chore(upstream): sync marcode through f6f2be32

[maarco]

What Changed

Daily upstream sync: merges pingdotgg/t3code@f6f2be32 (41 commits since f035a0f4, through upstream v0.0.35) into main as a normal two-parent merge. Fourteen conflicts, each resolved by hand so both intents survive — no whole-file ours/theirs, no force push, reset, restore, stash, or clean.

Conflict decisions

Path	Decision
apps/server/src/persistence/Migrations.ts	Upstream's new 042/043 renamed to Marcode's next free ids 043/044. Marcode's ProjectWorkspaceLayout owns 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Migrations.test.ts (the pin that fails loudly on every sync) and the migration's own test extended to match.
apps/server/src/cloud/bootService.ts (+ test)	Took upstream's launchd PATH export (pingdotgg#8173, keeps provider CLIs reachable from the macOS service) and kept Marcode's MARCODE_HOME key. The launcher reads MARCODE_HOME and exits without it, so exporting upstream's T3CODE_HOME would ship a service that never boots. Both assertions kept.
packages/contracts/src/environment.ts, ServerEnvironment.ts (+ test)	Kept both capability flags — Marcode's workspaceLayoutMutations and upstream's new threadPullRequestLinking. Additive on both sides.
apps/web/src/components/ChatMarkdown.tsx	Took upstream's expanded editorPreferences/editorLabels imports and the whole markdown file-link rework; kept Marcode's openFileInFloatingEditor seam and workspacePath prop. Dropped useRightPanelStore and useActiveEnvironmentId, whose only consumers upstream replaced.
apps/web/src/components/ChatView.tsx	Kept Marcode's title-only ChatHeader and single panelLayoutControls mount; took upstream's settleThread. Upstream's new project-scoped openProjectPullRequest has no consumer here — ThreadActionsCluster already wires the more capable openThreadPullRequest — so it is dropped with a seam comment naming where new entry points belong.
apps/web/src/components/chat/OpenInPicker.tsx	Took upstream's editorLabelForPlatform refactor (which preserves Finder/Explorer/Files) and kept Marcode's FolderOpenFilled icon.
apps/web/src/components/ThreadTerminalDrawer.tsx	Kept Marcode's xterm link provider. Upstream's pingdotgg#7488 swapped an inline regex for isTerminalUrl; Marcode already classifies through extractTerminalLinks, whose URL_PATTERN is the same https?:// test, so the fix is already present in this path. Recorded as a seam so the divergence is re-ported deliberately each sync.
apps/mobile/src/lib/mobileBranding.test.ts	Upstream deleted it as low-signal (pingdotgg#8397). Kept — it pins Marcode's empty stable-channel stage label against upstream's "Alpha". Annotated so the next sync knows why it survives an upstream deletion.
apps/web/src/components/threadSidebarWidth.test.ts	Upstream deleted it as trivial (pingdotgg#8400). Kept — it carries the sidebar brand-removal pin, which has no other home. Followed upstream in un-exporting THREAD_SIDEBAR_DEFAULT_WIDTH rather than re-exporting it for the test, and re-expressed that one assertion against the minimum.
scripts/build-desktop-artifact.test.ts	Kept Marcode's provisioning-profile fixture; took upstream's MAC_FILE_EXCLUSIONS import and the new mac.sign assertion from the signing rework (pingdotgg#8093).
pnpm-lock.yaml	Kept Marcode's @xterm/* entries; the Clerk bumps merged cleanly. pnpm install --frozen-lockfile passes against the merged workspace.

Fork-boundary breaks that merged cleanly (no conflict)

These are the dangerous ones — they produce no mark and then quietly do not work:

• apps/server/src/process/externalLauncher.test.ts carried an upstream oxlint-disable for t3code/no-global-process-runtime. Marcode's plugin namespace is marcode/, so the directive would have been unknown and tripped --report-unused-disable-directives. Renamed.
• .github/workflows/desktop-macos-preview.yml (new, feat(desktop): build macOS previews from a PR label pingdotgg/t3code#8182/feat(ci): download macOS preview DMGs without signing in pingdotgg/t3code#8243) ran on Blacksmith runners the public fork cannot reach, which queue forever rather than failing. Pinned to ubuntu-24.04/macos-26 with the same comment convention ci.yml already uses. The workflow is opt-in behind a preview:mac label and is not a required check — say the word if you would rather leave it upstream-shaped.
• apps/server/src/provider/ModelManifest.ts fetches upstream's hosted model manifest (feat(server): fetch legacy model classification from a hosted manifest pingdotgg/t3code#8227). Kept pointed at pingdotgg/t3codedeliberately: model classification is upstream-owned with no Marcode divergence, and the fork's own main would only refresh on a sync — losing the point of hosting it. Same precedent as the triage playbook URL. Recorded in a seam comment.

Swept T3CODE_*, t3code.service, WORKTREE_BRANCH_PREFIX, and boot-service naming across the merged tree; every other hit is an intentional compatibility identifier (T3_BOOT_SERVICE_UNIT, com.t3tools.t3code.service, t3code:* storage keys, @t3tools/*, the t3 package name) and is left upstream-shaped.

Coupled subtrees

pnpm-workspace.yaml moved only Clerk versions. The effect and alchemy catalog entries are unchanged, so neither .repos/effect-smol nor .repos/alchemy-effect needs a sync in this change.

Deleted tests

Upstream pruned 13 test files (pingdotgg#8397, pingdotgg#8400). Each was checked against the previous merge base and carried no Marcode edits, so all 13 deletions are accepted. The two that did carry Marcode behavior are kept and annotated (above).

Why

Marcode is a maintained fork. Upstream correctness, security, protocol, dependency, and operational fixes have to land, while Marcode's intentional product behavior — the floating editor, the unified workspace tree, FloatingPillNav, branding, and the migration id offset — has to survive them. Hotspot paths are mandatory-review paths, not automatic keep-Marcode paths, so the upstream launchd PATH fix, the editorLabelForPlatform refactor, and the mac.sign assertion were all taken even though they landed in customized files.

Where Marcode keeps a divergent implementation of an upstream subsystem, the divergence is now marked with a ── Marcode fork seam ── comment saying what it mounts and why, so the next person resolving that conflict knows instantly whether a hunk is theirs, ours, or a join.

UI Changes

None. Every web change in this merge is upstream's own; Marcode's user-visible surfaces (ChatHeader, OpenInPicker icon, panel layout controls, terminal link behavior) are preserved unchanged by the resolutions above. No live client verification was run in this container — it has no display or simulator — so if you want the chat markdown file-link rework driven in a real browser before this goes ready, that is the one thing left.

Checklist

• This PR is small and focused — one concern: the upstream sync
• I explained what changed and why
• I included before/after screenshots for any UI changes — n/a, no Marcode UI change
• I included a video for animation/interaction changes — n/a

Verification

Focused only on what the merge touched; CI owns the full suite.

• Tests (all passing): server boot service, ServerEnvironment, serviceLauncher, migrations 033/042/043 + the Migrations.test.ts pin, externalLauncher, GitVcsDriverCore, ProviderRegistry, ProjectionSnapshotQuery, serverSettings; web ChatMarkdown (×2), ChatView.logic, ThreadTerminalDrawer (+ stylesheet), terminal-links, editorLabels, Sidebar.logic, openPullRequestLink, imageCompression, versionSkew, threadSidebarWidth; mobile branding, markdownLinks, threadListV2, connection, linkEnvironment; contracts environment/settings; build-desktop-artifact, sign-macos, upstream-sync-workflow parity.
• Typecheck: @t3tools/contracts, @t3tools/web, t3, @t3tools/scripts, @t3tools/mobile — all clean.
• Format / lint: vp fmt --check over all 203 changed files, vp lint --report-unused-disable-directives over the 44 changed directories — clean, warnings only and all pre-existing.
• Install: pnpm install --frozen-lockfile succeeds, confirming the resolved lockfile matches the merged workspace and every package.json.
• Mobile static analysis: scripts/mobile-native-static-check.ts exits 0 (swiftlint/ktlint/detekt unavailable in this container, as on any non-macOS host).

Not verified here: live browser and simulator runs, and the four required CI checks — those run on this PR.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.2 KiB	−173 B (−1.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−174 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.5 KiB	+514 B (+0.9%)	66.4 KiB	✅
Codex	Live turn messages	16	9	−7 (−43.8%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−252 B (−1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+17 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.3 KiB	−269 B (−4.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−308 B (−0.5%)	66.4 KiB	✅
Claude	Live turn messages	16	9	−7 (−43.8%)	21	✅

Baseline: 133f3f7 · PR result: f08c879 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Daily upstream sync: merges pingdotgg/t3code@f6f2be32 (41 commits since f035a0f4, through upstream v0.0.35) into main as a normal two-parent merge. Fourteen conflicts, each resolved by hand so both intents survive — no whole-file ours/theirs, no force push, reset, restore, stash, or clean.

