[pull] main from pingdotgg:main

apps/mobile/src/components/AppSymbol.ios.tsx

@@ -1,3 +1,4 @@
+import IconGitPullRequest from "@tabler/icons-react-native/IconGitPullRequest";
 import { SymbolView as ExpoSymbolView } from "expo-symbols";
 import { withUniwind } from "uniwind";
 import type { AppSymbolViewProps } from "./AppSymbol";
@@ -6,10 +7,24 @@ export type { SFSymbol } from "expo-symbols";
 export type { AppSymbolName } from "./AppSymbol";
 
 /**
- * Keep the iOS implementation isolated from the Android Tabler fallback so
- * Metro does not initialize the icon package when iOS renders SF Symbols.
+ * Use SF Symbols on iOS except for pull requests, which have no matching
+ * native glyph. Import only that Tabler icon to keep the bundle small.
  */
 function AppSymbolView(props: AppSymbolViewProps) {
+  const name = typeof props.name === "string" ? props.name : props.name.ios;
+  if (name === "arrow.triangle.pull") {
+    return (
+      <IconGitPullRequest
+        accessibilityLabel={props.accessibilityLabel}
+        color={props.tintColor}
+        size={props.size}
+        strokeWidth={2}
+        style={props.style}
+        testID={props.testID}
+      />
+    );
+  }
+
   return <ExpoSymbolView {...props} />;
 }
 

apps/mobile/src/features/devices/DevicePreviewRouteScreen.tsx

@@ -1,3 +1,8 @@
+import {
+  deviceToolVersionLabels,
+  deviceToolUpdateOwnership,
+  deviceToolUpdatePolicy,
+} from "@t3tools/client-runtime/state/device";
 import { useIsFocused, useNavigation, type StaticScreenProps } from "@react-navigation/native";
 import { createNativeStackNavigator } from "@react-navigation/native-stack";
 import { EnvironmentId, ThreadId } from "@t3tools/contracts";
@@ -73,6 +78,7 @@ function DevicePreviewScreen({
   const [inputConnected, setInputConnected] = useState(false);
   const [streamAttempt, setStreamAttempt] = useState(0);
   const [shuttingDown, setShuttingDown] = useState(false);
+  const retryHost = useAtomCommand(deviceEnvironment.list);
   const shutdown = useAtomCommand(deviceEnvironment.shutdown, { reportFailure: false });
   const streamRef = useRef<DeviceStreamRef>(null);
   const state = useEnvironmentQuery(deviceEnvironment.state({ environmentId, input: {} }));
@@ -116,10 +122,58 @@ function DevicePreviewScreen({
   };
 
   const controls: ScreenHeaderMenuItem[] = [
+    ...(state.data?.hosts
+      .filter(
+        (host) =>
+          state.data?.supportsHostRetry && state.data.hostStatuses[host.id]?.status === "failed",
+      )
+      .map((host) => ({
+        id: `retry-${host.id}`,
+        title: `Retry ${host.label}`,
+        icon: "arrow.clockwise" as const,
+        onPress: () => {
+          void retryHost({ environmentId, input: { retryHostId: host.id } });
+        },
+      })) ?? []),
+    ...(state.data?.supportsToolInspection
+      ? [
+          {
+            id: "check-device-tools",
+            title: "Check device tool versions",
+            icon: "arrow.clockwise" as const,
+            onPress: () => {
+              void retryHost({ environmentId, input: { inspectOnly: true } });
+            },
+          },
+        ]
+      : []),
+    {
+      id: "device-tools",
+      title: "Device tool versions",
+      icon: "info.circle",
+      onPress: () =>
+        Alert.alert(
+          "Device tool versions",
+          deviceToolUpdateOwnership +
+            "\n\n" +
+            deviceToolUpdatePolicy(
+              state.data?.hosts.find((host) => host.id === preview?.session.hostId)?.tools,
+            ) +
+            "\n\n" +
+            deviceToolVersionLabels(
+              state.data?.hosts.find((host) => host.id === preview?.session.hostId)?.tools,
+            ).join("\n") +
+            "\n" +
+            (state.data?.hosts.find((host) => host.id === preview?.session.hostId)
+              ?.toolInspectionError ??
+              state.data?.hostStatuses[preview?.session.hostId ?? ""]?.detail ??
+              ""),
+        ),
+    },
     {
       id: "reload",
       title: "Reload stream",
-      icon: "arrow.clockwise",
+      icon: "arrow.clockwise" as const,
       disabled: !preview || shuttingDown,
       onPress: () => {
         setInputConnected(false);
@@ -149,7 +203,7 @@ function DevicePreviewScreen({
           {
             id: "rotate",
             title: "Rotate device",
-            icon: "arrow.clockwise",
+            icon: "arrow.clockwise" as const,
             disabled: !inputConnected,
             onPress: () => streamRef.current?.rotate(),
           },

