fix(connect): refresh relay credentials before expiry by maria-rcks · Pull Request #9178 · pingdotgg/t3code

maria-rcks · 2026-09-02T06:24:21Z

Relay WebSockets could outlive their one-hour DPoP access tokens, leaving HTTP-backed views such as pull request diffs stuck with stale credentials. Prepared connections now retain token expiry and renew the relay connection one minute early; rejected pull request diff sessions also tell users to refresh the page or reopen T3 Code.

Before

After

Verified with 54 focused tests, contracts and client-runtime typechecks, targeted lint and formatting, and diff checks.

This fixes#8326; implemented by gpt-5.6-sol via the Codex harness.

Note

Medium Risk
Changes connection lifecycle and a breaking shape on DPoP PreparedHttpAuthorization; incorrect refresh timing could cause extra reconnects or brief auth gaps on relay environments.

Overview
Relay connections now renew before DPoP access tokens expire, so long-lived WebSockets do not keep using credentials that HTTP calls (e.g. pull request diffs) can no longer use.

Prepared DPoP authorization carries expiresAtEpochMs, with a shared DPOP_ACCESS_TOKEN_REFRESH_SKEW_MS (60s) used for cache hits in authorization and for timing in EnvironmentSupervisor. While connected, the supervisor races session teardown with waitForAuthorizationRefresh, which sleeps until expiry minus the skew and triggers a reconnect with a fresh token.

When a pull request diff request gets invalid_credential, it is mapped to PullRequestDiffCredentialRejectedError with guidance to refresh the page or reopen T3 Code.

^{Reviewed by Cursor Bugbot for commit 62480b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Refresh DPoP relay credentials before expiry in `EnvironmentSupervisor`

DPoP tokens now carry expiresAtEpochMs in PreparedHttpAuthorization.Dpop; a shared 60-second refresh skew constant in model.ts replaces the previous service-local constant in service.ts.
waitForAuthorizationRefresh in supervisor.ts sleeps until expiresAtEpochMs minus the skew for DPoP connections, then emits a refresh signal; the runAttempt connected lifecycle now races this waiter alongside session closure and lease monitoring, leaving the connected state to trigger reconnect when the token nears expiry.
Adds PullRequestDiffCredentialRejectedError in pullRequestDiffHttp.ts and maps invalid_credentialEnvironmentAuthInvalidError from fetchEnvironmentPullRequestDiff to it with a fixed recovery message; PullRequestDiffLoader.load now declares the widened error union.
Behavioral Change: PreparedHttpAuthorization.Dpop now requires expiresAtEpochMs, so all fixtures and consumers must supply it. DPoP-connected supervisors now leave the connected state when the token enters the 60-second refresh window, in addition to existing session/lease triggers.

^{Macroscope summarized 62480b0.}

macroscopeapp · 2026-09-02T06:38:52Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes the production lifecycle of relay DPoP connections and adds authentication-specific error handling. The affected authorization and credential paths are sensitive and warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

…continuation, provider editor redesign, context meter opt-in, linked-PR summaries) Brings the fork up to origin/main e0da6c6..b57726c. Highlights: continue active threads across server self-updates (pingdotgg#9167), provider editor and models list redesign (pingdotgg#8508), opt-in context window meter (pingdotgg#9190), linked-PR summary RPC with last-good caching (pingdotgg#9176), relay credential refresh before expiry (pingdotgg#9178), composer draft preserved through worktree setup (pingdotgg#9197), project skill discovery for Claude (pingdotgg#9210), copy-path on diff headers (pingdotgg#2403), mobile long-press file references (pingdotgg#9258). Conflict resolutions (14 files), keep-both unless noted: - RpcAuthorization / contracts rpc / ws.ts: fork's PR rank, cherry-pick and upstream-release RPCs sit beside upstream's new pullRequestsSummary. - ws.ts route layer: fork's computer task/view brokers plus upstream's serverSelfUpdate wrapped in withRunningThreadContinuation. - PullRequestService: fork's upstream-project reads and scoped diff epochs kept; upstream's summary read, refCacheKey and viewer-flight invalidation added. invalidate() now scopes diff-only invalidation AND clears viewer flights on a whole-workspace refresh. Test file keeps both new suites. - client-runtime pullRequests: fork's PR stack atoms kept, TTL constant takes upstream's new name. - ChatMarkdown: upstream's one-character gutter rule replaces the fork's equivalent digitWidth fix. - ChatComposer: fork's voice-session button kept; context meter now honours settings.contextWindowMeterEnabled. - ConnectionsSettings: fork's EnvironmentLabelControl kept with upstream's min-w-0 truncate. - mobile ThreadFeed: upstream's markdownLinkHandlers plus the fork's onCancelQueuedMessage. - ClaudeDriver imports: fork's superset. build-desktop-artifact: distro and arch both threaded through. Integration: upstream's restart continuation and the fork's resume-on-restart both ran at boot on the same orphans. The continuation-marker helpers move to provider/serverUpdateContinuation.ts and SessionStartupReconciler now defers any binding carrying the marker to upstream's pass (logged as deferred), so a thread is never continued twice. Test added. Dependencies reinstalled for the expo-sharing pin; the stale pnpm copy of @t3tools/mobile-markdown-text was what broke the mobile typecheck. Typecheck clean: contracts, shared, client-runtime, server, web, mobile (desktop exits 1 on a pre-existing warning-level diagnostic). Startup and self-update suites 36 passing; web sidebar/composer/settings suites 419 passing; fork guard script OK. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