Conflict decisions

Path	Decision
apps/server/src/persistence/Migrations.ts	Upstream's new 042/043 renamed to Marcode's next free ids 043/044. Marcode's ProjectWorkspaceLayout owns 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Migrations.test.ts (the pin that fails loudly on every sync) and the migration's own test extended to match.
apps/server/src/cloud/bootService.ts (+ test)	Took upstream's launchd PATH export (pingdotgg#8173, keeps provider CLIs reachable from the macOS service) and kept Marcode's MARCODE_HOME key. The launcher reads MARCODE_HOME and exits without it, so exporting upstream's T3CODE_HOME would ship a service that never boots. Both assertions kept.
packages/contracts/src/environment.ts, ServerEnvironment.ts (+ test)	Kept both capability flags — Marcode's workspaceLayoutMutations and upstream's new threadPullRequestLinking. Additive on both sides.
apps/web/src/components/ChatMarkdown.tsx	Took upstream's expanded editorPreferences/editorLabels imports and the whole markdown file-link rework; kept Marcode's openFileInFloatingEditor seam and workspacePath prop. Dropped useRightPanelStore and useActiveEnvironmentId, whose only consumers upstream replaced.
apps/web/src/components/ChatView.tsx	Kept Marcode's title-only ChatHeader and single panelLayoutControls mount; took upstream's settleThread. Upstream's new project-scoped openProjectPullRequest has no consumer here — ThreadActionsCluster already wires the more capable openThreadPullRequest — so it is dropped with a seam comment naming where new entry points belong.
apps/web/src/components/chat/OpenInPicker.tsx	Took upstream's editorLabelForPlatform refactor (which preserves Finder/Explorer/Files) and kept Marcode's FolderOpenFilled icon.
apps/web/src/components/ThreadTerminalDrawer.tsx	Kept Marcode's xterm link provider. Upstream's pingdotgg#7488 swapped an inline regex for isTerminalUrl; Marcode already classifies through extractTerminalLinks, whose URL_PATTERN is the same https?:// test, so the fix is already present in this path. Recorded as a seam so the divergence is re-ported deliberately each sync.
apps/mobile/src/lib/mobileBranding.test.ts	Upstream deleted it as low-signal (pingdotgg#8397). Kept — it pins Marcode's empty stable-channel stage label against upstream's "Alpha". Annotated so the next sync knows why it survives an upstream deletion.
apps/web/src/components/threadSidebarWidth.test.ts	Upstream deleted it as trivial (pingdotgg#8400). Kept — it carries the sidebar brand-removal pin, which has no other home. Followed upstream in un-exporting THREAD_SIDEBAR_DEFAULT_WIDTH rather than re-exporting it for the test, and re-expressed that one assertion against the minimum.
scripts/build-desktop-artifact.test.ts	Kept Marcode's provisioning-profile fixture; took upstream's MAC_FILE_EXCLUSIONS import and the new mac.sign assertion from the signing rework (pingdotgg#8093).
pnpm-lock.yaml	Kept Marcode's @xterm/* entries; the Clerk bumps merged cleanly. pnpm install --frozen-lockfile passes against the merged workspace.

Fork-boundary breaks that merged cleanly (no conflict)

These are the dangerous ones — they produce no mark and then quietly do not work:

• apps/server/src/process/externalLauncher.test.ts carried an upstream oxlint-disable for t3code/no-global-process-runtime. Marcode's plugin namespace is marcode/, so the directive would have been unknown and tripped --report-unused-disable-directives. Renamed.
• .github/workflows/desktop-macos-preview.yml (new, feat(desktop): build macOS previews from a PR label pingdotgg/t3code#8182/feat(ci): download macOS preview DMGs without signing in pingdotgg/t3code#8243) ran on Blacksmith runners the public fork cannot reach, which queue forever rather than failing. Pinned to ubuntu-24.04/macos-26 with the same comment convention ci.yml already uses. The workflow is opt-in behind a preview:mac label and is not a required check — say the word if you would rather leave it upstream-shaped.
• apps/server/src/provider/ModelManifest.ts fetches upstream's hosted model manifest (feat(server): fetch legacy model classification from a hosted manifest pingdotgg/t3code#8227). Kept pointed at pingdotgg/t3codedeliberately: model classification is upstream-owned with no Marcode divergence, and the fork's own main would only refresh on a sync — losing the point of hosting it. Same precedent as the triage playbook URL. Recorded in a seam comment.

Swept T3CODE_*, t3code.service, WORKTREE_BRANCH_PREFIX, and boot-service naming across the merged tree; every other hit is an intentional compatibility identifier (T3_BOOT_SERVICE_UNIT, com.t3tools.t3code.service, t3code:* storage keys, @t3tools/*, the t3 package name) and is left upstream-shaped.

Coupled subtrees

pnpm-workspace.yaml moved only Clerk versions. The effect and alchemy catalog entries are unchanged, so neither .repos/effect-smol nor .repos/alchemy-effect needs a sync in this change.

Deleted tests

Upstream pruned 13 test files (pingdotgg#8397, pingdotgg#8400). Each was checked against the previous merge base and carried no Marcode edits, so all 13 deletions are accepted. The two that did carry Marcode behavior are kept and annotated (above).

Why

Marcode is a maintained fork. Upstream correctness, security, protocol, dependency, and operational fixes have to land, while Marcode's intentional product behavior — the floating editor, the unified workspace tree, FloatingPillNav, branding, and the migration id offset — has to survive them. Hotspot paths are mandatory-review paths, not automatic keep-Marcode paths, so the upstream launchd PATH fix, the editorLabelForPlatform refactor, and the mac.sign assertion were all taken even though they landed in customized files.

Where Marcode keeps a divergent implementation of an upstream subsystem, the divergence is now marked with a ── Marcode fork seam ── comment saying what it mounts and why, so the next person resolving that conflict knows instantly whether a hunk is theirs, ours, or a join.

UI Changes

None. Every web change in this merge is upstream's own; Marcode's user-visible surfaces (ChatHeader, OpenInPicker icon, panel layout controls, terminal link behavior) are preserved unchanged by the resolutions above. No live client verification was run in this container — it has no display or simulator — so if you want the chat markdown file-link rework driven in a real browser before this goes ready, that is the one thing left.

Checklist

• This PR is small and focused — one concern: the upstream sync
• I explained what changed and why
• I included before/after screenshots for any UI changes — n/a, no Marcode UI change
• I included a video for animation/interaction changes — n/a

Verification

Focused only on what the merge touched; CI owns the full suite.

• Tests (all passing): server boot service, ServerEnvironment, serviceLauncher, migrations 033/042/043 + the Migrations.test.ts pin, externalLauncher, GitVcsDriverCore, ProviderRegistry, ProjectionSnapshotQuery, serverSettings; web ChatMarkdown (×2), ChatView.logic, ThreadTerminalDrawer (+ stylesheet), terminal-links, editorLabels, Sidebar.logic, openPullRequestLink, imageCompression, versionSkew, threadSidebarWidth; mobile branding, markdownLinks, threadListV2, connection, linkEnvironment; contracts environment/settings; build-desktop-artifact, sign-macos, upstream-sync-workflow parity.
• Typecheck: @t3tools/contracts, @t3tools/web, t3, @t3tools/scripts, @t3tools/mobile — all clean.
• Format / lint: vp fmt --check over all 203 changed files, vp lint --report-unused-disable-directives over the 44 changed directories — clean, warnings only and all pre-existing.
• Install: pnpm install --frozen-lockfile succeeds, confirming the resolved lockfile matches the merged workspace and every package.json.
• Mobile static analysis: scripts/mobile-native-static-check.ts exits 0 (swiftlint/ktlint/detekt unavailable in this container, as on any non-macOS host).

Not verified here: live browser and simulator runs, and the four required CI checks — those run on this PR.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.2 KiB	−173 B (−1.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−174 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.5 KiB	+514 B (+0.9%)	66.4 KiB	✅
Codex	Live turn messages	16	9	−7 (−43.8%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−252 B (−1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+17 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.3 KiB	−269 B (−4.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−308 B (−0.5%)	66.4 KiB	✅
Claude	Live turn messages	16	9	−7 (−43.8%)	21	✅

Baseline: 133f3f7 · PR result: f08c879 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Daily upstream sync: merges pingdotgg/t3code@f6f2be32 (41 commits since f035a0f4, through upstream v0.0.35) into main as a normal two-parent merge. Fourteen conflicts, each resolved by hand so both intents survive — no whole-file ours/theirs, no force push, reset, restore, stash, or clean.

