chore: merge upstream pingdotgg/t3code through 611132c171

[andrewcai8]

The daily upstream sync has failed since 2026-10-06 because git merge upstream/main hit 38 conflicts. This merges upstream 76d3c96fd..611132c171 (80 commits) by hand, as a real merge commit. The fork's cloud machines, Home port, worker forks and account rotation all stay. Upstream wins everywhere else.

Notable upstream changes

• Thread links and snooze state for agents (feat(server,web,mobile): agents see snooze state and link to threads pingdotgg/t3code#16782). Thread tools return a link to paste. Web, desktop and mobile open t3-thread:// links as the thread. Agents also see whether a thread is snoozed and until when. This is the thread-link part of Theo's Home PR feat(home): add Home, an agent that manages threads across your machines pingdotgg/t3code#15975, which the fork had ported. Upstream's version now wins, and the fork's Home code uses it.
• Every T3 MCP tool declares who may call it (feat(server): every T3 MCP tool declares who may call it pingdotgg/t3code#16335). Outside agents (Claude Code, Codex, ChatGPT) can sign in to the T3 MCP server with OAuth (feat(server): outside agents sign in to the T3 MCP server with OAuth pingdotgg/t3code#16336, feat(server): hosted agents like ChatGPT can sign in to the T3 MCP server pingdotgg/t3code#16718), and you can copy an environment's MCP URL (feat(web): copy an environment's MCP URL for outside agents pingdotgg/t3code#16337).
• The browser preview runs on the environment server (feat(preview): run the browser on the environment server pingdotgg/t3code#15328). The desktop-only Playwright automation host is gone.
• Finer permissions (fix(auth): preserve explicitly granted pairing scopes pingdotgg/t3code#9785-feat(auth): allow passive terminal observation pingdotgg/t3code#9791, fix(auth): keep old clients connected across scope changes pingdotgg/t3code#10298). Separate grants for environment administration, source control writes, filesystem read/write, browser control, diagnostics and usage, and passive terminal viewing.
• GitHub talks to the API instead of gh (feat(server): GitHub API transport that uses gh only for the token pingdotgg/t3code#16319-feat: choose the GitHub account per host, save a GitHub token, and fewer reads per PR action pingdotgg/t3code#16322). You can pick the GitHub account per host and save a token.
• Other changes:
  • Reopen closed tabs (feat(web): reopen closed tabs across the app pingdotgg/t3code#15207).
  • Fast actions on linked PRs (feat(web): add fast actions to linked pull requests pingdotgg/t3code#16627).
  • Mod+T opens the right panel's tab menu (feat(web): open right panel tab menu with Mod+T pingdotgg/t3code#15686).
  • Old Claude threads compact on send (feat(web): old Claude threads compact on send instead of stacking notices pingdotgg/t3code#16631).
  • A project action can run when a worktree thread settles (feat(server): run a project action when a worktree thread settles pingdotgg/t3code#16290).
  • A thread settles as soon as a client sees its PR merge (fix(server): threads settle as soon as a client sees their PR merge pingdotgg/t3code#16761).
  • Several CPU and polling fixes (fix(server): status refresh no longer pegs CPU in repos with thousands of untracked files pingdotgg/t3code#16771, fix(server): settled threads stop polling their pull requests pingdotgg/t3code#16762, perf(server): background branch lookups share one GitHub query per sweep pingdotgg/t3code#16760, fix(server): stop storing tool image bytes no client reads pingdotgg/t3code#16652).

There is no new visualization feature in this range. Inline HTML pages for agents landed in the previous sync (#172), and pingdotgg#16752 only stops them painting slab backgrounds.

Cross-environment series and Home

• Julius's cross-environment series (feat(server): /mcp narrows a client's modes from T3-Mode-Limit pingdotgg/t3code#16653, feat(server): t3_thread_launch takes clientRequestId pingdotgg/t3code#16654, feat(server): link to another environment pingdotgg/t3code#16655, feat(server): agents use linked environments pingdotgg/t3code#16684) has not landed on upstream main.
• Theo's Home PR feat(home): add Home, an agent that manages threads across your machines pingdotgg/t3code#15975 is still open upstream.
• The overlap that did land is feat(server,web,mobile): agents see snooze state and link to threads pingdotgg/t3code#16782:
  • packages/shared/src/threadLinks.ts and its test, MarkdownThreadLink.tsx and the mobile link handling.
  • Snooze in ThreadSettlementService and the MCP list and read results.
  • Each side added these files on its own (add/add conflicts). Upstream's copy was kept, and the fork's duplicate import in ThreadFeed.tsx was dropped.
• The fork's Home-only code is not in upstream:
  • Fleet relay, t3_environment_list, t3_thread_watch and the Home settings page.
  • Routing every MCP tool by environmentId.
  • Cloud-chat reach and fork batches.
• When feat(home): add Home, an agent that manages threads across your machines pingdotgg/t3code#15975 or the cross-environment series lands, expect overlap in:
  • homeRouting.ts.
  • The environmentId parameters in packages/contracts/src/orchestratorMcp.ts.
  • rpc.ts (home.* and fleet.*).
  • RpcAuthorization.ts.
  • The apps/server/src/home/ services.