maria-rcks · 2026-09-02T06:24:21Z

Relay WebSockets could outlive their one-hour DPoP access tokens, leaving HTTP-backed views such as pull request diffs stuck with stale credentials. Prepared connections now retain token expiry and renew the relay connection one minute early; rejected pull request diff sessions also tell users to refresh the page or reopen T3 Code.

Before

After

Verified with 54 focused tests, contracts and client-runtime typechecks, targeted lint and formatting, and diff checks.

This fixes#8326; implemented by gpt-5.6-sol via the Codex harness.

Note

Medium Risk
Changes connection lifecycle and a breaking shape on DPoP PreparedHttpAuthorization; incorrect refresh timing could cause extra reconnects or brief auth gaps on relay environments.

Overview
Relay connections now renew before DPoP access tokens expire, so long-lived WebSockets do not keep using credentials that HTTP calls (e.g. pull request diffs) can no longer use.

Prepared DPoP authorization carries expiresAtEpochMs, with a shared DPOP_ACCESS_TOKEN_REFRESH_SKEW_MS (60s) used for cache hits in authorization and for timing in EnvironmentSupervisor. While connected, the supervisor races session teardown with waitForAuthorizationRefresh, which sleeps until expiry minus the skew and triggers a reconnect with a fresh token.

When a pull request diff request gets invalid_credential, it is mapped to PullRequestDiffCredentialRejectedError with guidance to refresh the page or reopen T3 Code.

^{Reviewed by Cursor Bugbot for commit 62480b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Refresh DPoP relay credentials before expiry in `EnvironmentSupervisor`

DPoP tokens now carry expiresAtEpochMs in PreparedHttpAuthorization.Dpop; a shared 60-second refresh skew constant in model.ts replaces the previous service-local constant in service.ts.
waitForAuthorizationRefresh in supervisor.ts sleeps until expiresAtEpochMs minus the skew for DPoP connections, then emits a refresh signal; the runAttempt connected lifecycle now races this waiter alongside session closure and lease monitoring, leaving the connected state to trigger reconnect when the token nears expiry.
Adds PullRequestDiffCredentialRejectedError in pullRequestDiffHttp.ts and maps invalid_credentialEnvironmentAuthInvalidError from fetchEnvironmentPullRequestDiff to it with a fixed recovery message; PullRequestDiffLoader.load now declares the widened error union.
Behavioral Change: PreparedHttpAuthorization.Dpop now requires expiresAtEpochMs, so all fixtures and consumers must supply it. DPoP-connected supervisors now leave the connected state when the token enters the 60-second refresh window, in addition to existing session/lease triggers.

^{Macroscope summarized 62480b0.}

macroscopeapp · 2026-09-02T06:38:52Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes the production lifecycle of relay DPoP connections and adds authentication-specific error handling. The affected authorization and credential paths are sensitive and warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

…continuation, provider editor redesign, context meter opt-in, linked-PR summaries) Brings the fork up to origin/main e0da6c6..b57726c. Highlights: continue active threads across server self-updates (pingdotgg#9167), provider editor and models list redesign (pingdotgg#8508), opt-in context window meter (pingdotgg#9190), linked-PR summary RPC with last-good caching (pingdotgg#9176), relay credential refresh before expiry (pingdotgg#9178), composer draft preserved through worktree setup (pingdotgg#9197), project skill discovery for Claude (pingdotgg#9210), copy-path on diff headers (pingdotgg#2403), mobile long-press file references (pingdotgg#9258). Conflict resolutions (14 files), keep-both unless noted: - RpcAuthorization / contracts rpc / ws.ts: fork's PR rank, cherry-pick and upstream-release RPCs sit beside upstream's new pullRequestsSummary. - ws.ts route layer: fork's computer task/view brokers plus upstream's serverSelfUpdate wrapped in withRunningThreadContinuation. - PullRequestService: fork's upstream-project reads and scoped diff epochs kept; upstream's summary read, refCacheKey and viewer-flight invalidation added. invalidate() now scopes diff-only invalidation AND clears viewer flights on a whole-workspace refresh. Test file keeps both new suites. - client-runtime pullRequests: fork's PR stack atoms kept, TTL constant takes upstream's new name. - ChatMarkdown: upstream's one-character gutter rule replaces the fork's equivalent digitWidth fix. - ChatComposer: fork's voice-session button kept; context meter now honours settings.contextWindowMeterEnabled. - ConnectionsSettings: fork's EnvironmentLabelControl kept with upstream's min-w-0 truncate. - mobile ThreadFeed: upstream's markdownLinkHandlers plus the fork's onCancelQueuedMessage. - ClaudeDriver imports: fork's superset. build-desktop-artifact: distro and arch both threaded through. Integration: upstream's restart continuation and the fork's resume-on-restart both ran at boot on the same orphans. The continuation-marker helpers move to provider/serverUpdateContinuation.ts and SessionStartupReconciler now defers any binding carrying the marker to upstream's pass (logged as deferred), so a thread is never continued twice. Test added. Dependencies reinstalled for the expo-sharing pin; the stale pnpm copy of @t3tools/mobile-markdown-text was what broke the mobile typecheck. Typecheck clean: contracts, shared, client-runtime, server, web, mobile (desktop exits 1 on a pre-existing warning-level diagnostic). Startup and self-update suites 36 passing; web sidebar/composer/settings suites 419 passing; fork guard script OK. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