Conflict decisions

Path	Decision
apps/server/src/persistence/Migrations.ts	Upstream's new 042/043 renamed to Marcode's next free ids 043/044. Marcode's ProjectWorkspaceLayout owns 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Migrations.test.ts (the pin that fails loudly on every sync) and the migration's own test extended to match.
apps/server/src/cloud/bootService.ts (+ test)	Took upstream's launchd PATH export (pingdotgg#8173, keeps provider CLIs reachable from the macOS service) and kept Marcode's MARCODE_HOME key. The launcher reads MARCODE_HOME and exits without it, so exporting upstream's T3CODE_HOME would ship a service that never boots. Both assertions kept.
packages/contracts/src/environment.ts, ServerEnvironment.ts (+ test)	Kept both capability flags — Marcode's workspaceLayoutMutations and upstream's new threadPullRequestLinking. Additive on both sides.
apps/web/src/components/ChatMarkdown.tsx	Took upstream's expanded editorPreferences/editorLabels imports and the whole markdown file-link rework; kept Marcode's openFileInFloatingEditor seam and workspacePath prop. Dropped useRightPanelStore and useActiveEnvironmentId, whose only consumers upstream replaced.
apps/web/src/components/ChatView.tsx	Kept Marcode's title-only ChatHeader and single panelLayoutControls mount; took upstream's settleThread. Upstream's new project-scoped openProjectPullRequest has no consumer here — ThreadActionsCluster already wires the more capable openThreadPullRequest — so it is dropped with a seam comment naming where new entry points belong.
apps/web/src/components/chat/OpenInPicker.tsx	Took upstream's editorLabelForPlatform refactor (which preserves Finder/Explorer/Files) and kept Marcode's FolderOpenFilled icon.
apps/web/src/components/ThreadTerminalDrawer.tsx	Kept Marcode's xterm link provider. Upstream's pingdotgg#7488 swapped an inline regex for isTerminalUrl; Marcode already classifies through extractTerminalLinks, whose URL_PATTERN is the same https?:// test, so the fix is already present in this path. Recorded as a seam so the divergence is re-ported deliberately each sync.
apps/mobile/src/lib/mobileBranding.test.ts	Upstream deleted it as low-signal (pingdotgg#8397). Kept — it pins Marcode's empty stable-channel stage label against upstream's "Alpha". Annotated so the next sync knows why it survives an upstream deletion.
apps/web/src/components/threadSidebarWidth.test.ts	Upstream deleted it as trivial (pingdotgg#8400). Kept — it carries the sidebar brand-removal pin, which has no other home. Followed upstream in un-exporting THREAD_SIDEBAR_DEFAULT_WIDTH rather than re-exporting it for the test, and re-expressed that one assertion against the minimum.
scripts/build-desktop-artifact.test.ts	Kept Marcode's provisioning-profile fixture; took upstream's MAC_FILE_EXCLUSIONS import and the new mac.sign assertion from the signing rework (pingdotgg#8093).
pnpm-lock.yaml	Kept Marcode's @xterm/* entries; the Clerk bumps merged cleanly. pnpm install --frozen-lockfile passes against the merged workspace.

Fork-boundary breaks that merged cleanly (no conflict)

These are the dangerous ones — they produce no mark and then quietly do not work:

• apps/server/src/process/externalLauncher.test.ts carried an upstream oxlint-disable for t3code/no-global-process-runtime. Marcode's plugin namespace is marcode/, so the directive would have been unknown and tripped --report-unused-disable-directives. Renamed.
• .github/workflows/desktop-macos-preview.yml (new, feat(desktop): build macOS previews from a PR label pingdotgg/t3code#8182/feat(ci): download macOS preview DMGs without signing in pingdotgg/t3code#8243) ran on Blacksmith runners the public fork cannot reach, which queue forever rather than failing. Pinned to ubuntu-24.04/macos-26 with the same comment convention ci.yml already uses. The workflow is opt-in behind a preview:mac label and is not a required check — say the word if you would rather leave it upstream-shaped.
• apps/server/src/provider/ModelManifest.ts fetches upstream's hosted model manifest (feat(server): fetch legacy model classification from a hosted manifest pingdotgg/t3code#8227). Kept pointed at pingdotgg/t3codedeliberately: model classification is upstream-owned with no Marcode divergence, and the fork's own main would only refresh on a sync — losing the point of hosting it. Same precedent as the triage playbook URL. Recorded in a seam comment.

Swept T3CODE_*, t3code.service, WORKTREE_BRANCH_PREFIX, and boot-service naming across the merged tree; every other hit is an intentional compatibility identifier (T3_BOOT_SERVICE_UNIT, com.t3tools.t3code.service, t3code:* storage keys, @t3tools/*, the t3 package name) and is left upstream-shaped.

Coupled subtrees

pnpm-workspace.yaml moved only Clerk versions. The effect and alchemy catalog entries are unchanged, so neither .repos/effect-smol nor .repos/alchemy-effect needs a sync in this change.

Deleted tests

Upstream pruned 13 test files (pingdotgg#8397, pingdotgg#8400). Each was checked against the previous merge base and carried no Marcode edits, so all 13 deletions are accepted. The two that did carry Marcode behavior are kept and annotated (above).

Why

Marcode is a maintained fork. Upstream correctness, security, protocol, dependency, and operational fixes have to land, while Marcode's intentional product behavior — the floating editor, the unified workspace tree, FloatingPillNav, branding, and the migration id offset — has to survive them. Hotspot paths are mandatory-review paths, not automatic keep-Marcode paths, so the upstream launchd PATH fix, the editorLabelForPlatform refactor, and the mac.sign assertion were all taken even though they landed in customized files.

Where Marcode keeps a divergent implementation of an upstream subsystem, the divergence is now marked with a ── Marcode fork seam ── comment saying what it mounts and why, so the next person resolving that conflict knows instantly whether a hunk is theirs, ours, or a join.

UI Changes

None. Every web change in this merge is upstream's own; Marcode's user-visible surfaces (ChatHeader, OpenInPicker icon, panel layout controls, terminal link behavior) are preserved unchanged by the resolutions above. No live client verification was run in this container — it has no display or simulator — so if you want the chat markdown file-link rework driven in a real browser before this goes ready, that is the one thing left.

Checklist

• This PR is small and focused — one concern: the upstream sync
• I explained what changed and why
• I included before/after screenshots for any UI changes — n/a, no Marcode UI change
• I included a video for animation/interaction changes — n/a

Verification

Focused only on what the merge touched; CI owns the full suite.

• Tests (all passing): server boot service, ServerEnvironment, serviceLauncher, migrations 033/042/043 + the Migrations.test.ts pin, externalLauncher, GitVcsDriverCore, ProviderRegistry, ProjectionSnapshotQuery, serverSettings; web ChatMarkdown (×2), ChatView.logic, ThreadTerminalDrawer (+ stylesheet), terminal-links, editorLabels, Sidebar.logic, openPullRequestLink, imageCompression, versionSkew, threadSidebarWidth; mobile branding, markdownLinks, threadListV2, connection, linkEnvironment; contracts environment/settings; build-desktop-artifact, sign-macos, upstream-sync-workflow parity.
• Typecheck: @t3tools/contracts, @t3tools/web, t3, @t3tools/scripts, @t3tools/mobile — all clean.
• Format / lint: vp fmt --check over all 203 changed files, vp lint --report-unused-disable-directives over the 44 changed directories — clean, warnings only and all pre-existing.
• Install: pnpm install --frozen-lockfile succeeds, confirming the resolved lockfile matches the merged workspace and every package.json.
• Mobile static analysis: scripts/mobile-native-static-check.ts exits 0 (swiftlint/ktlint/detekt unavailable in this container, as on any non-macOS host).

Not verified here: live browser and simulator runs, and the four required CI checks — those run on this PR.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.2 KiB	−173 B (−1.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−174 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.5 KiB	+514 B (+0.9%)	66.4 KiB	✅
Codex	Live turn messages	16	9	−7 (−43.8%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−252 B (−1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+17 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.3 KiB	−269 B (−4.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−308 B (−0.5%)	66.4 KiB	✅
Claude	Live turn messages	16	9	−7 (−43.8%)	21	✅

Baseline: 133f3f7 · PR result: f08c879 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Daily upstream sync: merges pingdotgg/t3code@f6f2be32 (41 commits since f035a0f4, through upstream v0.0.35) into main as a normal two-parent merge. Fourteen conflicts, each resolved by hand so both intents survive — no whole-file ours/theirs, no force push, reset, restore, stash, or clean.