Conflicted files and how each was resolved

Upstream only:

• packages/shared/src/threadLinks.ts and threadLinks.test.ts (add/add). Upstream also escapes parentheses.
• apps/server/src/orchestration-v2/ThreadSettlementService.ts
• apps/web/src/components/ChatMarkdown.tsx

Contracts and client runtime:

• packages/contracts/src/rpc.ts: kept the Home and fleet RPCs. Dropped the preview-automation RPCs, as upstream did.
• packages/client-runtime/src/rpc/client.ts: same, so fleetConnect stays a stream method.
• packages/contracts/src/orchestratorMcp.ts: kept the fork's projectId on thread list items.
• packages/client-runtime/src/providerSkills.ts: both sides. Upstream's hasCurrentProviderWorkspaceSnapshot sits next to the fork's provisioned skills.

Server MCP:

• apps/server/src/mcp/OrchestratorMcpService.ts: upstream's shell-based snooze. Kept the fork's exported readThreadPage and list helpers. readThreadPage now takes the shell, and Home's threads.read loads it.
• apps/server/src/mcp/McpHttpServer.ts and the orchestrator, project and thread toolkits: upstream's McpToolAccess declarations with the fork's Home routing inside them.
  • t3_thread_launch uses upstream's startsThreads. Home and remote launches still go through runAsHome, which needs a live full-access caller.
  • The Home toolkit is now declared too: reads for list, writes for watch, actsAsCaller for fork runs, readsAsCaller for fork status.
• toolkits/core.test.ts and toolkits/project/handlers.test.ts: upstream's test layers plus notHomeLayer.

Server, other:

• apps/server/src/auth/RpcAuthorization.ts: upstream's split scopes. Kept the fork's environment-control, Home and fleet scopes.
• apps/server/src/ws.ts: upstream's handlers without observeRpcEffect (refactor(server): instrument WS RPCs in group middleware pingdotgg/t3code#15548 moved it into middleware). The fork's environment-control, Home and fleet handlers are converted the same way.
• apps/server/src/server.ts: both routes.
• orchestration-v2/testkit/ProviderReplayHarness.ts: kept the fork's extra ThreadManagementService output.

Web:

• AppRoot.tsx: kept ProvisionCancellations, CloudBoxes and HomeFleetHost. Dropped PreviewAutomationHosts, which upstream deleted.
• routes/__root.tsx: both.
• ChatView.tsx: held cloud sends keep their message id. Upstream's compact-before-send runs alongside.
• CommandPalette.tsx: upstream's new "No project" ordering, still hiding the Home project.
• Sidebar.tsx, LegacySidebar.tsx, ChatHeader.tsx, useThreadActionMenu.ts: the fork's cloud-machine menu items and Home imports next to upstream's permission gates and useOrchestrationCommand.
• useThreadActions.ts: upstream's permission checks and delete flow, gated by the fork's offline-delete handling. Upstream dropped the terminal close.
• chat/MessagesTimeline.tsx: the fork's footerCard, then upstream's footer inside TimelineListFooter.

Mobile:

• App.tsx, useThreadListActions.ts, SettingsScheduledTasksRouteScreen.tsx, SettingsThreadsRouteScreen.tsx, thread-list-v2-items.tsx, use-thread-outbox-drain.ts: both sides.

Scripts:

• scripts/lib/cli-external-packages.test.ts: the fork's externals plus upstream's playwright-core.

What the fork had to adapt beyond the conflicts

• environmentControl/wsHandlers.ts loses its observeRpcEffect parameter, since upstream removed the helper.
• homeRouting.readHomeChangeCaller used readFullAccessCaller, which upstream removed. It now uses readCaller + assertLiveCaller + assertFullAccess, with the same rule as before.
• ProviderAccountSwitch.test.ts hung for 120s on every case. Upstream's makeClaudeAdapterV2 now requires a crypto service, and the test's fake driver did not pass one. It now does.
• ServerUpdateAction: upstream gates server updates on environment:maintain for that environment. A cloud guest upgraded through its manager is authorized by the manager, so that path skips the guest's own grant. Otherwise "Update via manager" would be disabled.
• useThreadActions.unsettleThread checks the operate grant before it wakes a cloud machine.
• Upstream's new useThreadActions.permissions.test.ts and useThreadActionMenu.test.ts mock every module the hooks import. They now also stub the fork's cloud hooks.
• CI keeps the fork's runner choices. The merge only brought upstream's new Chromium install step.

