chore: merge upstream pingdotgg/t3code through 12069eefd7

[andrewcai8]

The daily upstream sync failed again because git merge upstream/main hit 18 conflicts. This merges upstream 611132c171..12069eefd7 (91 commits) by hand, as a real merge commit. The fork's cloud machines, Home port, worker forks, account rotation and background-shell fixes all stay. Upstream wins everywhere the fork had not deliberately changed something.

Notable upstream changes

• Muse Code is a native provider (feat(providers): run Muse Code as a native provider pingdotgg/t3code#17082). It adds the @muse-code/sdk dependency. Cloud provisioning has no case for it, so it is refused as "does not support cloud provisioning", like the other providers outside Codex, Claude and Cursor.
• MCP apps render and run inline in threads (feat: MCP apps render and run inline in threads pingdotgg/t3code#16236).
• Find in the current thread (feat(web): find messages and plans in the current thread pingdotgg/t3code#10439) and in diffs with Cmd+F (feat(web): find in diffs with Cmd+F pingdotgg/t3code#14623).
• The composer handles block-level Markdown (feat(web): block-level Markdown in the rich text composer pingdotgg/t3code#14677). Compact-before-send is a chip that shows the token count (feat(web): compact-before-send is a chip that shows the token count pingdotgg/t3code#17127).
• Thread links name only the thread id (fix(server,web,mobile): thread links reference the thread id, not a baked title pingdotgg/t3code#17017). [title](t3-thread://v1/<threadId>) opens the thread in the environment of the message that holds the link, and clients show the thread's current title. Tools no longer return a ready link.
• Usage. The page answers in under a second and dims only what is still loading (perf(usage): the Usage page shows numbers in under a second and dims only what is still loading pingdotgg/t3code#17147). You can filter it to some providers (feat(web): filter the Usage page to just the providers you want pingdotgg/t3code#16970). Cursor account history loads about 4x faster and is cached on disk (fix(usage): Cursor account history loads about 4x faster pingdotgg/t3code#17140). Repeat scans skip unchanged Antigravity databases (fix(usage): repeat usage scans no longer decode unchanged Antigravity databases pingdotgg/t3code#17139).
• Threads settle sooner. An agent can settle its own thread when its turn ends (fix(server): an agent can settle its own thread when its turn ends pingdotgg/t3code#17145). A thread settles as soon as branch status sees its PR merge (fix(server): threads settle as soon as branch status sees their PR merge pingdotgg/t3code#17148).
• Claude. Haiku 5.5 is added, and Sonnet 5 and Opus 5 move to legacy (feat(models): add Claude Haiku 5.5 and retire Sonnet 5 and Opus 5 to legacy pingdotgg/t3code#16903). 5-series models always run 1M context (fix(server): Claude 5-series models always run 1M context pingdotgg/t3code#16908). A refused turn keeps its session (fix(server): a refused Claude turn no longer throws away its session pingdotgg/t3code#16287). A background subagent's work shows while its parent is idle (fix(server): a background Claude subagent's work shows while its parent is idle pingdotgg/t3code#16486).
• Server stability. Replaying a command (fix(server): replaying a command no longer freezes the server pingdotgg/t3code#17041) and opening a long thread (fix(server): opening a long thread no longer blocks the server for a second pingdotgg/t3code#17029) no longer freeze the server. Shell snapshots no longer block other database reads (fix(server): shell snapshots no longer block other database reads while decoding pingdotgg/t3code#17141). Idle Codex threads unload from the shared app-server (fix(server): unload Codex threads left idle on the shared app-server pingdotgg/t3code#16917). Worktree cleanup fixes (fix(server): merged-worktree cleanup removes worktrees after squash merges pingdotgg/t3code#14847, fix(server): Windows worktrees with long paths no longer fail or strand pingdotgg/t3code#14917, fix(server): free worktrees for terminal thread statuses pingdotgg/t3code#15150, fix(server): worktree cleanup no longer deletes files hidden by showUntrackedFiles=no pingdotgg/t3code#15834).
• Desktop. You can install the t3 command from Settings (feat(desktop): install the t3 command from Settings pingdotgg/t3code#16683). Sign-in and captchas work in desktop browser tabs (fix(desktop): sign-in and captchas work again in desktop browser tabs pingdotgg/t3code#16939).
• Mobile. v5 navigation with native iPad columns (feat(mobile): adopt v5 navigation and native iPad columns pingdotgg/t3code#16733), a redesigned Add environment sheet (feat(mobile): redesign the Add environment sheet pingdotgg/t3code#17092), and many list and Git-status performance fixes.