maria-rcks · 2026-09-02T06:24:21Z

Relay WebSockets could outlive their one-hour DPoP access tokens, leaving HTTP-backed views such as pull request diffs stuck with stale credentials. Prepared connections now retain token expiry and renew the relay connection one minute early; rejected pull request diff sessions also tell users to refresh the page or reopen T3 Code.

Before

After

Verified with 54 focused tests, contracts and client-runtime typechecks, targeted lint and formatting, and diff checks.

This fixes#8326; implemented by gpt-5.6-sol via the Codex harness.

Note

Medium Risk
Changes connection lifecycle and a breaking shape on DPoP PreparedHttpAuthorization; incorrect refresh timing could cause extra reconnects or brief auth gaps on relay environments.

Overview
Relay connections now renew before DPoP access tokens expire, so long-lived WebSockets do not keep using credentials that HTTP calls (e.g. pull request diffs) can no longer use.

Prepared DPoP authorization carries expiresAtEpochMs, with a shared DPOP_ACCESS_TOKEN_REFRESH_SKEW_MS (60s) used for cache hits in authorization and for timing in EnvironmentSupervisor. While connected, the supervisor races session teardown with waitForAuthorizationRefresh, which sleeps until expiry minus the skew and triggers a reconnect with a fresh token.

When a pull request diff request gets invalid_credential, it is mapped to PullRequestDiffCredentialRejectedError with guidance to refresh the page or reopen T3 Code.

^{Reviewed by Cursor Bugbot for commit 62480b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Refresh DPoP relay credentials before expiry in `EnvironmentSupervisor`

DPoP tokens now carry expiresAtEpochMs in PreparedHttpAuthorization.Dpop; a shared 60-second refresh skew constant in model.ts replaces the previous service-local constant in service.ts.
waitForAuthorizationRefresh in supervisor.ts sleeps until expiresAtEpochMs minus the skew for DPoP connections, then emits a refresh signal; the runAttempt connected lifecycle now races this waiter alongside session closure and lease monitoring, leaving the connected state to trigger reconnect when the token nears expiry.
Adds PullRequestDiffCredentialRejectedError in pullRequestDiffHttp.ts and maps invalid_credentialEnvironmentAuthInvalidError from fetchEnvironmentPullRequestDiff to it with a fixed recovery message; PullRequestDiffLoader.load now declares the widened error union.
Behavioral Change: PreparedHttpAuthorization.Dpop now requires expiresAtEpochMs, so all fixtures and consumers must supply it. DPoP-connected supervisors now leave the connected state when the token enters the 60-second refresh window, in addition to existing session/lease triggers.

^{Macroscope summarized 62480b0.}

macroscopeapp · 2026-09-02T06:38:52Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes the production lifecycle of relay DPoP connections and adds authentication-specific error handling. The affected authorization and credential paths are sensitive and warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

