aaditagrawal
diff --git a/‎.env.example‎
Lines changed: 17 additions & 0 deletions b/‎.env.example‎
Lines changed: 17 additions & 0 deletions
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 130 additions & 100 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 130 additions & 100 deletions
diff --git a/‎.github/workflows/deploy-relay.yml‎
Lines changed: 80 additions & 0 deletions b/‎.github/workflows/deploy-relay.yml‎
Lines changed: 80 additions & 0 deletions
@@ -0,0 +1,17 @@
+# Optional: T3 Connect source builds
+# Leave these unset to disable optional T3 Connect features in local source builds.
+# Release builds inject their public values at build time. Do not add server-side
+# secrets to this file.
+
+# Get these from the Clerk Dashboard under API keys, JWT templates, and OAuth applications.
+# T3CODE_CLERK_PUBLISHABLE_KEY=pk_test_...
+# T3CODE_CLERK_JWT_TEMPLATE=t3-relay
+# T3CODE_CLERK_CLI_OAUTH_CLIENT_ID=oauthapp_...
+
+# Get this from your relay deployment. `infra/relay` deploys update it automatically.
+# T3CODE_RELAY_URL=https://relay.example.com
+
+# Public, ingest-only mobile OpenTelemetry configuration.
+# T3CODE_MOBILE_OTLP_TRACES_URL=https://api.axiom.co/v1/traces
+# T3CODE_MOBILE_OTLP_TRACES_DATASET=t3-code-mobile-traces-dev
+# T3CODE_MOBILE_OTLP_TRACES_TOKEN=xaat-...
@@ -7,14 +7,10 @@ on:
       - main
 
 jobs:
-  quality:
-    name: Format, Lint, Typecheck, Test, Browser Test, Build
+  check:
+    name: Check
     runs-on: ubuntu-24.04
-    # 45 (was 30): the Playwright browser cache starts cold, so the first
-    # successful run must do a full ~20m chromium install (apt deps + 167MB
-    # download) before it can populate the cache. Subsequent runs hit the cache
-    # and finish well under 30m.
-    timeout-minutes: 45
+    timeout-minutes: 30
     env:
       # The default Electron binary source (GitHub releases) was returning a
       # partial/empty archive on the runner, leaving node_modules/electron
@@ -25,108 +21,158 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version-file: package.json
-
-      - name: Setup Node
-        uses: actions/setup-node@v6
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
         with:
           node-version-file: package.json
+          cache: true
+          run-install: true
 
-      - name: Cache Bun and Turbo
+      - name: Cache Electron binary
         uses: actions/cache@v5
         with:
-          path: |
-            ~/.bun/install/cache
-            .turbo
-          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-${{ hashFiles('turbo.json') }}
+          path: ~/.cache/electron
+          key: ${{ runner.os }}-electron-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
-            ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-
+            ${{ runner.os }}-electron-
 
-      - name: Cache Playwright browsers
-        uses: actions/cache@v5
+      # Best-effort: the Electron archive intermittently extracts incompletely
+      # on GitHub-hosted runners; the desktop build below only needs the JS
+      # pipeline, not the binary.
+      - name: Ensure Electron runtime is installed
+        continue-on-error: true
+        run: vp run --filter @t3tools/desktop ensure:electron
+
+      - name: Check
+        run: vp check
+
+      - name: Typecheck
+        run: vpr typecheck
+
+      - name: Build desktop pipeline
+        run: vp run build:desktop
+
+      - name: Verify preload bundle output
+        run: |
+          test -f apps/desktop/dist-electron/preload.cjs
+          grep -nE "desktopBridge|getLocalEnvironmentBootstrap|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.cjs
+
+  test:
+    name: Test
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      ELECTRON_MIRROR: https://npmmirror.com/mirrors/electron/
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
         with:
-          path: ~/.cache/ms-playwright
-          key: ${{ runner.os }}-playwright-${{ hashFiles('bun.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-playwright-
+          node-version-file: package.json
+          cache: true
+          run-install: true
 
       - name: Cache Electron binary
         uses: actions/cache@v5
         with:
           path: ~/.cache/electron
-          key: ${{ runner.os }}-electron-${{ hashFiles('bun.lock') }}
+          key: ${{ runner.os }}-electron-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
             ${{ runner.os }}-electron-
 