Conflict decisions

Path	Decision
apps/server/src/persistence/Migrations.ts	Upstream's new 042/043 renamed to Marcode's next free ids 043/044. Marcode's ProjectWorkspaceLayout owns 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Migrations.test.ts (the pin that fails loudly on every sync) and the migration's own test extended to match.
apps/server/src/cloud/bootService.ts (+ test)	Took upstream's launchd PATH export (pingdotgg#8173, keeps provider CLIs reachable from the macOS service) and kept Marcode's MARCODE_HOME key. The launcher reads MARCODE_HOME and exits without it, so exporting upstream's T3CODE_HOME would ship a service that never boots. Both assertions kept.
packages/contracts/src/environment.ts, ServerEnvironment.ts (+ test)	Kept both capability flags — Marcode's workspaceLayoutMutations and upstream's new threadPullRequestLinking. Additive on both sides.
apps/web/src/components/ChatMarkdown.tsx	Took upstream's expanded editorPreferences/editorLabels imports and the whole markdown file-link rework; kept Marcode's openFileInFloatingEditor seam and workspacePath prop. Dropped useRightPanelStore and useActiveEnvironmentId, whose only consumers upstream replaced.
apps/web/src/components/ChatView.tsx	Kept Marcode's title-only ChatHeader and single panelLayoutControls mount; took upstream's settleThread. Upstream's new project-scoped openProjectPullRequest has no consumer here — ThreadActionsCluster already wires the more capable openThreadPullRequest — so it is dropped with a seam comment naming where new entry points belong.
apps/web/src/components/chat/OpenInPicker.tsx	Took upstream's editorLabelForPlatform refactor (which preserves Finder/Explorer/Files) and kept Marcode's FolderOpenFilled icon.
apps/web/src/components/ThreadTerminalDrawer.tsx	Kept Marcode's xterm link provider. Upstream's pingdotgg#7488 swapped an inline regex for isTerminalUrl; Marcode already classifies through extractTerminalLinks, whose URL_PATTERN is the same https?:// test, so the fix is already present in this path. Recorded as a seam so the divergence is re-ported deliberately each sync.
apps/mobile/src/lib/mobileBranding.test.ts	Upstream deleted it as low-signal (pingdotgg#8397). Kept — it pins Marcode's empty stable-channel stage label against upstream's "Alpha". Annotated so the next sync knows why it survives an upstream deletion.
apps/web/src/components/threadSidebarWidth.test.ts	Upstream deleted it as trivial (pingdotgg#8400). Kept — it carries the sidebar brand-removal pin, which has no other home. Followed upstream in un-exporting THREAD_SIDEBAR_DEFAULT_WIDTH rather than re-exporting it for the test, and re-expressed that one assertion against the minimum.
scripts/build-desktop-artifact.test.ts	Kept Marcode's provisioning-profile fixture; took upstream's MAC_FILE_EXCLUSIONS import and the new mac.sign assertion from the signing rework (pingdotgg#8093).
pnpm-lock.yaml	Kept Marcode's @xterm/* entries; the Clerk bumps merged cleanly. pnpm install --frozen-lockfile passes against the merged workspace.

Fork-boundary breaks that merged cleanly (no conflict)

These are the dangerous ones — they produce no mark and then quietly do not work:

• apps/server/src/process/externalLauncher.test.ts carried an upstream oxlint-disable for t3code/no-global-process-runtime. Marcode's plugin namespace is marcode/, so the directive would have been unknown and tripped --report-unused-disable-directives. Renamed.
• .github/workflows/desktop-macos-preview.yml (new, feat(desktop): build macOS previews from a PR label pingdotgg/t3code#8182/feat(ci): download macOS preview DMGs without signing in pingdotgg/t3code#8243) ran on Blacksmith runners the public fork cannot reach, which queue forever rather than failing. Pinned to ubuntu-24.04/macos-26 with the same comment convention ci.yml already uses. The workflow is opt-in behind a preview:mac label and is not a required check — say the word if you would rather leave it upstream-shaped.
• apps/server/src/provider/ModelManifest.ts fetches upstream's hosted model manifest (feat(server): fetch legacy model classification from a hosted manifest pingdotgg/t3code#8227). Kept pointed at pingdotgg/t3codedeliberately: model classification is upstream-owned with no Marcode divergence, and the fork's own main would only refresh on a sync — losing the point of hosting it. Same precedent as the triage playbook URL. Recorded in a seam comment.

Swept T3CODE_*, t3code.service, WORKTREE_BRANCH_PREFIX, and boot-service naming across the merged tree; every other hit is an intentional compatibility identifier (T3_BOOT_SERVICE_UNIT, com.t3tools.t3code.service, t3code:* storage keys, @t3tools/*, the t3 package name) and is left upstream-shaped.

Coupled subtrees

pnpm-workspace.yaml moved only Clerk versions. The effect and alchemy catalog entries are unchanged, so neither .repos/effect-smol nor .repos/alchemy-effect needs a sync in this change.

Deleted tests

Upstream pruned 13 test files (pingdotgg#8397, pingdotgg#8400). Each was checked against the previous merge base and carried no Marcode edits, so all 13 deletions are accepted. The two that did carry Marcode behavior are kept and annotated (above).

Why

Marcode is a maintained fork. Upstream correctness, security, protocol, dependency, and operational fixes have to land, while Marcode's intentional product behavior — the floating editor, the unified workspace tree, FloatingPillNav, branding, and the migration id offset — has to survive them. Hotspot paths are mandatory-review paths, not automatic keep-Marcode paths, so the upstream launchd PATH fix, the editorLabelForPlatform refactor, and the mac.sign assertion were all taken even though they landed in customized files.

Where Marcode keeps a divergent implementation of an upstream subsystem, the divergence is now marked with a ── Marcode fork seam ── comment saying what it mounts and why, so the next person resolving that conflict knows instantly whether a hunk is theirs, ours, or a join.

UI Changes

None. Every web change in this merge is upstream's own; Marcode's user-visible surfaces (ChatHeader, OpenInPicker icon, panel layout controls, terminal link behavior) are preserved unchanged by the resolutions above. No live client verification was run in this container — it has no display or simulator — so if you want the chat markdown file-link rework driven in a real browser before this goes ready, that is the one thing left.

Checklist

• This PR is small and focused — one concern: the upstream sync
• I explained what changed and why
• I included before/after screenshots for any UI changes — n/a, no Marcode UI change
• I included a video for animation/interaction changes — n/a

Verification

Focused only on what the merge touched; CI owns the full suite.

• Tests (all passing): server boot service, ServerEnvironment, serviceLauncher, migrations 033/042/043 + the Migrations.test.ts pin, externalLauncher, GitVcsDriverCore, ProviderRegistry, ProjectionSnapshotQuery, serverSettings; web ChatMarkdown (×2), ChatView.logic, ThreadTerminalDrawer (+ stylesheet), terminal-links, editorLabels, Sidebar.logic, openPullRequestLink, imageCompression, versionSkew, threadSidebarWidth; mobile branding, markdownLinks, threadListV2, connection, linkEnvironment; contracts environment/settings; build-desktop-artifact, sign-macos, upstream-sync-workflow parity.
• Typecheck: @t3tools/contracts, @t3tools/web, t3, @t3tools/scripts, @t3tools/mobile — all clean.
• Format / lint: vp fmt --check over all 203 changed files, vp lint --report-unused-disable-directives over the 44 changed directories — clean, warnings only and all pre-existing.
• Install: pnpm install --frozen-lockfile succeeds, confirming the resolved lockfile matches the merged workspace and every package.json.
• Mobile static analysis: scripts/mobile-native-static-check.ts exits 0 (swiftlint/ktlint/detekt unavailable in this container, as on any non-macOS host).

Not verified here: live browser and simulator runs, and the four required CI checks — those run on this PR.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.2 KiB	−173 B (−1.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−174 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.5 KiB	+514 B (+0.9%)	66.4 KiB	✅
Codex	Live turn messages	16	9	−7 (−43.8%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−252 B (−1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+17 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.3 KiB	−269 B (−4.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−308 B (−0.5%)	66.4 KiB	✅
Claude	Live turn messages	16	9	−7 (−43.8%)	21	✅

Baseline: 133f3f7 · PR result: f08c879 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Daily upstream sync: merges pingdotgg/t3code@f6f2be32 (41 commits since f035a0f4, through upstream v0.0.35) into main as a normal two-parent merge. Fourteen conflicts, each resolved by hand so both intents survive — no whole-file ours/theirs, no force push, reset, restore, stash, or clean.

