[danspark]

Problem

Advance T2 Code from nightly 3592 to published upstream nightly v0.1.4-nightly.20261027.3796, preserving the fork's privacy policy, identity and Linux x64/ARM64 releases.

Change

Pin commit b88da91397c247b98c892831d7e759f72ea4db43 and release ID 426111391. Review all 576 intervening upstream commits, including the 367 commits added since the earlier review in this PR. Preserve upstream features, dependency versions, lockfiles and patches.

Retain the accepted analytics, OTLP, ownership, updater and relay-client protections. Block new mobile crash delivery, native startup telemetry endpoints, source-map and dSYM uploads. User preferences and configured relay URLs cannot enable these exports. Local diagnostics, authenticated cache operations, provider traffic, guest sharing and remote connections remain available. Re-anchor seven existing targets after upstream refactors and preserve the security fixes already reviewed here.

Keep the new desktop recovery links pointed at the fork. Carry upstream's production web boot and packaged Linux launch checks into the hosted release controls, before publication. Linux x64 and ARM64 outputs and the repository's exact Node pin are preserved.

Planning can advance past already published fork releases whose historical upstream release records have been pruned. Proposed and unpublished pins still require full live release identity verification. Source proposals extend an existing PR's history and push normally, with no history rewrite.

Scope and approval

Authorized recurring nightly release maintenance in this T3 thread. The previous unmerged nightly's release record was deleted upstream, so this PR now follows the current published nightly under its own tag and identity. The PR and its reviewed history are retained.

Prepared with sync.mjs plan/propose and the agent-output schema. The proposed Git tree exactly matches the local validation snapshot. No trusted statuses were synthesized.

Verification

• vp run check:changed b88da91397c247b98c892831d7e759f72ea4db43 passed format, lint, both Knip passes, GraphQL generation, unused-patch validation, 36 affected package typechecks and 413 tests across 43 files.
• All 37 release-control tests passed, including historical release pruning and repeated proposals that preserve an open PR's head in history.
• New mobile privacy regressions failed before the guards and passed afterward. A runtime config check confirms that a configured relay still leaves the native startup endpoint at https://observe.invalid.
• Verified exact dependency fields in 41 manifests and exact upstream lockfiles and patches. Every overlay target applies exactly once.
• Hosted full release CI, package builds, production boot and launch checks, and all 10 published-asset verifications remain mandatory.

Model: GPT-6.1. Harness: Codex in T3 Code.

[danspark]

CodeQL audit on 6267f6927a64d7ec44e20eb9fa04c6731773b23f: all 45 annotations map to pre-existing baseline findings. The branch has 67 open alerts, compared with 70 before the import. Alerts 136 and 139 are reidentified baseline findings 22 and 27; the remote-normalization expression and tool-label normalization function are unchanged. No additional source fixes or alert dismissals are warranted by this aggregate result.

The newly introduced findings 135, 137, 138 and 140 are confirmed fixed by the latest analysis. Test-fixture alert 141 remains dismissed as a documented false positive. The five maintainer-accepted regex dispositions are unchanged. Full release CI is still required on this exact head before merging.

[danspark]

Reviewed alert 142 on 42ee33ef44d6fa0b2f7a25ed3c39d7a249dc7929 against the actual release controls. The alert assumes that needs.metadata.outputs.sha is an unvalidated dispatch value. That assumption does not hold here.

metadata checks out the trusted workflow revision and runs .github/t2code/release.mjs metadata. Before emitting any outputs, it validates a complete SHA, fetches origin/main, rejects a SHA outside main's ancestry, reads that source's accepted upstream pin, verifies the tag and live upstream release identity, and checks for an existing fork release. build_bundle requires successful metadata and consumes only its validated output. The new web boot check uses the same source as the preceding release build.