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
-
-      # apps/desktop tests need Electron's prebuilt binary. On this runner the
-      # downloaded archive extracts incompletely (a partial dist/ with no
-      # executable), regardless of download source, so the binary install is
-      # best-effort here and the desktop test step below is non-blocking. Give
-      # the install a couple of tries (helps when the cache above is warm) but
-      # never fail the job on it.
-      - name: Install Electron binary (best-effort)
+      - name: Ensure Electron runtime is installed
         continue-on-error: true
-        working-directory: apps/desktop
-        run: |
-          for attempt in 1 2 3; do
-            if node -e "require('electron')" >/dev/null 2>&1; then
-              echo "Electron binary present."
-              break
-            fi
-            echo "Electron binary missing (attempt $attempt/3); reinstalling…"
-            node node_modules/electron/install.js || true
-          done
-
-      - name: Format
-        run: bun run fmt:check
-
-      - name: Lint
-        run: bun run lint
-
-      - name: Typecheck
-        run: bun run typecheck
+        run: vp run --filter @t3tools/desktop ensure:electron
 
       - name: Test
-        run: bunx turbo run test --filter='!@t3tools/desktop'
+        run: vp run -r --filter '!@t3tools/desktop' test
 
-      # Non-blocking: Electron's binary cannot currently be installed on the
-      # runner (see the best-effort step above), so these would always fail for
-      # environmental reasons. They still run and report; re-make this blocking
-      # once Electron installs cleanly in CI.
+      # Non-blocking: Electron's binary cannot currently be installed reliably
+      # on GitHub-hosted runners (see the best-effort step above), so these
+      # would fail for environmental reasons. They still run and report;
+      # re-make this blocking once Electron installs cleanly in CI.
       - name: Desktop tests (non-blocking — Electron unavailable on CI)
         continue-on-error: true
-        run: bunx turbo run test --filter='@t3tools/desktop'
-
-      # The Playwright browser download intermittently stalls on the runner
-      # (the chromium archive finishes, then a follow-up fetch hangs for the
-      # whole job). Cap the step so a stall can't hang the job, and keep it (and
-      # the browser test) non-blocking so a flaky download doesn't fail CI. They
-      # still run and report when the network cooperates; the browser cache
-      # above keeps successful runs fast.
+        run: vp run --filter @t3tools/desktop test
+
+  test_browser:
+    name: Test Browser
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/ms-playwright
+          key: ${{ runner.os }}-playwright-${{ hashFiles('pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-playwright-
+
+      # The Playwright browser download intermittently stalls on GitHub-hosted
+      # runners. Cap the step so a stall can't hang the job, and keep it (and
+      # the browser tests) non-blocking so a flaky download doesn't fail CI.
+      # They still run and report when the network cooperates; the browser
+      # cache above keeps successful runs fast.
       - name: Install browser test runtime
         continue-on-error: true
         timeout-minutes: 12
-        run: |
-          cd apps/web
-          bunx playwright install --with-deps chromium
+        run: vp run --filter @t3tools/web test:browser:install
 
-      - name: Browser test
+      - name: Browser test / Chat view
         continue-on-error: true
-        run: bun run --cwd apps/web test:browser
+        working-directory: apps/web
+        run: vp test run --mode browser --browser=chromium src/components/ChatView.browser.tsx
 
-      - name: Build desktop pipeline
-        run: bun run build:desktop
+      - name: Browser test / Chat markdown
+        continue-on-error: true
+        working-directory: apps/web
+        run: vp test run --mode browser --browser=chromium src/components/ChatMarkdown.browser.tsx
 
