[shuv1337]

Summary

Merge 154 upstream commits (3f1b132e970f..50a2f5b9f415) from pingdotgg/t3code into fork main 09526c591899 on sync/upstream-2026-11-15, as a merge commit — no rebase, no cherry-pick.

Fact	Value
Fork base	09526c5918990656666ac55a178a993fb1daa4a9
Upstream pin	50a2f5b9f415665f48b4d71df4ff68c858578199
Merge base	3f1b132e970f698562b1a12749b94f8ac8fc1e0d
Upstream commits merged	154
Merge commit	6fbafaa412f3c9c1a708fc86f28b9285a3b5fcf5
PR head	c9af87a6bf6921605ec4d062b6a35e709db48370
Conflicts	18 paths, all resolved below

Upstream's own summary of the range: perf on long-thread opens and active-thread reads, restart/queue robustness, MCP permission and browser-origin hardening, provider usage/price mapping, and a large batch of desktop/mobile/web fixes. Nothing later was chased: upstream main stayed at the pin for the whole sync.

Upstream highlights

• Performance: long threads open ~2.5x faster with a new inline_work_output projection column and migration 095 (perf(server): long threads open about 2.5x faster pingdotgg/t3code#34014), active-thread reads filter on archived_at (perf(server): active thread reads filter on the archived_at column pingdotgg/t3code#28992), Codex skill context loads 12x faster (perf(server): Codex skills for four workspaces load in a median 138 ms instead of 1,657 ms (12x) pingdotgg/t3code#33972), terminal output batches at 2 ms (perf(server): batch terminal output that arrives within 2 ms pingdotgg/t3code#37060), WSL preflight starts the staged runtime once (perf(desktop): WSL preflight starts the staged runtime once instead of twice pingdotgg/t3code#37052), check:changed on Windows drops from ~2,500 s to ~5 s (perf(scripts): check:changed on Windows no longer spends minutes walking node_modules (2,500 s → 5.0 s) pingdotgg/t3code#32023), and several composer/chat re-render reductions.
• Orchestration/restarts: prompts the provider never accepted survive a restart (fix(server): restarts no longer drop prompts the provider never accepted pingdotgg/t3code#32413), task_status no longer reports a restart-continued task as cancelled (fix(server): task_status no longer reports a restart-continued task as cancelled pingdotgg/t3code#32414), resuming a queue respects failed worktree setup (fix(server): resuming a queue no longer bypasses failed worktree setup pingdotgg/t3code#36616), an effect this build cannot read no longer blocks the thread's later work (fix(server): an effect this build can't read no longer blocks its thread's later work pingdotgg/t3code#32746), forks of forks keep their deleted source's files (fix(server): forks of forks keep their deleted source's files pingdotgg/t3code#32255), a branch's own PR shows past 100 same-named fork PRs (fix(server): a branch's own pull request shows past a hundred same-named fork pull requests pingdotgg/t3code#32796).
• MCP: Codex calls delegate_task directly instead of through Code Mode (fix(server): Codex calls delegate_task directly instead of from Code Mode pingdotgg/t3code#30019, t3-code-direct), cross-thread permission rejections explain the link's approved access (fix(mcp): explain cross-thread permission rejections pingdotgg/t3code#36934), /mcp refuses browser Origins with 403 before auth and CORS (fix(server): MCP refuses disallowed browser origins with 403 before auth and CORS pingdotgg/t3code#35810), agents can no longer delete the built-in "No project" (fix(server): agents can no longer delete the built-in No project through MCP pingdotgg/t3code#33773), plus an agent pin lands at the top of Pinned (fix(server): an MCP pin lands at the top of the Pinned section pingdotgg/t3code#33978) and thread reads report pinned (fix(server): agents can see whether a thread is pinned pingdotgg/t3code#32727).
• Providers: usage mapped onto a Pi/Cursor/Antigravity model prices at that model's rate (fix(server): usage mapped onto a Pi, Cursor or Antigravity model prices at that model's rate pingdotgg/t3code#32219, new rateModel), OpenCode Go-key instances keep Go usage on OpenCode 2 (fix(opencode): Go-key-only instances keep OpenCode Go usage on OpenCode 2 pingdotgg/t3code#36519), OpenCode full-access subagents start without approval prompts (fix(opencode): Full access subagents start without approval prompts pingdotgg/t3code#35401), Grok background generation no longer inherits always-approve (fix(grok): background text generation no longer inherits Grok always-approve pingdotgg/t3code#29692), Claude --settings launch args honored (fix(server): Claude text generation honors --settings launch args pingdotgg/t3code#34874) and WinGet launchers resolve on Windows (fix(server): resolve Claude WinGet launchers on Windows pingdotgg/t3code#32138), an aborted Cursor SDK stall no longer stops the server (fix(cursor): an aborted Cursor SDK stall no longer stops the server pingdotgg/t3code#23354).
• Clients: desktop backend recovery after a busy start (fix(desktop): a backend busy right after startup no longer ends in a fatal HTTP 500 screen pingdotgg/t3code#34918), a connection catalog this build cannot read is kept (fix(desktop): saving keeps a connection catalog this build cannot read pingdotgg/t3code#34944), voice input recovers after Linux audio restarts (fix(desktop): voice input recovers after Linux audio restarts pingdotgg/t3code#32376), main window reloads when it read the WSL endpoint before the Windows fallback; mobile fixes for PR activity filters, Duo layouts, Android clock format, queued-message labels, video previews and tab-bar insets.