Cross-environment series and Home

• Julius's cross-environment series (feat(server): /mcp narrows a client's modes from T3-Mode-Limit pingdotgg/t3code#16653, feat(server): t3_thread_launch takes clientRequestId pingdotgg/t3code#16654, feat(server): link to another environment pingdotgg/t3code#16655, feat(server): agents use linked environments pingdotgg/t3code#16684) has not landed. All four are still open, along with feat(server): work a linked environment starts stays within its link pingdotgg/t3code#16695, feat(web,mobile): linked environments in Connections pingdotgg/t3code#16698 and feat(server): delegate_task to a linked environment pingdotgg/t3code#16719.
• Theo's Home PR feat(home): add Home, an agent that manages threads across your machines pingdotgg/t3code#15975 is still open.
• fix(server,web,mobile): thread links reference the thread id, not a baked title pingdotgg/t3code#17017 overlaps with the fork's Home port. Home's whole job is threads in other environments, and a link can no longer say which environment it means. The adaptation is in the next section. Upstream's open fix(composer): don't send attached threads to a machine that can't read them pingdotgg/t3code#16940 ("keep thread references on their machine") looks like the planned fix. When it lands, Home should go back to linking every thread.

Conflicted files and how each was resolved

Server MCP and contracts:

• packages/contracts/src/orchestratorMcp.ts: kept the fork's projectId on thread list items and dropped link, as upstream did.
• apps/server/src/mcp/OrchestratorMcpService.ts: upstream's nowMs-only list item and detail. Kept the fork's exported listItemFromShell and readThreadPage. readThreadPage no longer takes an environment id.
• toolkits/orchestrator/tools.ts, toolkits/project/tools.ts: upstream's descriptions, including how to write a thread link, with the fork's Home sentence appended. t3_thread_launch keeps the fork's FleetThreadLaunchResult.
• toolkits/thread/tools.ts: upstream's description and its new settlesWhenTurnEnds result, with the fork's FleetThreadOrganizeInput parameters and Home sentence.
• toolkits/thread/handlers.ts: the fork's Home routing first, then upstream's settleThread({ byOwnAgent }). Home's fleet path settles other threads directly, which is one member of the new result union.
• toolkits/project/handlers.ts: the fork's Home and remote launch block. The upstream-removed link stays removed.

Server, other:

• orchestration-v2/ProviderTurnStartService.ts: both. The fork's resume-fallback notice and upstream's refusedBeforePrompt check sit side by side.
• usage/UsageService.ts: upstream's parallel source scan and its cached Cursor reader. The fork's box usage reads, maxHourlyWindowMs and usageHostId stay. See below for extra Cursor logins.
• apps/server/package.json, pnpm-lock.yaml: both @namespacelabs/sdk (fork) and @muse-code/sdk (upstream).

Web:

• ChatView.tsx: a held cloud send claims its first turn, then upstream resets full history. timelineSkills passes the fork's provisioned skills.
• BranchToolbar.tsx: upstream's displayMode label with the fork's cloud "Run on" label first.
• BranchToolbarEnvironmentSelector.tsx: upstream dropped displayMode and the panel styling here. Only the fork's cloudRunOn prop remains.
• usage/UsagePage.tsx: upstream's shownWindow, keeping the fork's "to now" label and live reference time for the past-24-hours view (fork perf(client): reuse usage queries within the hour and ask only selected environments #36).

Client runtime and mobile:

• client-runtime/src/connection/presentation.ts: the fork's box exports and blocked-reason type plus upstream's route helpers.
• client-runtime/src/platform/persistence.ts: the fork's CatalogRegistration plus upstream's DeferredShellSnapshot.
• apps/mobile/src/Stack.tsx: both imports. CloudBoxesWorker still mounts in the new v5 layout.

