit}")
+          head_sha=$(git rev-parse HEAD)
+
+          if [[ "$last_nightly_sha" == "$head_sha" ]]; then
+            echo "No changes on main since last nightly release ($last_nightly_tag). Skipping."
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Changes detected on main since $last_nightly_tag ($last_nightly_sha → $head_sha). Proceeding."
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
+
   preflight:
     name: Preflight
-    runs-on: ubuntu-24.04
+    needs: [check_changes]
+    if: |
+      !failure() && !cancelled() &&
+      (github.event_name != 'schedule' || needs.check_changes.outputs.has_changes == 'true')
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 10
     outputs:
       release_channel: ${{ steps.release_meta.outputs.release_channel }}
@@ -37,6 +74,7 @@ jobs:
       release_name: ${{ steps.release_meta.outputs.name }}
       short_sha: ${{ steps.release_meta.outputs.short_sha }}
       previous_tag: ${{ steps.previous_tag.outputs.previous_tag }}
+      cli_dist_tag: ${{ steps.release_meta.outputs.cli_dist_tag }}
       is_prerelease: ${{ steps.release_meta.outputs.is_prerelease }}
       make_latest: ${{ steps.release_meta.outputs.make_latest }}
       ref: ${{ github.sha }}
@@ -79,6 +117,7 @@ jobs:
               --github-output
 
             echo "release_channel=nightly" >> "$GITHUB_OUTPUT"
+            echo "cli_dist_tag=nightly" >> "$GITHUB_OUTPUT"
             echo "is_prerelease=true" >> "$GITHUB_OUTPUT"
             echo "make_latest=false" >> "$GITHUB_OUTPUT"
           else
@@ -102,6 +141,7 @@ jobs:
             echo "version=$version" >> "$GITHUB_OUTPUT"
             echo "tag=v$version" >> "$GITHUB_OUTPUT"
             echo "name=T3 Code v$version" >> "$GITHUB_OUTPUT"
+            echo "cli_dist_tag=latest" >> "$GITHUB_OUTPUT"
             if [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
               echo "is_prerelease=false" >> "$GITHUB_OUTPUT"
               echo "make_latest=true" >> "$GITHUB_OUTPUT"
@@ -131,29 +171,30 @@ jobs:
   build:
     name: Build ${{ matrix.label }}
     needs: preflight
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' }}
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 30
     strategy:
       fail-fast: false
       matrix:
         include:
           - label: macOS arm64
-            runner: macos-26
+            runner: blacksmith-12vcpu-macos-26
             platform: mac
             target: dmg
             arch: arm64
           - label: macOS x64
-            runner: macos-26-intel
+            runner: blacksmith-12vcpu-macos-26
             platform: mac
             target: dmg
             arch: x64
           - label: Linux x64
-            runner: ubuntu-24.04
+            runner: blacksmith-32vcpu-ubuntu-2404
             platform: linux
             target: AppImage
             arch: x64
           - label: Windows x64
-            runner: windows-2022 # blacksmith-32vcpu-windows-2025
+            runner: blacksmith-32vcpu-windows-2025
             platform: win
             target: nsis
             arch: x64
@@ -185,6 +226,23 @@ jobs:
       - name: Align package versions to release version
         run: node scripts/update-release-package-versions.ts "${{ needs.preflight.outputs.version }}"
 
+      - name: Install Spectre-mitigated MSVC libs
+        if: matrix.platform == 'win'
+        shell: pwsh
+        run: |
+          $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+             $installPath = & $vswhere -products * -latest -property installationPath
+             $setupExe = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\setup.exe"
+             $proc = Start-Process -FilePath $setupExe `
+              -ArgumentList "modify", "--installPath", "`"$installPath`"", "--add", `
+              "Microsoft.VisualStudio.Component.VC.Tools.x86.x64.Spectre", "--quiet", "--norestart" `
+              -Wait -PassThru -NoNewWindow
+             if ($null -eq $proc -or $proc.ExitCode -ne 0) {
+               $code = if ($null -ne $proc) { $proc.ExitCode } else { 1 }
+               Write-Error "Visual Studio Installer failed with exit code $code"
+               exit $code
+             }
+
       - name: Build desktop artifact
         shell: bash
         env:
@@ -293,29 +351,73 @@ jobs:
           path: release-publish/*
           if-no-files-found: error
 
-  release:
-    name: Publish GitHub Release
+  publish_cli:
+    name: Publish CLI to npm
     needs: [preflight, build]
-    runs-on: ubuntu-24.04
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.build.result == 'success' }}
+    runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
       - name: Checkout
         uses: actions/checkout@v6
         with:
           ref: ${{ needs.preflight.outputs.ref }}
 
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+
       - name: Setup Node
         uses: actions/setup-node@v6
         with:
           node-version-file: package.json
+          registry-url: https://registry.npmjs.org
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Align package versions to release version
+        run: node scripts/update-release-package-versions.ts "${{ needs.preflight.outputs.version }}"
+
+      - name: Build CLI package
+        run: bun run build --filter=@t3tools/web --filter=t3
+
+      - name: Publish CLI package
+        run: node apps/server/scripts/cli.ts publish --tag "${{ needs.preflight.outputs.cli_dist_tag }}" --app-version "${{ needs.preflight.outputs.version }}" --verbose
+
+  release:
+    name: Publish GitHub Release
+    needs: [preflight, build, publish_cli]
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.build.result == 'success' && needs.publish_cli.result == 'success' }}
+    runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 10
+    steps:
+      - id: app_token
+        name: Mint release app token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.preflight.outputs.ref }}
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version-file: package.json
 