Conflict ledger and disposition

18 conflicted paths. Upstream conventions win in shared code; fork features are kept. No unrelated refactors.

Path	Disposition
apps/server/src/httpCors.ts	Kept the fork's desktop renderer origins (s2code/shuv2code schemes); added upstream MCP_HTTP_PATH.
apps/server/src/peer/PeerLinks.ts	Adopted upstream's racing URL probe (a silent address no longer delays one that answers); kept the fork's capabilities/label capture and the link-fence check from the answering peer.
apps/server/src/process/agentScope.ts	Adopted upstream applyMemoryLimits (limits follow live RAM); kept fork ${PRODUCT_ID} scope unit names.
apps/server/src/process/agentScope.test.ts	Union of fake-systemd extras: fork awaitReset/cleanupSlices plus upstream failingVerbs; upstream's live-memory test now filters on the fork's app-s2code-agents.slice.
apps/server/src/mcp/toolkits/thread/handlers.ts	Kept the fork t3_thread_configure service path (model selection + autoSettle); adopted upstream pin ordering; dropped upstream's now-unused mode-selection import.
apps/server/src/orchestration-v2/Adapters/CodexAdapterV2.test.ts	Kept the fork shared-MCP-server fixture; adopted upstream's delegate_task move out of Code Mode into t3-code-direct.
apps/server/src/cli/invocation.ts	Kept the fork's invocation resolution (owned npm bin, launcher, npx/bunx); adopted upstream's root-command trimEnd so resolveHostCliCommand("") emits no double space.
apps/server/src/cli/up.ts	Adopted upstream's base-dir-aware hints object; kept fork S2CODE_LAN writes and S2Code wording.
apps/server/src/cli/up.test.ts	Adopted upstream's multi-line prints; kept fork product wording, and kept the fragment style the source-runtime prefix requires. The upstream T3CODE_LAN case is deliberate: a refused other-home service must stay byte-identical.
apps/desktop/src/backend/DesktopBackendPool.ts	Kept the fork's local-server attach early return (update recovery stays alive); adopted upstream reloadMainOnReady for a pre-readiness WSL fallback.
apps/desktop/src/backend/DesktopBackendPool.test.ts	Kept the fork attach test and its dialog/quit overrides; added upstream's dialog dies and the reload test.
apps/mobile/src/lib/modelOptions.test.ts	Union of imports: fork usage-limit pool selection + upstream stored-thread options helper.
apps/web/src/components/settings/AcpSessionManagementSection.browser.test.tsx	Adopted upstream's focus wait before keys; kept the fork's exact option name.
packages/provider-acp/src/server/mcpOverAcpBridge.ts	Kept the fork's per-connection endpoint (shared MCP binding); adopted upstream's retry-restore wrapper so a failed disconnect restores the session.
packages/provider-acp/src/server/mcpOverAcpBridge.test.ts	Union of the fork's multi-endpoint fixture and upstream's 503/retry assertions.
packages/provider-cursor/src/server/driver.ts	Adopted upstream rateModel; kept the fork's keychain-aware usage scan.
docs/orchestration-v2/orchestrator-mcp-server.md	Adopted upstream's contract-import type block (contract is authoritative); kept the fork delegation prose for isolation, target.options and linked environments.
docs/user/install.md	Kept the fork install identity, homes and markers; adopted upstream's pair guidance worded with s2code-nightly pair.