Conflict decisions

Path	Decision
apps/server/src/persistence/Migrations.ts	Upstream's new 042/043 renamed to Marcode's next free ids 043/044. Marcode's ProjectWorkspaceLayout owns 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Migrations.test.ts (the pin that fails loudly on every sync) and the migration's own test extended to match.
apps/server/src/cloud/bootService.ts (+ test)	Took upstream's launchd PATH export (pingdotgg#8173, keeps provider CLIs reachable from the macOS service) and kept Marcode's MARCODE_HOME key. The launcher reads MARCODE_HOME and exits without it, so exporting upstream's T3CODE_HOME would ship a service that never boots. Both assertions kept.
packages/contracts/src/environment.ts, ServerEnvironment.ts (+ test)	Kept both capability flags — Marcode's workspaceLayoutMutations and upstream's new threadPullRequestLinking. Additive on both sides.
apps/web/src/components/ChatMarkdown.tsx	Took upstream's expanded editorPreferences/editorLabels imports and the whole markdown file-link rework; kept Marcode's openFileInFloatingEditor seam and workspacePath prop. Dropped useRightPanelStore and useActiveEnvironmentId, whose only consumers upstream replaced.
apps/web/src/components/ChatView.tsx	Kept Marcode's title-only ChatHeader and single panelLayoutControls mount; took upstream's settleThread. Upstream's new project-scoped openProjectPullRequest has no consumer here — ThreadActionsCluster already wires the more capable openThreadPullRequest — so it is dropped with a seam comment naming where new entry points belong.
apps/web/src/components/chat/OpenInPicker.tsx	Took upstream's editorLabelForPlatform refactor (which preserves Finder/Explorer/Files) and kept Marcode's FolderOpenFilled icon.
apps/web/src/components/ThreadTerminalDrawer.tsx	Kept Marcode's xterm link provider. Upstream's pingdotgg#7488 swapped an inline regex for isTerminalUrl; Marcode already classifies through extractTerminalLinks, whose URL_PATTERN is the same https?:// test, so the fix is already present in this path. Recorded as a seam so the divergence is re-ported deliberately each sync.
apps/mobile/src/lib/mobileBranding.test.ts	Upstream deleted it as low-signal (pingdotgg#8397). Kept — it pins Marcode's empty stable-channel stage label against upstream's "Alpha". Annotated so the next sync knows why it survives an upstream deletion.
apps/web/src/components/threadSidebarWidth.test.ts	Upstream deleted it as trivial (pingdotgg#8400). Kept — it carries the sidebar brand-removal pin, which has no other home. Followed upstream in un-exporting THREAD_SIDEBAR_DEFAULT_WIDTH rather than re-exporting it for the test, and re-expressed that one assertion against the minimum.
scripts/build-desktop-artifact.test.ts	Kept Marcode's provisioning-profile fixture; took upstream's MAC_FILE_EXCLUSIONS import and the new mac.sign assertion from the signing rework (pingdotgg#8093).
pnpm-lock.yaml	Kept Marcode's @xterm/* entries; the Clerk bumps merged cleanly. pnpm install --frozen-lockfile passes against the merged workspace.

Fork-boundary breaks that merged cleanly (no conflict)

These are the dangerous ones — they produce no mark and then quietly do not work:

• apps/server/src/process/externalLauncher.test.ts carried an upstream oxlint-disable for t3code/no-global-process-runtime. Marcode's plugin namespace is marcode/, so the directive would have been unknown and tripped --report-unused-disable-directives. Renamed.
• .github/workflows/desktop-macos-preview.yml (new, feat(desktop): build macOS previews from a PR label pingdotgg/t3code#8182/feat(ci): download macOS preview DMGs without signing in pingdotgg/t3code#8243) ran on Blacksmith runners the public fork cannot reach, which queue forever rather than failing. Pinned to ubuntu-24.04/macos-26 with the same comment convention ci.yml already uses. The workflow is opt-in behind a preview:mac label and is not a required check — say the word if you would rather leave it upstream-shaped.
• apps/server/src/provider/ModelManifest.ts fetches upstream's hosted model manifest (feat(server): fetch legacy model classification from a hosted manifest pingdotgg/t3code#8227). Kept pointed at pingdotgg/t3codedeliberately: model classification is upstream-owned with no Marcode divergence, and the fork's own main would only refresh on a sync — losing the point of hosting it. Same precedent as the triage playbook URL. Recorded in a seam comment.

Swept T3CODE_*, t3code.service, WORKTREE_BRANCH_PREFIX, and boot-service naming across the merged tree; every other hit is an intentional compatibility identifier (T3_BOOT_SERVICE_UNIT, com.t3tools.t3code.service, t3code:* storage keys, @t3tools/*, the t3 package name) and is left upstream-shaped.

Coupled subtrees

pnpm-workspace.yaml moved only Clerk versions. The effect and alchemy catalog entries are unchanged, so neither .repos/effect-smol nor .repos/alchemy-effect needs a sync in this change.

Deleted tests

Upstream pruned 13 test files (pingdotgg#8397, pingdotgg#8400). Each was checked against the previous merge base and carried no Marcode edits, so all 13 deletions are accepted. The two that did carry Marcode behavior are kept and annotated (above).

Why

Marcode is a maintained fork. Upstream correctness, security, protocol, dependency, and operational fixes have to land, while Marcode's intentional product behavior — the floating editor, the unified workspace tree, FloatingPillNav, branding, and the migration id offset — has to survive them. Hotspot paths are mandatory-review paths, not automatic keep-Marcode paths, so the upstream launchd PATH fix, the editorLabelForPlatform refactor, and the mac.sign assertion were all taken even though they landed in customized files.

Where Marcode keeps a divergent implementation of an upstream subsystem, the divergence is now marked with a ── Marcode fork seam ── comment saying what it mounts and why, so the next person resolving that conflict knows instantly whether a hunk is theirs, ours, or a join.

UI Changes

None. Every web change in this merge is upstream's own; Marcode's user-visible surfaces (ChatHeader, OpenInPicker icon, panel layout controls, terminal link behavior) are preserved unchanged by the resolutions above. No live client verification was run in this container — it has no display or simulator — so if you want the chat markdown file-link rework driven in a real browser before this goes ready, that is the one thing left.

Checklist

• This PR is small and focused — one concern: the upstream sync
• I explained what changed and why
• I included before/after screenshots for any UI changes — n/a, no Marcode UI change
• I included a video for animation/interaction changes — n/a

Verification

Focused only on what the merge touched; CI owns the full suite.

• Tests (all passing): server boot service, ServerEnvironment, serviceLauncher, migrations 033/042/043 + the Migrations.test.ts pin, externalLauncher, GitVcsDriverCore, ProviderRegistry, ProjectionSnapshotQuery, serverSettings; web ChatMarkdown (×2), ChatView.logic, ThreadTerminalDrawer (+ stylesheet), terminal-links, editorLabels, Sidebar.logic, openPullRequestLink, imageCompression, versionSkew, threadSidebarWidth; mobile branding, markdownLinks, threadListV2, connection, linkEnvironment; contracts environment/settings; build-desktop-artifact, sign-macos, upstream-sync-workflow parity.
• Typecheck: @t3tools/contracts, @t3tools/web, t3, @t3tools/scripts, @t3tools/mobile — all clean.
• Format / lint: vp fmt --check over all 203 changed files, vp lint --report-unused-disable-directives over the 44 changed directories — clean, warnings only and all pre-existing.
• Install: pnpm install --frozen-lockfile succeeds, confirming the resolved lockfile matches the merged workspace and every package.json.
• Mobile static analysis: scripts/mobile-native-static-check.ts exits 0 (swiftlint/ktlint/detekt unavailable in this container, as on any non-macOS host).

Not verified here: live browser and simulator runs, and the four required CI checks — those run on this PR.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.2 KiB	−173 B (−1.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−174 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.5 KiB	+514 B (+0.9%)	66.4 KiB	✅
Codex	Live turn messages	16	9	−7 (−43.8%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−252 B (−1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+17 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.3 KiB	−269 B (−4.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−308 B (−0.5%)	66.4 KiB	✅
Claude	Live turn messages	16	9	−7 (−43.8%)	21	✅

Baseline: 133f3f7 · PR result: f08c879 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Daily upstream sync: merges pingdotgg/t3code@f6f2be32 (41 commits since f035a0f4, through upstream v0.0.35) into main as a normal two-parent merge. Fourteen conflicts, each resolved by hand so both intents survive — no whole-file ours/theirs, no force push, reset, restore, stash, or clean.