What the fork had to adapt beyond the conflicts

• Home thread links (fix(server,web,mobile): thread links reference the thread id, not a baked title pingdotgg/t3code#17017). The fork's fleet launch result and the shared list item no longer carry link. FleetService and CloudFleetHost stop building it. Home's watch reports name a thread by its quoted title next to its environment and thread id. Home's AGENTS section now says to link threads in Home's own environment as [title](t3-thread://v1/<threadId>) and to name threads elsewhere by title and environment. Before this, a Home link opened a thread on any machine. Now only Home's own machine's threads are clickable until upstream lands cross-environment references.
• Extra Cursor logins (usage). Upstream now caches Cursor account history per credential, on disk, behind CursorAccountReader. The fork's cursorAccountHistory.ts did the same thing in memory, so it is deleted. cursorLogins.ts now only lists the other Cursor instances' logins. UsageService reads each one through upstream's cursorAccountSource and counts an account reached through several logins once. The existing two-login tests now pass awaitRefresh, since upstream answers a cold read with a refreshing source.
• Box reseed and deferred pull request links. Upstream's mobile shell cache now defers decoding thread PR links, and upstream refuses to save rows whose links are still pending. The fork's host-chat Reseed step loads the cached box shell and saves it back. It now fills the deferred links first (withPullRequestsLoaded), so a reseed cannot strip a box's PR links from the cache. New tests cover it.
• Fork migration ledger. The test of the fork's separate ledger now expects upstream's new migrations 59 and 60. Older fork-era rows at ids 59 and 60 still move to the fork ledger by name, and those tests pass.
• Test layers. The box-usage and Cursor-login suites provide upstream's CursorUsageReader.layer.

Verification

Run locally with the main checkout's installed node_modules linked in. No network installs.

• Server. src/environmentControl, ProviderAccountSwitch.test.ts and src/usage: 67 files, 1001 tests pass. src/mcp, src/home, src/project: 47 of 48 files, 509 of 510 tests pass. Orchestration around the merged areas (ProviderSessionManager, ProviderTurnStartService, RunExecutionService, ThreadManagementService, ThreadStop, ClaudeAdapterV2, ProviderSwitch and background-note integration): 12 files, 396 tests pass. src/persistence, server.test, RpcAuthorization, runtimeLayer: pass.
• Packages. contracts: 41 files, 655 tests pass. shared threadLinks and usageFormat: pass. client-runtime connection, platform, shell state, providerSkills, rpc: 28 files, 374 tests pass.
• Web. BranchToolbar logic and panel, ChatView.logic, components/usage, src/cloud, components/home: 30 files, 364 tests pass.
• Mobile. Home, threads, settings, connection, dependency graph, workspace stack projection, markdown module: 71 files, 574 tests pass.
• vp lint on every resolved and adapted file: no errors.

Failures I saw, none in files this merge touched:

• AgentSessionScanner "excludes sandboxes reached through a symlink" fails here. Guess: macOS /var is itself a symlink to /private/var. The file is unchanged by this merge.
• ProviderRegistry "re-probes when settings change the codex binaryPath" fails here because this Mac has Homebrew and the probe also spawns brew. Guess: CI's Linux runners have no brew.
• UsageService "upgrades a v4 cache" is flaky. It failed 1 of 4 runs on the merged file and 4 of 5 runs with upstream's own UsageService.ts swapped in, so it is upstream's flake.

Could not run:

• Muse Code suites. @muse-code/sdk is not installed in the main checkout, and network installs are off. Server suites ran against a local, uncommitted stub of the package, so the Muse adapter, SDK and text-generation tests were not run. CI installs the real package.
• Typecheck. It is blocked locally, so CI's Typecheck is the first full compile of the merged code.

Old cloud boxes and thread links

Cloud boxes upgrade only when idle, so a busy one keeps the pre-merge build for days. Those builds decode thread list, read and launch answers with a required link, which pingdotgg#17017 removed. Without it, an old box's t3_thread_launch into a new cloud chat provisioned a machine but read the answer as a failure, and a retry provisioned a second one. Listing a sleeping box, and calls the host passed through from an upgraded box, failed the same way.

CloudFleetHost now adds the old [title](t3-thread://v1/<environmentId>/<threadId>) link to each thread in those answers before it sends them to a box. It keeps a link the answer already has. New boxes drop the field. The code is marked for deletion once every cloud box runs this merge or later. A test decodes the host's list, read and launch answers with the pre-merge schemas. It fails with Missing key at ["threads"][0]["link"] without the change.

Risks

• Typecheck is unproven locally. Upstream changed readThread, settleThread, the shell cache types and the usage service requirements. The tests above cover the fork code that uses them, but CI may still find a type break in auto-merged code.
• Home links regress for threads on other machines (above) until upstream ships cross-environment references.
• A box host and its guests must upgrade together for threads.list. A new host reads an old guest's extra link field fine. An old host would reject a new guest's list, because the field it expects is gone. Guess: hosts and guests run the same release.

Claude Opus 5.5, Claude Code

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.9 KiB	20.9 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 57fde0d · PR result: a561679 · Source CI: failure

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.