Protected fork behavior — evidence

Invariant	Evidence
MCP tool set	Production Tool.make( declarations under apps/server/src/mcp, excluding test/spec files: 81 before / 81 after (78 literal names, three symbolic names), no removed tools. The earlier 92 count lacked a reproducible scope and is superseded. agentContextBudget.json unchanged: Claude append 5,930 B, Codex context 7,324 B, MCP tool-list JSON 51,814 B. No agent-context-increase label.
Delegated tasks	RemoteDelegation, PeerLinks, SharedMcpServers, McpSessionRegistry, ThreadSettlementService, ProjectionSettlement: 168 tests pass. CodexAdapterV2 197 tests (shared servers + delegate_task direct). Orchestrator toolkit core 25.
Local/cross-project/remote/worktree delegation + completion delivery	UsageLimitFailover.integration, UsageLimitFailoverWorker, ThreadLaunchService, OrchestratorMcpService: 213 tests pass. Restart-continuation was refactored upstream without behavior change (Stop handling extracted to restartStopRequested); fork continuation chain and delegated-task Stop propagation still covered.
Pools / named seats / spent-instance failover	Same 213-test batch. Upstream carries continuation history through failover; the fork's replacement-account-new-turn behavior is unchanged in UsageLimitFailover* and ThreadLaunchService.
Shared MCP binding (#432) + permission ordering	SharedMcpServers + McpSessionRegistry + PeerLinks (168-test batch); assertTargetWithinLimits now carries the target thread id for upstream's clearer cross-thread rejection, and the fork's deny ordering is untouched.
Per-thread autoSettle (#435/#436)	ThreadSettlementService/ProjectionSettlement in the 168-test batch; t3_thread_configure keeps the fork service path and autoSettle read/write. Migration 054_ProjectionThreadsAutoSettleDisabledAt untouched.
Cursor CLI/Keychain + SDK patch	CursorAgentSdk, CursorSdk, cursorRetry, adapter, driver: 71 tests pass. patches/@cursor__sdk@1.3.1.patch unchanged (no conflict); the shell-stream producer in CJS/ESM/bundled builds is untouched and still asserted by the installed-producer tests. Keychain usage flag retained in CursorUsageAccounts.
Migration ledgers	Fork ledger 1–7 unchanged in ForkMigrations.ts; upstream appended 095_TurnItemInlineWorkOutput after 094, no renumbering. Migrations, reconcileForkMigrationTrack, initializeV2Database, DatabaseStorage: 27 tests pass, including reconciliation and fail-closed paths. No live database was opened and no migration ran outside test fixtures.
Branding / channel homes / release sources	CLI invocation + up + up.test: 89 tests pass (fork command names, S2CODE_* settings, refused other-home service). .github/workflows/ is byte-identical to base: fork nightly release, deploy/publish guards and Windows jobs untouched.
Ocean-dark default theme (#438)	themeBoot + useEnvironmentTheme: 41 tests pass; no starry sidebar header reintroduced (no conflict, upstream's seam-variable change in index.css merged cleanly).
Windows payload cap (#434)	scripts/build-desktop-artifact.test.ts: 74 tests pass on Linux fixtures. The real payload count is produced by the Windows job — see limits.
Formatter fix (#441)	pnpm-workspace.yaml publicHoistPattern: oxfmt untouched; commit hooks ran normally (vp fmt, vp lint, vp knip:check) with no bypass. /home/shuv/node_modules not touched.
Lockfile / patches / codegen	Upstream's 154 commits change no dependency (only packages/shared/package.json gained two exports entries), so pnpm-lock.yaml, pnpm-workspace.yaml and patches/ are unchanged and no regeneration was needed.