Conflict decisions

Path	Decision
apps/server/src/persistence/Migrations.ts	Upstream's new 042/043 renamed to Marcode's next free ids 043/044. Marcode's ProjectWorkspaceLayout owns 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Migrations.test.ts (the pin that fails loudly on every sync) and the migration's own test extended to match.
apps/server/src/cloud/bootService.ts (+ test)	Took upstream's launchd PATH export (pingdotgg#8173, keeps provider CLIs reachable from the macOS service) and kept Marcode's MARCODE_HOME key. The launcher reads MARCODE_HOME and exits without it, so exporting upstream's T3CODE_HOME would ship a service that never boots. Both assertions kept.
packages/contracts/src/environment.ts, ServerEnvironment.ts (+ test)	Kept both capability flags — Marcode's workspaceLayoutMutations and upstream's new threadPullRequestLinking. Additive on both sides.
apps/web/src/components/ChatMarkdown.tsx	Took upstream's expanded editorPreferences/editorLabels imports and the whole markdown file-link rework; kept Marcode's openFileInFloatingEditor seam and workspacePath prop. Dropped useRightPanelStore and useActiveEnvironmentId, whose only consumers upstream replaced.
apps/web/src/components/ChatView.tsx	Kept Marcode's title-only ChatHeader and single panelLayoutControls mount; took upstream's settleThread. Upstream's new project-scoped openProjectPullRequest has no consumer here — ThreadActionsCluster already wires the more capable openThreadPullRequest — so it is dropped with a seam comment naming where new entry points belong.
apps/web/src/components/chat/OpenInPicker.tsx	Took upstream's editorLabelForPlatform refactor (which preserves Finder/Explorer/Files) and kept Marcode's FolderOpenFilled icon.
apps/web/src/components/ThreadTerminalDrawer.tsx	Kept Marcode's xterm link provider. Upstream's pingdotgg#7488 swapped an inline regex for isTerminalUrl; Marcode already classifies through extractTerminalLinks, whose URL_PATTERN is the same https?:// test, so the fix is already present in this path. Recorded as a seam so the divergence is re-ported deliberately each sync.
apps/mobile/src/lib/mobileBranding.test.ts	Upstream deleted it as low-signal (pingdotgg#8397). Kept — it pins Marcode's empty stable-channel stage label against upstream's "Alpha". Annotated so the next sync knows why it survives an upstream deletion.
apps/web/src/components/threadSidebarWidth.test.ts	Upstream deleted it as trivial (pingdotgg#8400). Kept — it carries the sidebar brand-removal pin, which has no other home. Followed upstream in un-exporting THREAD_SIDEBAR_DEFAULT_WIDTH rather than re-exporting it for the test, and re-expressed that one assertion against the minimum.
scripts/build-desktop-artifact.test.ts	Kept Marcode's provisioning-profile fixture; took upstream's MAC_FILE_EXCLUSIONS import and the new mac.sign assertion from the signing rework (pingdotgg#8093).
pnpm-lock.yaml	Kept Marcode's @xterm/* entries; the Clerk bumps merged cleanly. pnpm install --frozen-lockfile passes against the merged workspace.

Fork-boundary breaks that merged cleanly (no conflict)

These are the dangerous ones — they produce no mark and then quietly do not work:

• apps/server/src/process/externalLauncher.test.ts carried an upstream oxlint-disable for t3code/no-global-process-runtime. Marcode's plugin namespace is marcode/, so the directive would have been unknown and tripped --report-unused-disable-directives. Renamed.
• .github/workflows/desktop-macos-preview.yml (new, feat(desktop): build macOS previews from a PR label pingdotgg/t3code#8182/feat(ci): download macOS preview DMGs without signing in pingdotgg/t3code#8243) ran on Blacksmith runners the public fork cannot reach, which queue forever rather than failing. Pinned to ubuntu-24.04/macos-26 with the same comment convention ci.yml already uses. The workflow is opt-in behind a preview:mac label and is not a required check — say the word if you would rather leave it upstream-shaped.
• apps/server/src/provider/ModelManifest.ts fetches upstream's hosted model manifest (feat(server): fetch legacy model classification from a hosted manifest pingdotgg/t3code#8227). Kept pointed at pingdotgg/t3codedeliberately: model classification is upstream-owned with no Marcode divergence, and the fork's own main would only refresh on a sync — losing the point of hosting it. Same precedent as the triage playbook URL. Recorded in a seam comment.

Swept T3CODE_*, t3code.service, WORKTREE_BRANCH_PREFIX, and boot-service naming across the merged tree; every other hit is an intentional compatibility identifier (T3_BOOT_SERVICE_UNIT, com.t3tools.t3code.service, t3code:* storage keys, @t3tools/*, the t3 package name) and is left upstream-shaped.

Coupled subtrees

pnpm-workspace.yaml moved only Clerk versions. The effect and alchemy catalog entries are unchanged, so neither .repos/effect-smol nor .repos/alchemy-effect needs a sync in this change.

Deleted tests

Upstream pruned 13 test files (pingdotgg#8397, pingdotgg#8400). Each was checked against the previous merge base and carried no Marcode edits, so all 13 deletions are accepted. The two that did carry Marcode behavior are kept and annotated (above).

Why

Marcode is a maintained fork. Upstream correctness, security, protocol, dependency, and operational fixes have to land, while Marcode's intentional product behavior — the floating editor, the unified workspace tree, FloatingPillNav, branding, and the migration id offset — has to survive them. Hotspot paths are mandatory-review paths, not automatic keep-Marcode paths, so the upstream launchd PATH fix, the editorLabelForPlatform refactor, and the mac.sign assertion were all taken even though they landed in customized files.

Where Marcode keeps a divergent implementation of an upstream subsystem, the divergence is now marked with a ── Marcode fork seam ── comment saying what it mounts and why, so the next person resolving that conflict knows instantly whether a hunk is theirs, ours, or a join.

UI Changes

None. Every web change in this merge is upstream's own; Marcode's user-visible surfaces (ChatHeader, OpenInPicker icon, panel layout controls, terminal link behavior) are preserved unchanged by the resolutions above. No live client verification was run in this container — it has no display or simulator — so if you want the chat markdown file-link rework driven in a real browser before this goes ready, that is the one thing left.

Checklist

• This PR is small and focused — one concern: the upstream sync
• I explained what changed and why
• I included before/after screenshots for any UI changes — n/a, no Marcode UI change
• I included a video for animation/interaction changes — n/a

Verification

Focused only on what the merge touched; CI owns the full suite.

• Tests (all passing): server boot service, ServerEnvironment, serviceLauncher, migrations 033/042/043 + the Migrations.test.ts pin, externalLauncher, GitVcsDriverCore, ProviderRegistry, ProjectionSnapshotQuery, serverSettings; web ChatMarkdown (×2), ChatView.logic, ThreadTerminalDrawer (+ stylesheet), terminal-links, editorLabels, Sidebar.logic, openPullRequestLink, imageCompression, versionSkew, threadSidebarWidth; mobile branding, markdownLinks, threadListV2, connection, linkEnvironment; contracts environment/settings; build-desktop-artifact, sign-macos, upstream-sync-workflow parity.
• Typecheck: @t3tools/contracts, @t3tools/web, t3, @t3tools/scripts, @t3tools/mobile — all clean.
• Format / lint: vp fmt --check over all 203 changed files, vp lint --report-unused-disable-directives over the 44 changed directories — clean, warnings only and all pre-existing.
• Install: pnpm install --frozen-lockfile succeeds, confirming the resolved lockfile matches the merged workspace and every package.json.
• Mobile static analysis: scripts/mobile-native-static-check.ts exits 0 (swiftlint/ktlint/detekt unavailable in this container, as on any non-macOS host).

Not verified here: live browser and simulator runs, and the four required CI checks — those run on this PR.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.2 KiB	−173 B (−1.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−174 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.5 KiB	+514 B (+0.9%)	66.4 KiB	✅
Codex	Live turn messages	16	9	−7 (−43.8%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−252 B (−1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+17 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.3 KiB	−269 B (−4.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−308 B (−0.5%)	66.4 KiB	✅
Claude	Live turn messages	16	9	−7 (−43.8%)	21	✅

Baseline: 133f3f7 · PR result: f08c879 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Daily upstream sync: merges pingdotgg/t3code@f6f2be32 (41 commits since f035a0f4, through upstream v0.0.35) into main as a normal two-parent merge. Fourteen conflicts, each resolved by hand so both intents survive — no whole-file ours/theirs, no force push, reset, restore, stash, or clean.