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: package.json
+
       - name: Install dependencies
-        run: bun install --frozen-lockfile --ignore-scripts
+        run: bun install --frozen-lockfile
 
       - name: Download all desktop artifacts
         uses: actions/download-artifact@v8
@@ -383,6 +485,7 @@ jobs:
             release-assets/*.blockmap
             release-assets/*.yml
           fail_on_unmatched_files: true
+          token: ${{ steps.app_token.outputs.token }}
 
       - name: Publish first release
         if: needs.preflight.outputs.previous_tag == ''
@@ -402,12 +505,13 @@ jobs:
             release-assets/*.blockmap
             release-assets/*.yml
           fail_on_unmatched_files: true
+          token: ${{ steps.app_token.outputs.token }}
 
   finalize:
     name: Finalize release
-    if: needs.preflight.outputs.release_channel == 'stable'
+    if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.release.result == 'success' && needs.preflight.outputs.release_channel == 'stable' }}
     needs: [preflight, release]
-    runs-on: ubuntu-24.04
+    runs-on: blacksmith-8vcpu-ubuntu-2404
     timeout-minutes: 10
     steps:
       - id: app_token

apps/desktop/package.json

@@ -23,6 +23,7 @@
     "@t3tools/contracts": "workspace:*",
     "@t3tools/shared": "workspace:*",
     "@types/node": "catalog:",
+    "effect-acp": "workspace:*",
     "tsdown": "catalog:",
     "typescript": "catalog:",
     "vitest": "catalog:"

apps/desktop/src/backendStartupReadiness.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, it, vi } from "vitest";
+
+import { BackendReadinessAbortedError } from "./backendReadiness.ts";
+import { waitForBackendStartupReady } from "./backendStartupReadiness.ts";
+
+describe("waitForBackendStartupReady", () => {
+  it("falls back to the HTTP probe when no listening signal exists", async () => {
+    const waitForHttpReady = vi.fn<() => Promise<void>>().mockResolvedValue(undefined);
+    const cancelHttpWait = vi.fn();
+
+    await expect(
+      waitForBackendStartupReady({
+        waitForHttpReady,
+        cancelHttpWait,
+      }),
+    ).resolves.toBe("http");
+
+    expect(waitForHttpReady).toHaveBeenCalledTimes(1);
+    expect(cancelHttpWait).not.toHaveBeenCalled();
+  });
+
+  it("uses the listening signal and cancels the HTTP probe", async () => {
+    let rejectHttpWait: ((error: unknown) => void) | null = null;
+    const waitForHttpReady = vi.fn(
+      () =>
+        new Promise<void>((_resolve, reject) => {
+          rejectHttpWait = reject;
+        }),
+    );
+    const cancelHttpWait = vi.fn(() => {
+      rejectHttpWait?.(new BackendReadinessAbortedError());
+    });
+
+    await expect(
+      waitForBackendStartupReady({
+        listeningPromise: Promise.resolve(),
+        waitForHttpReady,
+        cancelHttpWait,
+      }),
+    ).resolves.toBe("listening");
+
+    expect(waitForHttpReady).toHaveBeenCalledTimes(1);
+    expect(cancelHttpWait).toHaveBeenCalledTimes(1);
+  });
+
+  it("rejects when the listening signal fails before HTTP readiness", async () => {
+    const error = new Error("backend exited");
+    const waitForHttpReady = vi.fn(() => new Promise<void>(() => {}));
+
+    await expect(
+      waitForBackendStartupReady({
+        listeningPromise: Promise.reject(error),
+        waitForHttpReady,
+        cancelHttpWait: vi.fn(),
+      }),
+    ).rejects.toBe(error);
+  });
+});

apps/desktop/src/backendStartupReadiness.ts

@@ -0,0 +1,56 @@
+import { isBackendReadinessAborted } from "./backendReadiness.ts";
+
+export interface WaitForBackendStartupReadyOptions {
+  readonly listeningPromise?: Promise<void> | null;
+  readonly waitForHttpReady: () => Promise<void>;
+  readonly cancelHttpWait: () => void;
+}
+
+export async function waitForBackendStartupReady(
+  options: WaitForBackendStartupReadyOptions,
+): Promise<"listening" | "http"> {
+  const httpReadyPromise = options.waitForHttpReady();
+  const listeningPromise = options.listeningPromise;
+
+  if (!listeningPromise) {
+    await httpReadyPromise;
+    return "http";
+  }
+
+  return await new Promise<"listening" | "http">((resolve, reject) => {
+    let settled = false;
+
+    const settleResolve = (source: "listening" | "http") => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (source === "listening") {
+        options.cancelHttpWait();
+      }
+      resolve(source);
+    };
+
+    const settleReject = (error: unknown) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      reject(error);
+    };
+
+    listeningPromise.then(
+      () => settleResolve("listening"),
+      (error) => settleReject(error),
+    );
+    httpReadyPromise.then(
+      () => settleResolve("http"),
+      (error) => {
+        if (settled && isBackendReadinessAborted(error)) {
+          return;
+        }
+        settleReject(error);
+      },
+    );
+  });
+}