…continuation, provider editor redesign, context meter opt-in, linked-PR summaries) Brings the fork up to origin/main e0da6c6..b57726c. Highlights: continue active threads across server self-updates (pingdotgg#9167), provider editor and models list redesign (pingdotgg#8508), opt-in context window meter (pingdotgg#9190), linked-PR summary RPC with last-good caching (pingdotgg#9176), relay credential refresh before expiry (pingdotgg#9178), composer draft preserved through worktree setup (pingdotgg#9197), project skill discovery for Claude (pingdotgg#9210), copy-path on diff headers (pingdotgg#2403), mobile long-press file references (pingdotgg#9258). Conflict resolutions (14 files), keep-both unless noted: - RpcAuthorization / contracts rpc / ws.ts: fork's PR rank, cherry-pick and upstream-release RPCs sit beside upstream's new pullRequestsSummary. - ws.ts route layer: fork's computer task/view brokers plus upstream's serverSelfUpdate wrapped in withRunningThreadContinuation. - PullRequestService: fork's upstream-project reads and scoped diff epochs kept; upstream's summary read, refCacheKey and viewer-flight invalidation added. invalidate() now scopes diff-only invalidation AND clears viewer flights on a whole-workspace refresh. Test file keeps both new suites. - client-runtime pullRequests: fork's PR stack atoms kept, TTL constant takes upstream's new name. - ChatMarkdown: upstream's one-character gutter rule replaces the fork's equivalent digitWidth fix. - ChatComposer: fork's voice-session button kept; context meter now honours settings.contextWindowMeterEnabled. - ConnectionsSettings: fork's EnvironmentLabelControl kept with upstream's min-w-0 truncate. - mobile ThreadFeed: upstream's markdownLinkHandlers plus the fork's onCancelQueuedMessage. - ClaudeDriver imports: fork's superset. build-desktop-artifact: distro and arch both threaded through. Integration: upstream's restart continuation and the fork's resume-on-restart both ran at boot on the same orphans. The continuation-marker helpers move to provider/serverUpdateContinuation.ts and SessionStartupReconciler now defers any binding carrying the marker to upstream's pass (logged as deferred), so a thread is never continued twice. Test added. Dependencies reinstalled for the expo-sharing pin; the stale pnpm copy of @t3tools/mobile-markdown-text was what broke the mobile typecheck. Typecheck clean: contracts, shared, client-runtime, server, web, mobile (desktop exits 1 on a pre-existing warning-level diagnostic). Startup and self-update suites 36 passing; web sidebar/composer/settings suites 419 passing; fork guard script OK. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

maria-rcks · 2026-09-02T06:24:21Z

Relay WebSockets could outlive their one-hour DPoP access tokens, leaving HTTP-backed views such as pull request diffs stuck with stale credentials. Prepared connections now retain token expiry and renew the relay connection one minute early; rejected pull request diff sessions also tell users to refresh the page or reopen T3 Code.

Before

After

Verified with 54 focused tests, contracts and client-runtime typechecks, targeted lint and formatting, and diff checks.

This fixes#8326; implemented by gpt-5.6-sol via the Codex harness.

Note

Medium Risk
Changes connection lifecycle and a breaking shape on DPoP PreparedHttpAuthorization; incorrect refresh timing could cause extra reconnects or brief auth gaps on relay environments.

Overview
Relay connections now renew before DPoP access tokens expire, so long-lived WebSockets do not keep using credentials that HTTP calls (e.g. pull request diffs) can no longer use.

Prepared DPoP authorization carries expiresAtEpochMs, with a shared DPOP_ACCESS_TOKEN_REFRESH_SKEW_MS (60s) used for cache hits in authorization and for timing in EnvironmentSupervisor. While connected, the supervisor races session teardown with waitForAuthorizationRefresh, which sleeps until expiry minus the skew and triggers a reconnect with a fresh token.

When a pull request diff request gets invalid_credential, it is mapped to PullRequestDiffCredentialRejectedError with guidance to refresh the page or reopen T3 Code.

^{Reviewed by Cursor Bugbot for commit 62480b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Refresh DPoP relay credentials before expiry in `EnvironmentSupervisor`

DPoP tokens now carry expiresAtEpochMs in PreparedHttpAuthorization.Dpop; a shared 60-second refresh skew constant in model.ts replaces the previous service-local constant in service.ts.
waitForAuthorizationRefresh in supervisor.ts sleeps until expiresAtEpochMs minus the skew for DPoP connections, then emits a refresh signal; the runAttempt connected lifecycle now races this waiter alongside session closure and lease monitoring, leaving the connected state to trigger reconnect when the token nears expiry.
Adds PullRequestDiffCredentialRejectedError in pullRequestDiffHttp.ts and maps invalid_credentialEnvironmentAuthInvalidError from fetchEnvironmentPullRequestDiff to it with a fixed recovery message; PullRequestDiffLoader.load now declares the widened error union.
Behavioral Change: PreparedHttpAuthorization.Dpop now requires expiresAtEpochMs, so all fixtures and consumers must supply it. DPoP-connected supervisors now leave the connected state when the token enters the 60-second refresh window, in addition to existing session/lease triggers.