Submodule warning in the sync workflow

fatal: No url found for submodule path '.repos/alchemy-effect/submodules/distilled' comes from the gitlinks .repos/alchemy-effect/submodules/{distilled,floci}, which have no .gitmodules. Upstream main has the same gitlinks. The message prints in actions/checkout's post-job cleanup as a warning, after the merge step had already failed on conflicts. It does not fail the job, and fork CI checks out fine. Deleting the gitlinks would only open a new difference from upstream, so this PR leaves them.

Cloud chats re-pair after the scope change

Servers never widen a stored grant (pingdotgg#10298). Before this merge the fork's standard client grant was only orchestration:read/operate, terminal:operate, review:write and relay:read. Every device already paired with a cloud box would keep that grant after the box upgrades and lose file search and the explorer, commit/push/PR, preview control and settings on every existing cloud chat. The permission-update notice would then ask the user to pair again with a new link, which a cloud chat cannot do.

Fix (fix(client): cloud chats re-pair themselves when a box upgrade narrows their permissions):

• registryBoxes.ts. A paired box's first dial in a launch reads its grant over the new connection. If it is the legacy grant, the box pairs once more through its host, the legacy session closes, and the dial continues with the standard grant. The check is recorded before the re-pair, so a host that still mints the legacy grant is asked once per box per launch, never in a loop. A failed re-pair keeps the working legacy connection. An old box server reports no permissions, so it is never treated as legacy.
• boxPairing.ts / boxPairingLayer.ts. PairingRedemption gains sessionGrant, which reads /api/auth/session with the box's bearer pairing.
• Web and mobile PermissionUpdateNotice skip box environments, since they repair themselves.
• Tests in registry.cloud.test.ts: a legacy box re-pairs once, closes the legacy session, and ends on a fresh credential; a host that keeps minting the legacy grant is asked once across three opens; a box on the standard grant is not re-paired. The web notice test covers a box environment, and the existing cases still cover a normal paired one. The two re-pair tests and the box notice test failed before the fix.

This push also merges current main (#196, #197) so the release carries them.

Out of scope here. Review finding 2 (fork environmentControl RPCs gated on orchestration:operate rather than providers:manage / environment:maintain) follows after this lands. Finding 3 (t3_fork_cancel uses actsAsCaller) is accepted as is.

Verification

• vp i passes and leaves pnpm-lock.yaml unchanged.
• Server. 34 files under src/mcp (including cloudReach, homeRouting and the MCP toolkit integration), src/home, auth/RpcAuthorization and ThreadSettlementService: 351 tests pass. src/environmentControl, runtimeLayer, ManagedProjectFolders and server.test: 54 files, 886 tests pass. ProviderAccountSwitch.test.ts: 6 tests pass.
• Web. The hand-resolved files plus src/cloud, src/components/home, src/hooks and src/components/settings: all pass.
• Mobile. Thread, settings, home and outbox tests: 53 files, 566 tests pass.
• Packages and scripts. shared threadLinks, client-runtime providerSkills and rpc, contracts rpc, scripts/lib/cli-external-packages: all pass.
• vp lint on the changed areas: no errors.
• Typecheck is not run locally, so CI's Typecheck is the first full compile of the merged fork code.

Risks

• Upstream changed many service signatures, and the fork's auto-merged code is only proven by the tests above. The adapter crypto option was one such break. CI Typecheck may find more.
• Clients and servers from before and after this merge disagree on scopes. Upstream's fix(auth): keep old clients connected across scope changes pingdotgg/t3code#10298 is meant to keep old clients connected. Cloud chats now re-pair themselves (above). Unverified guess: a manually paired phone or browser may still lose access it had, such as the diagnostics grant the Usage page now needs, until it pairs again.
• Home and remote launches go through FleetService, which does not apply upstream's new existing-worktree check (feat(server): every T3 MCP tool declares who may call it pingdotgg/t3code#16335 assertProjectWorktree). This was already the case before the merge. Home is full-access only.

Claude Opus 5.5 (1M context), Claude Code

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	4.9 KiB	−23 B (−0.5%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−23 B (−1.9%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.8 KiB	−41 B (−0.2%)	29.3 KiB	✅
Codex	Live turn messages	2	1	−1 (−50.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 9e2a007 · PR result: 3bee0f3 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.