-      - name: Verify preload bundle output
+      - name: Browser test / Components
+        continue-on-error: true
+        working-directory: apps/web
         run: |
-          test -f apps/desktop/dist-electron/preload.cjs
-          grep -nE "desktopBridge|getLocalEnvironmentBootstrap|PICK_FOLDER_CHANNEL|wsUrl" apps/desktop/dist-electron/preload.cjs
+          vp test run --mode browser --browser=chromium \
+            src/components/GitActionsControl.browser.tsx \
+            src/components/KeybindingsToast.browser.tsx \
+            src/components/ThreadTerminalDrawer.browser.tsx \
+            src/components/chat/MessagesTimeline.browser.tsx \
+            src/components/chat/ProviderModelPicker.browser.tsx \
+            src/components/chat/CompactComposerControlsMenu.browser.tsx \
+            src/components/settings/SettingsPanels.browser.tsx
+
+  mobile_native_static_analysis:
+    name: Mobile Native Static Analysis
+    runs-on: macos-26
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Install mobile native static analysis tools
+        run: brew bundle install --file apps/mobile/Brewfile
+
+      - name: Lint mobile native sources
+        run: vp run lint:mobile
 
   release_smoke:
     name: Release Smoke
@@ -136,28 +182,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Setup Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version-file: package.json
-
-      - name: Setup Node
-        uses: actions/setup-node@v6
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
         with:
           node-version-file: package.json
-
-      - name: Cache Bun and Turbo
-        uses: actions/cache@v5
-        with:
-          path: |
-            ~/.bun/install/cache
-            .turbo
-          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-${{ hashFiles('turbo.json') }}
-          restore-keys: |
-            ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}-
-
-      - name: Install dependencies
-        run: bun install --frozen-lockfile
+          cache: true
+          run-install: true
 
       - name: Exercise release-only workflow steps
-        run: bun run scripts/release-smoke.ts
+        run: node scripts/release-smoke.ts
@@ -0,0 +1,80 @@
+name: Deploy T3 Connect relay
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  id-token: none
+  statuses: write
+
+concurrency:
+  group: relay-production
+  cancel-in-progress: false
+
+jobs:
+  deploy_relay:
+    name: Deploy production relay
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    timeout-minutes: 15
+    environment:
+      name: production
+    env:
+      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      PLANETSCALE_ORGANIZATION: ${{ vars.PLANETSCALE_ORGANIZATION }}
+      AXIOM_ORG_ID: ${{ vars.AXIOM_ORG_ID }}
+      RELAY_DOMAIN: ${{ vars.RELAY_DOMAIN }}
+      RELAY_API_ZONE_NAME: ${{ vars.RELAY_API_ZONE_NAME }}
+      RELAY_TUNNEL_ZONE_NAME: ${{ vars.RELAY_TUNNEL_ZONE_NAME }}
+      CLERK_PUBLISHABLE_KEY: ${{ vars.CLERK_PUBLISHABLE_KEY }}
+      CLERK_JWT_AUDIENCE: ${{ vars.CLERK_JWT_AUDIENCE }}
+      APNS_ENVIRONMENT: ${{ vars.APNS_ENVIRONMENT }}
+      APNS_TEAM_ID: ${{ vars.APNS_TEAM_ID }}
+      APNS_KEY_ID: ${{ vars.APNS_KEY_ID }}
+      APNS_BUNDLE_ID: ${{ vars.APNS_BUNDLE_ID }}
+      ALCHEMY_TELEMETRY_DISABLED: "1"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Vite+
+        uses: voidzero-dev/setup-vp@v1
+        with:
+          node-version-file: package.json
+          cache: true
+          run-install: true
+
+      - name: Deploy production relay stage
+        id: deploy
+        run: vp run --filter t3code-relay deploy --stage prod --yes --github-output
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          PLANETSCALE_API_TOKEN_ID: ${{ secrets.PLANETSCALE_API_TOKEN_ID }}
+          PLANETSCALE_API_TOKEN: ${{ secrets.PLANETSCALE_API_TOKEN }}
+          AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }}
+          CLERK_SECRET_KEY: ${{ secrets.CLERK_SECRET_KEY }}
+          APNS_PRIVATE_KEY: ${{ secrets.APNS_PRIVATE_KEY }}
+
+      - name: Publish relay deploy commit status
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const result = "${{ steps.deploy.outputs.result }}";
+            const changed = "${{ steps.deploy.outputs.changed }}" === "true";
+            const description = changed
+              ? "Relay production deploy applied infrastructure changes."
+              : result === "noop"
+                ? "Relay production deploy was a no-op."
+                : `Relay production deploy completed with result: ${result}.`;
+
+            await github.rest.repos.createCommitStatus({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              sha: context.sha,
+              state: "success",
+              context: "Relay deploy / production",
+              description,
+              target_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+            });