Validation

• PASS: targeted typecheck of every conflicted workspace: t3, @t3tools/desktop, @t3tools/provider-acp, @t3tools/provider-cursor, @t3tools/mobile — 5/5 tasks.
• PASS: the focused protected-feature suites from the table above, each run on this head: 213 (failover, launch, MCP service), 197 (Codex adapter), 168 (shared MCP, peers, delegation, settlement), 106 (CLI branding: up, invocation, config), 74 (Windows payload fixtures), 71 (Cursor SDK), 41 (theme boot), 27 (migrations), 25 (thread toolkit core), 17 (check-changed script), 14 (ACP settings browser), 7 (desktop backend pool), 6 (ACP bridge + Cursor driver) — all green; a few files ran in more than one batch.
• PASS: offline MCP context eval (mcp-tool-use --context, no model calls): 79 tools, 7,655 B system text / 15,883 B tool descriptions / 52,999 B schemas. No paid eval was run.
• check:changed (cfffaebf7f, vs origin/main): PASS. format, lint, knip (both passes), unused patches, both GraphQL checks, and typecheck 42/42 packages; tests 209 files / 5,714 tests pass plus the react-compiler pass (104 tests, 2,422 skipped). One upstream case needed porting first: its fixture assumed upstream's own defaults, so it now writes this fork's .product-identity marker and uses the fork default home; that commit is cfffaebf7f.

Limits

• No CI was started by this PR's author; CI Full and the platform jobs belong to the lead. Not verified here: Windows payload file count (100-file cap) and Windows shim/archive, macOS native/packaging, mobile native static analysis, Rust crates, and the browser suite at CI concurrency.
• No dev server, no real-client pass, no app install, no release/tag/workflow dispatch, no paid agent turns.
• The Windows payload cap is exercised only by fixtures on Linux; if upstream's new server modules add prepared cache entries, the Windows job is what will say so first.

Follow-up (not changed here)

• New upstream mcpOAuthHttp.ts body-read orDie: unreadable request bodies bypass the declared registration-error mapper. Nonblocking upstream-owned code-level finding, not independently HTTP-reproduced (ratstack://lore/error-model). Per user direction, leave shared upstream code unchanged to avoid sync drift; no fork follow-up PR unless a real user-visible failure occurs.
• Fork-only shared MCP endpoint /mcp/servers/<name> still answers browser CORS, while upstream's new rule refuses any browser Origin on /mcp. The fork proxy needs a T3-issued agent token, so this is not a regression from the sync; aligning it is a separate decision.

Final review correction

Both split reviewers approved cfffaebf7f with no blockers. The primary restored the CLI negative assertion to omits: "--no-lan" in c9af87a6bf; this is the only delta and changes no production code. A temporary planted host-guard violation passed all 29 tests with the weak assertion, failed exactly one after restoring the strict assertion, and all 29 passed after restoring production code. Final-delta check:changed cfffaebf7f passed format/lint/knip, three package typechecks and 31 tests in two files; the real commit passed all hooks without bypass. Rat-stack: ratstack://lore/tests-that-earn-their-place.

Final assertion re-check APPROVED c9af87a6bf6921605ec4d062b6a35e709db48370 (29 CLI tests + targeted case, format and lint pass); final-head CI Full https://github.com/shuv1337/s2code/actions/runs/43702446726 PASSED all 18 jobs, including Test Web + built-client boot and all eight server Test steps. Required CI, context-budget and Socket checks are green. Split server/client approvals and primary isolated UI pass are recorded in comments. Ready to merge; no release dispatch. The earlier full CI https://github.com/shuv1337/s2code/actions/runs/43700880256, Windows shim/archive https://github.com/shuv1337/s2code/actions/runs/43700994951 and primary isolated browser pass all succeeded at cfffaebf7f (production code identical). No macOS/native-device/full Electron payload-count execution is claimed.

Commit details

• 6fbafaa412 — merge commit, parents 09526c591899 (fork main) and 50a2f5b9f415 (upstream pin); upstream history preserved, no rebase.
• cfffaebf7f — port the new upstream pair-hint CLI fixture to fork homes/dirs (it is the only test the merge's own check:changed tripped).