An isolated Git fixture exercised this exact metadata script from the PR, using a local bare origin and mocked GitHub release metadata. An unmerged commit, a branch-name input and a mismatched tag each failed without emitting a downstream SHA. The merged, correctly pinned commit succeeded and emitted the exact validated SHA. This disproves the arbitrary-source execution path described by this alert. The fixture and results are retained in the operation cache as prove-release-metadata.py and release-metadata-proof.json.

Classified this specific alert as a false positive. No source, workflow checks, query exclusions, baseline findings or accepted regex dispositions were changed. Other analyses are still running and will be reviewed separately.

[danspark]

CodeQL review for 42ee33ef44d6fa0b2f7a25ed3c39d7a249dc7929 is complete. Two valid issues are repaired in the latest head b2dfc925acd88e4d67ec980d39b02c3d9ac4b84e:

• Alert 146, inherited Office worker method dispatch, is fixed in b7b3f6c. Four message-protocol regressions fail before the fix and pass afterward.
• Alert 143, model-name parenthetical regex backtracking, is fixed in b2dfc92. V8 exceeded its backtracking threshold with 8,000 unmatched opening parentheses before the fix and does not afterward. The linear scan preserves 265,720 results across 66,430 short forms, including nested parentheses and all four line terminators. All 16 model-label tests pass.

Alerts 144, 145 and 147 are proven false positives. Each review thread has its source analysis and focused evidence, and only these alerts were dismissed. The temporary draft-ownership investigation was removed after it disproved the randomness claim. Alert 142 was already documented and dismissed independently. No accepted regex finding or inherited alert disposition was changed.

The other annotations map to inherited alerts 35, 36, 37, 49, 58, 59, 61, 62, 63 and 64. Moved expressions 136 and 139 remain mapped to baseline alerts 22 and 27 as previously recorded. Their classifications and source remain unchanged.

Validation passed for the new head: check:changed, including format, lint, both Knip passes, affected-package typechecks and 53 tests in two files. The wider focused run passed 130 tests across file preview, composer drafts and PortScanner. Minimal-overlay verification passes against the same pinned upstream commit. Both fixes use ordinary follow-up commits and a normal push. Dependencies, lockfiles and supported release platforms are unchanged. Full hosted CI on the latest head is still required before merge.

[danspark]

CodeQL triage for b2dfc925a: the 10 remaining annotations were inherited alerts already open on main since 2026-10-08. Each is a proven false positive, now dismissed with its reason:

• chore(sync): run upstream synchronization daily #35, chore(release): prepare on-demand releases from the local task #36, chore(sync): follow v0.0.43-nightly.20260928.2402 #37 (DOM text reinterpreted as HTML): PR attachment URLs only become segments after splitPullRequestBody's http/https isWebUrl check, and OpenMediaLink re-checks the protocol. A probe of javascript:, mixed-case javascript:, data: and protocol-relative URLs in bare, markdown-link and <video> forms produced no attachment, while https URLs still do.
• chore(sync): follow v0.0.46-nightly.20261014.3132 #49 (incomplete multi-character sanitization): the stripped comment body renders as a React text child, so React escapes it and nothing reaches innerHTML.
• chore(deps): bump nodemailer from 10.0.10 to 10.1.4 in /.repos/effect-smol #58, chore(deps): bump undici from 8.11.2 to 8.12.2 in /.repos/effect-smol #59 (insecure randomness): this is the same flow as dismissed Fix chat scroll restoration across thread switches pingdotgg/t3code#145. Math.random only forms local new-task draft keys, and CodeQL conflates draft keys with composerCloudDraftsAtom.accountId through the shared AtomRegistry.
• fix(release): inherit the pinned Node for CLI builds #61–fix(release): unblock the v0.1.4-nightly.20261027.3796 release checks #64 (shell command from environment): test-only. spawnSync runs /bin/sh with argv and a literal -c program, and paths are passed as positional parameters. All 17 process-tree tests pass, including a lease path with spaces and arguments containing quotes.

No source changed. The CodeQL check now reports no new alerts.