^{Macroscope summarized 62480b0.}

macroscopeapp · 2026-09-02T06:38:52Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes the production lifecycle of relay DPoP connections and adds authentication-specific error handling. The affected authorization and credential paths are sensitive and warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

…continuation, provider editor redesign, context meter opt-in, linked-PR summaries) Brings the fork up to origin/main e0da6c6..b57726c. Highlights: continue active threads across server self-updates (pingdotgg#9167), provider editor and models list redesign (pingdotgg#8508), opt-in context window meter (pingdotgg#9190), linked-PR summary RPC with last-good caching (pingdotgg#9176), relay credential refresh before expiry (pingdotgg#9178), composer draft preserved through worktree setup (pingdotgg#9197), project skill discovery for Claude (pingdotgg#9210), copy-path on diff headers (pingdotgg#2403), mobile long-press file references (pingdotgg#9258). Conflict resolutions (14 files), keep-both unless noted: - RpcAuthorization / contracts rpc / ws.ts: fork's PR rank, cherry-pick and upstream-release RPCs sit beside upstream's new pullRequestsSummary. - ws.ts route layer: fork's computer task/view brokers plus upstream's serverSelfUpdate wrapped in withRunningThreadContinuation. - PullRequestService: fork's upstream-project reads and scoped diff epochs kept; upstream's summary read, refCacheKey and viewer-flight invalidation added. invalidate() now scopes diff-only invalidation AND clears viewer flights on a whole-workspace refresh. Test file keeps both new suites. - client-runtime pullRequests: fork's PR stack atoms kept, TTL constant takes upstream's new name. - ChatMarkdown: upstream's one-character gutter rule replaces the fork's equivalent digitWidth fix. - ChatComposer: fork's voice-session button kept; context meter now honours settings.contextWindowMeterEnabled. - ConnectionsSettings: fork's EnvironmentLabelControl kept with upstream's min-w-0 truncate. - mobile ThreadFeed: upstream's markdownLinkHandlers plus the fork's onCancelQueuedMessage. - ClaudeDriver imports: fork's superset. build-desktop-artifact: distro and arch both threaded through. Integration: upstream's restart continuation and the fork's resume-on-restart both ran at boot on the same orphans. The continuation-marker helpers move to provider/serverUpdateContinuation.ts and SessionStartupReconciler now defers any binding carrying the marker to upstream's pass (logged as deferred), so a thread is never continued twice. Test added. Dependencies reinstalled for the expo-sharing pin; the stale pnpm copy of @t3tools/mobile-markdown-text was what broke the mobile typecheck. Typecheck clean: contracts, shared, client-runtime, server, web, mobile (desktop exits 1 on a pre-existing warning-level diagnostic). Startup and self-update suites 36 passing; web sidebar/composer/settings suites 419 passing; fork guard script OK. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

maria-rcks · 2026-09-02T06:24:21Z

Relay WebSockets could outlive their one-hour DPoP access tokens, leaving HTTP-backed views such as pull request diffs stuck with stale credentials. Prepared connections now retain token expiry and renew the relay connection one minute early; rejected pull request diff sessions also tell users to refresh the page or reopen T3 Code.

Before

After

Verified with 54 focused tests, contracts and client-runtime typechecks, targeted lint and formatting, and diff checks.

This fixes#8326; implemented by gpt-5.6-sol via the Codex harness.

Note

Medium Risk
Changes connection lifecycle and a breaking shape on DPoP PreparedHttpAuthorization; incorrect refresh timing could cause extra reconnects or brief auth gaps on relay environments.

Overview
Relay connections now renew before DPoP access tokens expire, so long-lived WebSockets do not keep using credentials that HTTP calls (e.g. pull request diffs) can no longer use.

Prepared DPoP authorization carries expiresAtEpochMs, with a shared DPOP_ACCESS_TOKEN_REFRESH_SKEW_MS (60s) used for cache hits in authorization and for timing in EnvironmentSupervisor. While connected, the supervisor races session teardown with waitForAuthorizationRefresh, which sleeps until expiry minus the skew and triggers a reconnect with a fresh token.

When a pull request diff request gets invalid_credential, it is mapped to PullRequestDiffCredentialRejectedError with guidance to refresh the page or reopen T3 Code.

^{Reviewed by Cursor Bugbot for commit 62480b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Refresh DPoP relay credentials before expiry in `EnvironmentSupervisor`

DPoP tokens now carry expiresAtEpochMs in PreparedHttpAuthorization.Dpop; a shared 60-second refresh skew constant in model.ts replaces the previous service-local constant in service.ts.
waitForAuthorizationRefresh in supervisor.ts sleeps until expiresAtEpochMs minus the skew for DPoP connections, then emits a refresh signal; the runAttempt connected lifecycle now races this waiter alongside session closure and lease monitoring, leaving the connected state to trigger reconnect when the token nears expiry.
Adds PullRequestDiffCredentialRejectedError in pullRequestDiffHttp.ts and maps invalid_credentialEnvironmentAuthInvalidError from fetchEnvironmentPullRequestDiff to it with a fixed recovery message; PullRequestDiffLoader.load now declares the widened error union.
Behavioral Change: PreparedHttpAuthorization.Dpop now requires expiresAtEpochMs, so all fixtures and consumers must supply it. DPoP-connected supervisors now leave the connected state when the token enters the 60-second refresh window, in addition to existing session/lease triggers.