apps/mobile/src/features/threads/new-task-flow-provider.tsx

@@ -873,12 +873,20 @@ export function NewTaskFlowProvider(props: React.PropsWithChildren) {
 
   useEffect(() => {
     if (
+      !selectedProjectDraftKey ||
       !defaultWorkspaceModeSettled ||
       workspaceMode !== "worktree" ||
       selectedBranchName !== null
     ) {
       return;
     }
+    // The draft screen writes a thread's branch and worktree into the draft in
+    // the same commit this effect runs, so the rendered selection above can be
+    // stale. Re-read the draft before replacing it.
+    const live = getComposerDraftSnapshot(selectedProjectDraftKey).workspaceSelection;
+    if (live && (live.mode !== "worktree" || live.branch !== null)) {
+      return;
+    }
     // The default may only exist as origin/<default> (isRemote), which
     // availableBranches filters out — search the unfiltered refs for it.
     const preferredBranch =
@@ -894,6 +902,7 @@ export function NewTaskFlowProvider(props: React.PropsWithChildren) {
     defaultWorkspaceModeSettled,
     selectBranch,
     selectedBranchName,
+    selectedProjectDraftKey,
     workspaceMode,
   ]);
 

apps/server/src/auth/RpcAuthorization.test.ts

@@ -8,7 +8,11 @@ import {
 } from "@t3tools/contracts";
 import { describe, expect, it } from "@effect/vitest";
 
-import { RPC_REQUIRED_SCOPES, requiredScopeForRpcMethod } from "./RpcAuthorization.ts";
+import {
+  RPC_REQUIRED_SCOPES,
+  requiredScopeForRpcMethod,
+  requiredScopeForDeviceList,
+} from "./RpcAuthorization.ts";
 
 describe("RPC authorization scopes", () => {
   it("declares exactly one scope for every RPC in the server group", () => {
@@ -71,3 +75,17 @@ describe("RPC authorization scopes", () => {
     }
   });
 });
+
+it("requires operate permission for host retry while preserving read-only listing", () => {
+  expect(requiredScopeForDeviceList({})).toBe(AuthOrchestrationReadScope);
+  expect(requiredScopeForDeviceList({ retryHostId: "remote-host" })).toBe(
+    AuthOrchestrationOperateScope,
+  );
+});
+
+it("requires operate permission for tool updates even alongside a read-only check", () => {
+  expect(requiredScopeForDeviceList({ updateTool: "agent", inspectOnly: true })).toBe(
+    AuthOrchestrationOperateScope,
+  );
+  expect(requiredScopeForDeviceList({ updateTool: "hub" })).toBe(AuthOrchestrationOperateScope);
+});

apps/server/src/auth/RpcAuthorization.ts

@@ -1,4 +1,5 @@
 import {
+  type DeviceListInput,
   AuthAccessReadScope,
   AuthOrchestrationOperateScope,
   AuthOrchestrationReadScope,
@@ -180,3 +181,9 @@ export function requiredScopeForRpcMethod(method: string): AuthEnvironmentScope
   }
   return requiredScope;
 }
+
+/** Retrying can install or restart tools even though ordinary listing is readable. */
+export const requiredScopeForDeviceList = (input: DeviceListInput): AuthEnvironmentScope =>
+  input.retryHostId || input.updateTool
+    ? AuthOrchestrationOperateScope
+    : AuthOrchestrationReadScope;

apps/server/src/device/DeviceHost.ts

@@ -80,6 +80,7 @@ export class DeviceHost extends Context.Service<
   {
     readonly id: DeviceHostId;
     readonly summary: Effect.Effect<DeviceHostSummary>;
+    readonly inspect?: Effect.Effect<DeviceHostSummary, DeviceHostError>;
     readonly platformAvailability: (
       platform: DevicePlatform,
     ) => Effect.Effect<DevicePlatformAvailability>;
@@ -88,11 +89,11 @@ export class DeviceHost extends Context.Service<
      * concurrent callers share one start, and a ready host returns immediately.
      */
     readonly ensureReady: (
-      onPhase: (phase: "installing" | "starting") => Effect.Effect<void>,
+      onPhase: (phase: "installing" | "starting", detail?: string) => Effect.Effect<void>,
     ) => Effect.Effect<DeviceHostReady, DeviceHostError | NodeRuntimeUnavailableError>;
     /** Installs and starts agent-device after the user grants agent access. */
     readonly ensureAgentReady: (
-      onPhase: (phase: "installing" | "starting") => Effect.Effect<void>,
+      onPhase: (phase: "installing" | "starting", detail?: string) => Effect.Effect<void>,
     ) => Effect.Effect<
       DeviceHostAgentReady,
       DeviceHostError | DeviceHostTimeoutError | NodeRuntimeUnavailableError