Conflict decisions

Path	Decision
apps/server/src/persistence/Migrations.ts	Upstream's new 042/043 renamed to Marcode's next free ids 043/044. Marcode's ProjectWorkspaceLayout owns 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Migrations.test.ts (the pin that fails loudly on every sync) and the migration's own test extended to match.
apps/server/src/cloud/bootService.ts (+ test)	Took upstream's launchd PATH export (pingdotgg#8173, keeps provider CLIs reachable from the macOS service) and kept Marcode's MARCODE_HOME key. The launcher reads MARCODE_HOME and exits without it, so exporting upstream's T3CODE_HOME would ship a service that never boots. Both assertions kept.
packages/contracts/src/environment.ts, ServerEnvironment.ts (+ test)	Kept both capability flags — Marcode's workspaceLayoutMutations and upstream's new threadPullRequestLinking. Additive on both sides.
apps/web/src/components/ChatMarkdown.tsx	Took upstream's expanded editorPreferences/editorLabels imports and the whole markdown file-link rework; kept Marcode's openFileInFloatingEditor seam and workspacePath prop. Dropped useRightPanelStore and useActiveEnvironmentId, whose only consumers upstream replaced.
apps/web/src/components/ChatView.tsx	Kept Marcode's title-only ChatHeader and single panelLayoutControls mount; took upstream's settleThread. Upstream's new project-scoped openProjectPullRequest has no consumer here — ThreadActionsCluster already wires the more capable openThreadPullRequest — so it is dropped with a seam comment naming where new entry points belong.
apps/web/src/components/chat/OpenInPicker.tsx	Took upstream's editorLabelForPlatform refactor (which preserves Finder/Explorer/Files) and kept Marcode's FolderOpenFilled icon.
apps/web/src/components/ThreadTerminalDrawer.tsx	Kept Marcode's xterm link provider. Upstream's pingdotgg#7488 swapped an inline regex for isTerminalUrl; Marcode already classifies through extractTerminalLinks, whose URL_PATTERN is the same https?:// test, so the fix is already present in this path. Recorded as a seam so the divergence is re-ported deliberately each sync.
apps/mobile/src/lib/mobileBranding.test.ts	Upstream deleted it as low-signal (pingdotgg#8397). Kept — it pins Marcode's empty stable-channel stage label against upstream's "Alpha". Annotated so the next sync knows why it survives an upstream deletion.
apps/web/src/components/threadSidebarWidth.test.ts	Upstream deleted it as trivial (pingdotgg#8400). Kept — it carries the sidebar brand-removal pin, which has no other home. Followed upstream in un-exporting THREAD_SIDEBAR_DEFAULT_WIDTH rather than re-exporting it for the test, and re-expressed that one assertion against the minimum.
scripts/build-desktop-artifact.test.ts	Kept Marcode's provisioning-profile fixture; took upstream's MAC_FILE_EXCLUSIONS import and the new mac.sign assertion from the signing rework (pingdotgg#8093).
pnpm-lock.yaml	Kept Marcode's @xterm/* entries; the Clerk bumps merged cleanly. pnpm install --frozen-lockfile passes against the merged workspace.

Fork-boundary breaks that merged cleanly (no conflict)

These are the dangerous ones — they produce no mark and then quietly do not work:

• apps/server/src/process/externalLauncher.test.ts carried an upstream oxlint-disable for t3code/no-global-process-runtime. Marcode's plugin namespace is marcode/, so the directive would have been unknown and tripped --report-unused-disable-directives. Renamed.
• .github/workflows/desktop-macos-preview.yml (new, feat(desktop): build macOS previews from a PR label pingdotgg/t3code#8182/feat(ci): download macOS preview DMGs without signing in pingdotgg/t3code#8243) ran on Blacksmith runners the public fork cannot reach, which queue forever rather than failing. Pinned to ubuntu-24.04/macos-26 with the same comment convention ci.yml already uses. The workflow is opt-in behind a preview:mac label and is not a required check — say the word if you would rather leave it upstream-shaped.
• apps/server/src/provider/ModelManifest.ts fetches upstream's hosted model manifest (feat(server): fetch legacy model classification from a hosted manifest pingdotgg/t3code#8227). Kept pointed at pingdotgg/t3codedeliberately: model classification is upstream-owned with no Marcode divergence, and the fork's own main would only refresh on a sync — losing the point of hosting it. Same precedent as the triage playbook URL. Recorded in a seam comment.

Swept T3CODE_*, t3code.service, WORKTREE_BRANCH_PREFIX, and boot-service naming across the merged tree; every other hit is an intentional compatibility identifier (T3_BOOT_SERVICE_UNIT, com.t3tools.t3code.service, t3code:* storage keys, @t3tools/*, the t3 package name) and is left upstream-shaped.

Coupled subtrees

pnpm-workspace.yaml moved only Clerk versions. The effect and alchemy catalog entries are unchanged, so neither .repos/effect-smol nor .repos/alchemy-effect needs a sync in this change.

Deleted tests

Upstream pruned 13 test files (pingdotgg#8397, pingdotgg#8400). Each was checked against the previous merge base and carried no Marcode edits, so all 13 deletions are accepted. The two that did carry Marcode behavior are kept and annotated (above).

Why

Marcode is a maintained fork. Upstream correctness, security, protocol, dependency, and operational fixes have to land, while Marcode's intentional product behavior — the floating editor, the unified workspace tree, FloatingPillNav, branding, and the migration id offset — has to survive them. Hotspot paths are mandatory-review paths, not automatic keep-Marcode paths, so the upstream launchd PATH fix, the editorLabelForPlatform refactor, and the mac.sign assertion were all taken even though they landed in customized files.

Where Marcode keeps a divergent implementation of an upstream subsystem, the divergence is now marked with a ── Marcode fork seam ── comment saying what it mounts and why, so the next person resolving that conflict knows instantly whether a hunk is theirs, ours, or a join.

UI Changes

None. Every web change in this merge is upstream's own; Marcode's user-visible surfaces (ChatHeader, OpenInPicker icon, panel layout controls, terminal link behavior) are preserved unchanged by the resolutions above. No live client verification was run in this container — it has no display or simulator — so if you want the chat markdown file-link rework driven in a real browser before this goes ready, that is the one thing left.

Checklist

• This PR is small and focused — one concern: the upstream sync
• I explained what changed and why
• I included before/after screenshots for any UI changes — n/a, no Marcode UI change
• I included a video for animation/interaction changes — n/a

Verification

Focused only on what the merge touched; CI owns the full suite.

• Tests (all passing): server boot service, ServerEnvironment, serviceLauncher, migrations 033/042/043 + the Migrations.test.ts pin, externalLauncher, GitVcsDriverCore, ProviderRegistry, ProjectionSnapshotQuery, serverSettings; web ChatMarkdown (×2), ChatView.logic, ThreadTerminalDrawer (+ stylesheet), terminal-links, editorLabels, Sidebar.logic, openPullRequestLink, imageCompression, versionSkew, threadSidebarWidth; mobile branding, markdownLinks, threadListV2, connection, linkEnvironment; contracts environment/settings; build-desktop-artifact, sign-macos, upstream-sync-workflow parity.
• Typecheck: @t3tools/contracts, @t3tools/web, t3, @t3tools/scripts, @t3tools/mobile — all clean.
• Format / lint: vp fmt --check over all 203 changed files, vp lint --report-unused-disable-directives over the 44 changed directories — clean, warnings only and all pre-existing.
• Install: pnpm install --frozen-lockfile succeeds, confirming the resolved lockfile matches the merged workspace and every package.json.
• Mobile static analysis: scripts/mobile-native-static-check.ts exits 0 (swiftlint/ktlint/detekt unavailable in this container, as on any non-macOS host).

Not verified here: live browser and simulator runs, and the four required CI checks — those run on this PR.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.2 KiB	−173 B (−1.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−174 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.5 KiB	+514 B (+0.9%)	66.4 KiB	✅
Codex	Live turn messages	16	9	−7 (−43.8%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−252 B (−1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+17 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.3 KiB	−269 B (−4.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−308 B (−0.5%)	66.4 KiB	✅
Claude	Live turn messages	16	9	−7 (−43.8%)	21	✅

Baseline: 133f3f7 · PR result: f08c879 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

What Changed

Daily upstream sync: merges pingdotgg/t3code@f6f2be32 (41 commits since f035a0f4, through upstream v0.0.35) into main as a normal two-parent merge. Fourteen conflicts, each resolved by hand so both intents survive — no whole-file ours/theirs, no force push, reset, restore, stash, or clean.