Notes

• rat-stack pages followed: ratstack://skills/ship (candidate/CI/evidence discipline, no deploy), ratstack://lore/tests-that-earn-their-place (behavior over implementation; extend existing cases), ratstack://lore/testing-ladder (smallest check that catches the failure), ratstack://lore/error-model (declared failures stay distinct from defects). Astra found one nonblocking upstream error-model deviation: apps/server/src/auth/mcpOAuthHttp.ts:112–121 applies orDie to request body reads before mapping registration errors (ratstack://lore/error-model). This is a code-level finding, not HTTP-reproduced; retain upstream code without fork divergence. Per user direction, record this as upstream-owned rat-stack debt only; no fork follow-up PR unless a real user-visible failure occurs. The inherited spentInstanceResolver.ts:70 orDie debt is unchanged.
• Implementation: DeepSeek V4.1 Flash, OpenCode harness (opencode-go/deepseek-v4.1-flash) inside T3 Code.

[shuv1337]

Primary integrated client pass at cfffaeb: captured baseline on main09526c59 using a throwaway home, created a free Replay showcase turn and handled its simulated approval; stopped baseline, started sync against that same isolated home, verified migration095 adds inline_work_output and re-opened the persisted rich transcript unchanged. On sync, a fresh command-output replay completed; expanded the tool row and confirmed literal JSON/Unicode output. Settings > Appearance still selects Ocean + dark, S2Code branding remains, no starry sidebar header. Before/after/Appearance/tool-output captures retained outside git. A concurrent focused test generated .vite-temp config and triggered a dev watcher restart; UI recovered automatically, final alerts empty. Filed recurring dev-only watcher papercut pc_bead8ad7760c; no production crash attributed. No live state, paid turns, app install, or release. Native mobile/macOS packaging and full Windows installer payload count are not covered by this browser pass. Split reviews, CI Full and Windows shim/archive validation remain pending.

[shuv1337]

Windows validation passed at cfffaeb: https://github.com/shuv1337/s2code/actions/runs/43700994951 — real cmd.exe shim check and real built Windows x64 CLI archive smoke test both succeeded. This is not a claim that the full Electron installer payload-cap file count, macOS packaging, or native mobile was exercised. Split reviews and CI Full remain separate gates.

[shuv1337]

Astra/high server/provider/migration review APPROVED cfffaeb with no blocking findings. Independently ran 924 focused tests across 33 files, including installed Cursor CJS/ESM/bundled shell producers, failover/delegation, migration095, receipt identity, MCP/ownership and CLI homes. Corrected the tool inventory to a reproducible 81 production Tool.make declarations under apps/server/src/mcp before/after (tests excluded); no tools removed. Nonblocking rat-stack finding: upstream mcpOAuthHttp.ts body-read orDie bypasses its declared registration-error mapping on read failure (code-level only, not HTTP-reproduced; ratstack://lore/error-model). Track separately; inherited shared-proxy Origin difference and spentInstanceResolver debt are unchanged. Client split review and CI Full remain gates; primary isolated UI and Windows CLI validation are recorded separately.

[shuv1337]

CI Full is green at exact head cfffaeb: https://github.com/shuv1337/s2code/actions/runs/43700880256 . Test Web and its production-client boot both succeeded, all eight server Test steps passed, and every other job succeeded with no cancellation/timeout. Windows shim/real CLI archive, Astra server review and primary isolated browser pass are recorded above. The remaining acceptance gate is the client/desktop/CI split review; not merging before that result.

[shuv1337]

DeepSeek client/desktop/themes/CI review approved cfffaeb with no blockers and confirmed frozen context budget, all 18 conflict resolutions, fork branding/themes/formatter/release guards. Fixed its one concrete coverage weakness before merge: c9af87a restores omits:"--no-lan". Planted host-guard violation: old assertion29pass -> restored assertion1fail/28pass -> production restored29pass. Only one test line changed, no runtime code. Normal hook commit and final-delta changed checks pass; fresh assertion review and CI Full43702446726 are running. Inherited startup-recovery upstream-release links and mobile branding remain separate backlog items; upstream-owned OAuth error-model note remains untouched per user direction.

[shuv1337]

Final acceptance: both split reviews approved; fresh independent review approved the one-line test-only delta at c9af87a; final CI Full43702446726 passed all 18 jobs including actual Test Web+production boot and every server Test step. Required CI/context/Socket green; mergeable/clean. Windows cmd.exe shim + real CLI archive smoke and isolated migration/replay/theme/browser pass were green on identical production code. Two Pi watcher processes failed, but the primary completed a blocking watch of the same existing run; CI was not retried. Upstream-owned OAuth code unchanged per user instruction. Merging with history-preserving merge commit; no release/deploy/install.