^{Macroscope summarized 62480b0.}

macroscopeapp · 2026-09-02T06:38:52Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes the production lifecycle of relay DPoP connections and adds authentication-specific error handling. The affected authorization and credential paths are sensitive and warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

…continuation, provider editor redesign, context meter opt-in, linked-PR summaries) Brings the fork up to origin/main e0da6c6..b57726c. Highlights: continue active threads across server self-updates (pingdotgg#9167), provider editor and models list redesign (pingdotgg#8508), opt-in context window meter (pingdotgg#9190), linked-PR summary RPC with last-good caching (pingdotgg#9176), relay credential refresh before expiry (pingdotgg#9178), composer draft preserved through worktree setup (pingdotgg#9197), project skill discovery for Claude (pingdotgg#9210), copy-path on diff headers (pingdotgg#2403), mobile long-press file references (pingdotgg#9258). Conflict resolutions (14 files), keep-both unless noted: - RpcAuthorization / contracts rpc / ws.ts: fork's PR rank, cherry-pick and upstream-release RPCs sit beside upstream's new pullRequestsSummary. - ws.ts route layer: fork's computer task/view brokers plus upstream's serverSelfUpdate wrapped in withRunningThreadContinuation. - PullRequestService: fork's upstream-project reads and scoped diff epochs kept; upstream's summary read, refCacheKey and viewer-flight invalidation added. invalidate() now scopes diff-only invalidation AND clears viewer flights on a whole-workspace refresh. Test file keeps both new suites. - client-runtime pullRequests: fork's PR stack atoms kept, TTL constant takes upstream's new name. - ChatMarkdown: upstream's one-character gutter rule replaces the fork's equivalent digitWidth fix. - ChatComposer: fork's voice-session button kept; context meter now honours settings.contextWindowMeterEnabled. - ConnectionsSettings: fork's EnvironmentLabelControl kept with upstream's min-w-0 truncate. - mobile ThreadFeed: upstream's markdownLinkHandlers plus the fork's onCancelQueuedMessage. - ClaudeDriver imports: fork's superset. build-desktop-artifact: distro and arch both threaded through. Integration: upstream's restart continuation and the fork's resume-on-restart both ran at boot on the same orphans. The continuation-marker helpers move to provider/serverUpdateContinuation.ts and SessionStartupReconciler now defers any binding carrying the marker to upstream's pass (logged as deferred), so a thread is never continued twice. Test added. Dependencies reinstalled for the expo-sharing pin; the stale pnpm copy of @t3tools/mobile-markdown-text was what broke the mobile typecheck. Typecheck clean: contracts, shared, client-runtime, server, web, mobile (desktop exits 1 on a pre-existing warning-level diagnostic). Startup and self-update suites 36 passing; web sidebar/composer/settings suites 419 passing; fork guard script OK. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

maria-rcks · 2026-09-02T06:24:21Z

Relay WebSockets could outlive their one-hour DPoP access tokens, leaving HTTP-backed views such as pull request diffs stuck with stale credentials. Prepared connections now retain token expiry and renew the relay connection one minute early; rejected pull request diff sessions also tell users to refresh the page or reopen T3 Code.

Before

After

Verified with 54 focused tests, contracts and client-runtime typechecks, targeted lint and formatting, and diff checks.

This fixes#8326; implemented by gpt-5.6-sol via the Codex harness.

Note

Medium Risk
Changes connection lifecycle and a breaking shape on DPoP PreparedHttpAuthorization; incorrect refresh timing could cause extra reconnects or brief auth gaps on relay environments.

Overview
Relay connections now renew before DPoP access tokens expire, so long-lived WebSockets do not keep using credentials that HTTP calls (e.g. pull request diffs) can no longer use.

Prepared DPoP authorization carries expiresAtEpochMs, with a shared DPOP_ACCESS_TOKEN_REFRESH_SKEW_MS (60s) used for cache hits in authorization and for timing in EnvironmentSupervisor. While connected, the supervisor races session teardown with waitForAuthorizationRefresh, which sleeps until expiry minus the skew and triggers a reconnect with a fresh token.

When a pull request diff request gets invalid_credential, it is mapped to PullRequestDiffCredentialRejectedError with guidance to refresh the page or reopen T3 Code.

^{Reviewed by Cursor Bugbot for commit 62480b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Refresh DPoP relay credentials before expiry in `EnvironmentSupervisor`

DPoP tokens now carry expiresAtEpochMs in PreparedHttpAuthorization.Dpop; a shared 60-second refresh skew constant in model.ts replaces the previous service-local constant in service.ts.
waitForAuthorizationRefresh in supervisor.ts sleeps until expiresAtEpochMs minus the skew for DPoP connections, then emits a refresh signal; the runAttempt connected lifecycle now races this waiter alongside session closure and lease monitoring, leaving the connected state to trigger reconnect when the token nears expiry.
Adds PullRequestDiffCredentialRejectedError in pullRequestDiffHttp.ts and maps invalid_credentialEnvironmentAuthInvalidError from fetchEnvironmentPullRequestDiff to it with a fixed recovery message; PullRequestDiffLoader.load now declares the widened error union.
Behavioral Change: PreparedHttpAuthorization.Dpop now requires expiresAtEpochMs, so all fixtures and consumers must supply it. DPoP-connected supervisors now leave the connected state when the token enters the 60-second refresh window, in addition to existing session/lease triggers.