Conflict decisions

Path	Decision
apps/server/src/persistence/Migrations.ts	Upstream's new 042/043 renamed to Marcode's next free ids 043/044. Marcode's ProjectWorkspaceLayout owns 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on existing installs. Migrations.test.ts (the pin that fails loudly on every sync) and the migration's own test extended to match.
apps/server/src/cloud/bootService.ts (+ test)	Took upstream's launchd PATH export (pingdotgg#8173, keeps provider CLIs reachable from the macOS service) and kept Marcode's MARCODE_HOME key. The launcher reads MARCODE_HOME and exits without it, so exporting upstream's T3CODE_HOME would ship a service that never boots. Both assertions kept.
packages/contracts/src/environment.ts, ServerEnvironment.ts (+ test)	Kept both capability flags — Marcode's workspaceLayoutMutations and upstream's new threadPullRequestLinking. Additive on both sides.
apps/web/src/components/ChatMarkdown.tsx	Took upstream's expanded editorPreferences/editorLabels imports and the whole markdown file-link rework; kept Marcode's openFileInFloatingEditor seam and workspacePath prop. Dropped useRightPanelStore and useActiveEnvironmentId, whose only consumers upstream replaced.
apps/web/src/components/ChatView.tsx	Kept Marcode's title-only ChatHeader and single panelLayoutControls mount; took upstream's settleThread. Upstream's new project-scoped openProjectPullRequest has no consumer here — ThreadActionsCluster already wires the more capable openThreadPullRequest — so it is dropped with a seam comment naming where new entry points belong.
apps/web/src/components/chat/OpenInPicker.tsx	Took upstream's editorLabelForPlatform refactor (which preserves Finder/Explorer/Files) and kept Marcode's FolderOpenFilled icon.
apps/web/src/components/ThreadTerminalDrawer.tsx	Kept Marcode's xterm link provider. Upstream's pingdotgg#7488 swapped an inline regex for isTerminalUrl; Marcode already classifies through extractTerminalLinks, whose URL_PATTERN is the same https?:// test, so the fix is already present in this path. Recorded as a seam so the divergence is re-ported deliberately each sync.
apps/mobile/src/lib/mobileBranding.test.ts	Upstream deleted it as low-signal (pingdotgg#8397). Kept — it pins Marcode's empty stable-channel stage label against upstream's "Alpha". Annotated so the next sync knows why it survives an upstream deletion.
apps/web/src/components/threadSidebarWidth.test.ts	Upstream deleted it as trivial (pingdotgg#8400). Kept — it carries the sidebar brand-removal pin, which has no other home. Followed upstream in un-exporting THREAD_SIDEBAR_DEFAULT_WIDTH rather than re-exporting it for the test, and re-expressed that one assertion against the minimum.
scripts/build-desktop-artifact.test.ts	Kept Marcode's provisioning-profile fixture; took upstream's MAC_FILE_EXCLUSIONS import and the new mac.sign assertion from the signing rework (pingdotgg#8093).
pnpm-lock.yaml	Kept Marcode's @xterm/* entries; the Clerk bumps merged cleanly. pnpm install --frozen-lockfile passes against the merged workspace.

Fork-boundary breaks that merged cleanly (no conflict)

These are the dangerous ones — they produce no mark and then quietly do not work:

• apps/server/src/process/externalLauncher.test.ts carried an upstream oxlint-disable for t3code/no-global-process-runtime. Marcode's plugin namespace is marcode/, so the directive would have been unknown and tripped --report-unused-disable-directives. Renamed.
• .github/workflows/desktop-macos-preview.yml (new, feat(desktop): build macOS previews from a PR label pingdotgg/t3code#8182/feat(ci): download macOS preview DMGs without signing in pingdotgg/t3code#8243) ran on Blacksmith runners the public fork cannot reach, which queue forever rather than failing. Pinned to ubuntu-24.04/macos-26 with the same comment convention ci.yml already uses. The workflow is opt-in behind a preview:mac label and is not a required check — say the word if you would rather leave it upstream-shaped.
• apps/server/src/provider/ModelManifest.ts fetches upstream's hosted model manifest (feat(server): fetch legacy model classification from a hosted manifest pingdotgg/t3code#8227). Kept pointed at pingdotgg/t3codedeliberately: model classification is upstream-owned with no Marcode divergence, and the fork's own main would only refresh on a sync — losing the point of hosting it. Same precedent as the triage playbook URL. Recorded in a seam comment.

Swept T3CODE_*, t3code.service, WORKTREE_BRANCH_PREFIX, and boot-service naming across the merged tree; every other hit is an intentional compatibility identifier (T3_BOOT_SERVICE_UNIT, com.t3tools.t3code.service, t3code:* storage keys, @t3tools/*, the t3 package name) and is left upstream-shaped.

Coupled subtrees

pnpm-workspace.yaml moved only Clerk versions. The effect and alchemy catalog entries are unchanged, so neither .repos/effect-smol nor .repos/alchemy-effect needs a sync in this change.

Deleted tests

Upstream pruned 13 test files (pingdotgg#8397, pingdotgg#8400). Each was checked against the previous merge base and carried no Marcode edits, so all 13 deletions are accepted. The two that did carry Marcode behavior are kept and annotated (above).

Why

Marcode is a maintained fork. Upstream correctness, security, protocol, dependency, and operational fixes have to land, while Marcode's intentional product behavior — the floating editor, the unified workspace tree, FloatingPillNav, branding, and the migration id offset — has to survive them. Hotspot paths are mandatory-review paths, not automatic keep-Marcode paths, so the upstream launchd PATH fix, the editorLabelForPlatform refactor, and the mac.sign assertion were all taken even though they landed in customized files.

Where Marcode keeps a divergent implementation of an upstream subsystem, the divergence is now marked with a ── Marcode fork seam ── comment saying what it mounts and why, so the next person resolving that conflict knows instantly whether a hunk is theirs, ours, or a join.

UI Changes

None. Every web change in this merge is upstream's own; Marcode's user-visible surfaces (ChatHeader, OpenInPicker icon, panel layout controls, terminal link behavior) are preserved unchanged by the resolutions above. No live client verification was run in this container — it has no display or simulator — so if you want the chat markdown file-link rework driven in a real browser before this goes ready, that is the one thing left.

Checklist

• This PR is small and focused — one concern: the upstream sync
• I explained what changed and why
• I included before/after screenshots for any UI changes — n/a, no Marcode UI change
• I included a video for animation/interaction changes — n/a

Verification

Focused only on what the merge touched; CI owns the full suite.

• Tests (all passing): server boot service, ServerEnvironment, serviceLauncher, migrations 033/042/043 + the Migrations.test.ts pin, externalLauncher, GitVcsDriverCore, ProviderRegistry, ProjectionSnapshotQuery, serverSettings; web ChatMarkdown (×2), ChatView.logic, ThreadTerminalDrawer (+ stylesheet), terminal-links, editorLabels, Sidebar.logic, openPullRequestLink, imageCompression, versionSkew, threadSidebarWidth; mobile branding, markdownLinks, threadListV2, connection, linkEnvironment; contracts environment/settings; build-desktop-artifact, sign-macos, upstream-sync-workflow parity.
• Typecheck: @t3tools/contracts, @t3tools/web, t3, @t3tools/scripts, @t3tools/mobile — all clean.
• Format / lint: vp fmt --check over all 203 changed files, vp lint --report-unused-disable-directives over the 44 changed directories — clean, warnings only and all pre-existing.
• Install: pnpm install --frozen-lockfile succeeds, confirming the resolved lockfile matches the merged workspace and every package.json.
• Mobile static analysis: scripts/mobile-native-static-check.ts exits 0 (swiftlint/ktlint/detekt unavailable in this container, as on any non-macOS host).

Not verified here: live browser and simulator runs, and the four required CI checks — those run on this PR.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.2 KiB	−173 B (−1.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+1 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−174 B (−2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	55.5 KiB	+514 B (+0.9%)	66.4 KiB	✅
Codex	Live turn messages	16	9	−7 (−43.8%)	21	✅
Claude	Total thread wire	13.4 KiB	13.2 KiB	−252 B (−1.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+17 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.6 KiB	6.3 KiB	−269 B (−4.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	55.5 KiB	−308 B (−0.5%)	66.4 KiB	✅
Claude	Live turn messages	16	9	−7 (−43.8%)	21	✅

Baseline: 133f3f7 · PR result: f08c879 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.