feat: integrate upstream agent, settlement and model updates (Sep 30)

[nickrroberts]

Second upstream batch after #17, stacked on #55 (base sync/upstream-reliability-20260930; retarget to main once #55 merges). Cherry-picked with git cherry-pick -x, one commit per upstream PR, rebased on main at 66555de446.

Browser and MCP:

• 894d33419d (fix(preview): use the visible browser for new agent sessions pingdotgg/t3code#13064): new agent sessions prefer the host that owns the thread's visible browser tab. Clean apply. Our fix(browser): recover thread automation after host timeout #49 host-timeout reconnect (client-runtime rpc) and the Tell Project agents to use the built-in browser #42/Coordinator settle tool, agent turn rule, continuation result delivery #44 prompt text in assistantRuntime.ts are untouched.
• 4f27a84631 (fix(mcp): preview snapshots fit in the agent's tool output again pingdotgg/t3code#13558): preview snapshots bounded near 20 KB, and structuredContent carries the same bounded value. Clean apply; only the preview toolkit changes. cp_agent_* tools, the agents toolkit and multi-machine (feat: start agents on linked machines per server settings #43) code are untouched.

Settlement efficiency:

• 3b0a495b0e (perf(server): per-thread settlement and PR checks no longer rebuild the whole thread list pingdotgg/t3code#13691): per-thread settlement and PR checks read one thread instead of the whole list. Conflict in ThreadSettlementReactor.ts: kept our isAssistantSettlementExempt filter, so Project agents and coordinators stay exempt and settling stays coordinator-owned (fix(server): let coordinators settle agents after follow-ups #47). The per-thread read still loads the thread's project, so the exemption still sees it. Dropped one upstream test for listThreadsWithPullRequests, which comes from perf(server): pull request sync reads only threads with linked pull requests pingdotgg/t3code#13704 (not taken).
• 999161ef84 (perf(server): stop re-running git for every project each minute pingdotgg/t3code#13689): repository identity cache keeps hits for 15 minutes. Conflict in RepositoryIdentityResolver.ts: kept our refine handling, took the shared timeToLive.
• 1d6f23b519 (perf(server): background sweeps only read threads that can still settle pingdotgg/t3code#13765): background sweeps read only unsettled threads. Clean apply. The filter is opt-in (unsettledOnly), so client snapshots and our query additions are unchanged.

Models and Codex protocol:

• 72330e22c0 (Add Claude Sonnet 5.5 to the model manifest pingdotgg/t3code#14152): Claude Sonnet 5.5 in the bundled catalog and currentModels. Added only the Sonnet 5.5 entry: the fork's manifest has no compatibility block and no Opus 5.5 entry.
• 567783ecdc (fix(codex): the protocol generator runs again on Effect rc.115 pingdotgg/t3code#13480) and d5d48742c9 (feat(codex): require Codex 0.156 and regenerate its protocol pingdotgg/t3code#13481): prerequisites, not on the original list. feat(codex): regenerate protocol bindings for Codex 0.159 pingdotgg/t3code#14311 regenerates the bindings on top of feat(codex): require Codex 0.156 and regenerate its protocol pingdotgg/t3code#13481's Codex 0.156 refresh, which needs fix(codex): the protocol generator runs again on Effect rc.115 pingdotgg/t3code#13480's generator fix. effect-codex-app-server had no fork changes, so its generated files now match upstream at 422248515a exactly. feat(codex): require Codex 0.156 and regenerate its protocol pingdotgg/t3code#13481 also drops the legacy thread/rollback path (Codex 0.156 removed it). Its compatibility-range edits were dropped, since the fork has no such system.
• 451afcb22d (fix(codex): Pro Max accounts load, so Ultrafast shows up pingdotgg/t3code#14304): Pro Max (promax) accounts load and Ultrafast shows; PlanType decodes as a plain string.
• 422248515a (feat(codex): regenerate protocol bindings for Codex 0.159 pingdotgg/t3code#14311): Codex 0.159 protocol bindings. Local Codex is 0.159.2.

Instructions:

• 6391be2729 (fix(server): newer Codex models get T3 Code's instructions again pingdotgg/t3code#13547): newer Codex models get runtime info, PR linking and tool instructions again, via turn/start.additionalContext, re-injected after compaction. Branding kept (Control Plane, cplane MCP server), and the browser rules from Require agents to use only the built-in Control Plane browser #56/fix(server): allow explicitly requested desktop browser use #57 (built-in browser only, explicit-request exception) carry over into the tools entry; the tools entry stays under the 4,000-byte cap test. Fork adaptation: the Project coordinator/agent block stays in the collaboration-mode developer_instructions, as before. Codex truncates the middle of any additionalContext entry above about 1,000 tokens, and the block inlines MEMORY.md and role files (16 KB caps), so moving it would cut it. A test asserts the block stays out of additionalContext.
  • Pre-existing gap, not fixed here: gpt-6.x models (gpt-6.1-sol, gpt-6-astra) ship their own collaboration-mode text in the Codex catalog, and upstream says Codex then drops the client developer_instructions. So Codex agents on those models likely get no Project block, before and after this PR. Possible follow-up: send the block as thread-level developerInstructions on thread/start/thread/resume (sessions already restart when the role changes).

Not taken: pingdotgg#14290, pingdotgg#12006, pingdotgg#13302, pingdotgg#11846, pingdotgg#13501, pingdotgg#13704, pingdotgg#14198 (see #55).

Validation (local, no remote CI):

• server: full suite 52 failures in 11 files. 51 match main by name (37 ThreadSettlementReactor storage cleanup, CodexDriver/providerMaintenance npm, Cursor skills, UsageService, Antigravity, AgentSessionScanner, entrypoint, ProviderRegistry). The 52nd, AcpJsonRpcConnection session/load replay, is a timing flake: it failed 1 of 3 runs on main too (load average 50 to 100 from parallel agents), and no commit here touches ACP.
• PR B targeted set after the final rebase: assistantRuntime, agents toolkit, AgentCompletionReactor, ThreadSettlementReactor, RuntimeInstructions, CodexSessionRuntime, Codex collab/provider/adapter, McpHttpServer, PreviewAutomationBroker, ThreadPullRequestReactor, ProjectionSnapshotQuery, RepositoryIdentityResolver, ClaudeModelCatalog, ModelManifest: 407 passed, 37 failed (the same storage cleanup failures as main). Prompt text tests (Tell Project agents to use the built-in browser #42/Coordinator settle tool, agent turn rule, continuation result delivery #44/Require agents to use only the built-in Control Plane browser #56/fix(server): allow explicitly requested desktop browser use #57) pass.
• web: 9 failures (connectCliAuth, SnapShotCoordinator), same as main. client-runtime 1,690, contracts 479, effect-codex-app-server 36: all pass.
• Typecheck: server, web, client-runtime, effect-codex-app-server clean; contracts has the same 2 errors as main.
• Lint: 0 errors, warnings only, none new.

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for b862eda.

This comment will update automatically after the next completed run.