^{Macroscope summarized 62480b0.}

macroscopeapp · 2026-09-02T06:38:52Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes the production lifecycle of relay DPoP connections and adds authentication-specific error handling. The affected authorization and credential paths are sensitive and warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

…continuation, provider editor redesign, context meter opt-in, linked-PR summaries) Brings the fork up to origin/main e0da6c6..b57726c. Highlights: continue active threads across server self-updates (pingdotgg#9167), provider editor and models list redesign (pingdotgg#8508), opt-in context window meter (pingdotgg#9190), linked-PR summary RPC with last-good caching (pingdotgg#9176), relay credential refresh before expiry (pingdotgg#9178), composer draft preserved through worktree setup (pingdotgg#9197), project skill discovery for Claude (pingdotgg#9210), copy-path on diff headers (pingdotgg#2403), mobile long-press file references (pingdotgg#9258). Conflict resolutions (14 files), keep-both unless noted: - RpcAuthorization / contracts rpc / ws.ts: fork's PR rank, cherry-pick and upstream-release RPCs sit beside upstream's new pullRequestsSummary. - ws.ts route layer: fork's computer task/view brokers plus upstream's serverSelfUpdate wrapped in withRunningThreadContinuation. - PullRequestService: fork's upstream-project reads and scoped diff epochs kept; upstream's summary read, refCacheKey and viewer-flight invalidation added. invalidate() now scopes diff-only invalidation AND clears viewer flights on a whole-workspace refresh. Test file keeps both new suites. - client-runtime pullRequests: fork's PR stack atoms kept, TTL constant takes upstream's new name. - ChatMarkdown: upstream's one-character gutter rule replaces the fork's equivalent digitWidth fix. - ChatComposer: fork's voice-session button kept; context meter now honours settings.contextWindowMeterEnabled. - ConnectionsSettings: fork's EnvironmentLabelControl kept with upstream's min-w-0 truncate. - mobile ThreadFeed: upstream's markdownLinkHandlers plus the fork's onCancelQueuedMessage. - ClaudeDriver imports: fork's superset. build-desktop-artifact: distro and arch both threaded through. Integration: upstream's restart continuation and the fork's resume-on-restart both ran at boot on the same orphans. The continuation-marker helpers move to provider/serverUpdateContinuation.ts and SessionStartupReconciler now defers any binding carrying the marker to upstream's pass (logged as deferred), so a thread is never continued twice. Test added. Dependencies reinstalled for the expo-sharing pin; the stale pnpm copy of @t3tools/mobile-markdown-text was what broke the mobile typecheck. Typecheck clean: contracts, shared, client-runtime, server, web, mobile (desktop exits 1 on a pre-existing warning-level diagnostic). Startup and self-update suites 36 passing; web sidebar/composer/settings suites 419 passing; fork guard script OK. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

maria-rcks · 2026-09-02T06:24:21Z

Relay WebSockets could outlive their one-hour DPoP access tokens, leaving HTTP-backed views such as pull request diffs stuck with stale credentials. Prepared connections now retain token expiry and renew the relay connection one minute early; rejected pull request diff sessions also tell users to refresh the page or reopen T3 Code.

Before

After

Verified with 54 focused tests, contracts and client-runtime typechecks, targeted lint and formatting, and diff checks.

This fixes#8326; implemented by gpt-5.6-sol via the Codex harness.

Note

Medium Risk
Changes connection lifecycle and a breaking shape on DPoP PreparedHttpAuthorization; incorrect refresh timing could cause extra reconnects or brief auth gaps on relay environments.

Overview
Relay connections now renew before DPoP access tokens expire, so long-lived WebSockets do not keep using credentials that HTTP calls (e.g. pull request diffs) can no longer use.

Prepared DPoP authorization carries expiresAtEpochMs, with a shared DPOP_ACCESS_TOKEN_REFRESH_SKEW_MS (60s) used for cache hits in authorization and for timing in EnvironmentSupervisor. While connected, the supervisor races session teardown with waitForAuthorizationRefresh, which sleeps until expiry minus the skew and triggers a reconnect with a fresh token.

When a pull request diff request gets invalid_credential, it is mapped to PullRequestDiffCredentialRejectedError with guidance to refresh the page or reopen T3 Code.

^{Reviewed by Cursor Bugbot for commit 62480b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Refresh DPoP relay credentials before expiry in `EnvironmentSupervisor`

DPoP tokens now carry expiresAtEpochMs in PreparedHttpAuthorization.Dpop; a shared 60-second refresh skew constant in model.ts replaces the previous service-local constant in service.ts.
waitForAuthorizationRefresh in supervisor.ts sleeps until expiresAtEpochMs minus the skew for DPoP connections, then emits a refresh signal; the runAttempt connected lifecycle now races this waiter alongside session closure and lease monitoring, leaving the connected state to trigger reconnect when the token nears expiry.
Adds PullRequestDiffCredentialRejectedError in pullRequestDiffHttp.ts and maps invalid_credentialEnvironmentAuthInvalidError from fetchEnvironmentPullRequestDiff to it with a fixed recovery message; PullRequestDiffLoader.load now declares the widened error union.
Behavioral Change: PreparedHttpAuthorization.Dpop now requires expiresAtEpochMs, so all fixtures and consumers must supply it. DPoP-connected supervisors now leave the connected state when the token enters the 60-second refresh window, in addition to existing session/lease triggers.

^{Macroscope summarized 62480b0.}

macroscopeapp · 2026-09-02T06:38:52Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes the production lifecycle of relay DPoP connections and adds authentication-specific error handling. The affected authorization and credential paths are sensitive and warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

…continuation, provider editor redesign, context meter opt-in, linked-PR summaries) Brings the fork up to origin/main e0da6c6..b57726c. Highlights: continue active threads across server self-updates (pingdotgg#9167), provider editor and models list redesign (pingdotgg#8508), opt-in context window meter (pingdotgg#9190), linked-PR summary RPC with last-good caching (pingdotgg#9176), relay credential refresh before expiry (pingdotgg#9178), composer draft preserved through worktree setup (pingdotgg#9197), project skill discovery for Claude (pingdotgg#9210), copy-path on diff headers (pingdotgg#2403), mobile long-press file references (pingdotgg#9258). Conflict resolutions (14 files), keep-both unless noted: - RpcAuthorization / contracts rpc / ws.ts: fork's PR rank, cherry-pick and upstream-release RPCs sit beside upstream's new pullRequestsSummary. - ws.ts route layer: fork's computer task/view brokers plus upstream's serverSelfUpdate wrapped in withRunningThreadContinuation. - PullRequestService: fork's upstream-project reads and scoped diff epochs kept; upstream's summary read, refCacheKey and viewer-flight invalidation added. invalidate() now scopes diff-only invalidation AND clears viewer flights on a whole-workspace refresh. Test file keeps both new suites. - client-runtime pullRequests: fork's PR stack atoms kept, TTL constant takes upstream's new name. - ChatMarkdown: upstream's one-character gutter rule replaces the fork's equivalent digitWidth fix. - ChatComposer: fork's voice-session button kept; context meter now honours settings.contextWindowMeterEnabled. - ConnectionsSettings: fork's EnvironmentLabelControl kept with upstream's min-w-0 truncate. - mobile ThreadFeed: upstream's markdownLinkHandlers plus the fork's onCancelQueuedMessage. - ClaudeDriver imports: fork's superset. build-desktop-artifact: distro and arch both threaded through. Integration: upstream's restart continuation and the fork's resume-on-restart both ran at boot on the same orphans. The continuation-marker helpers move to provider/serverUpdateContinuation.ts and SessionStartupReconciler now defers any binding carrying the marker to upstream's pass (logged as deferred), so a thread is never continued twice. Test added. Dependencies reinstalled for the expo-sharing pin; the stale pnpm copy of @t3tools/mobile-markdown-text was what broke the mobile typecheck. Typecheck clean: contracts, shared, client-runtime, server, web, mobile (desktop exits 1 on a pre-existing warning-level diagnostic). Startup and self-update suites 36 passing; web sidebar/composer/settings suites 419 passing; fork guard script OK. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

maria-rcks · 2026-09-02T06:24:21Z

Relay WebSockets could outlive their one-hour DPoP access tokens, leaving HTTP-backed views such as pull request diffs stuck with stale credentials. Prepared connections now retain token expiry and renew the relay connection one minute early; rejected pull request diff sessions also tell users to refresh the page or reopen T3 Code.

Before

After

Verified with 54 focused tests, contracts and client-runtime typechecks, targeted lint and formatting, and diff checks.

This fixes#8326; implemented by gpt-5.6-sol via the Codex harness.

Note

Medium Risk
Changes connection lifecycle and a breaking shape on DPoP PreparedHttpAuthorization; incorrect refresh timing could cause extra reconnects or brief auth gaps on relay environments.

Overview
Relay connections now renew before DPoP access tokens expire, so long-lived WebSockets do not keep using credentials that HTTP calls (e.g. pull request diffs) can no longer use.

Prepared DPoP authorization carries expiresAtEpochMs, with a shared DPOP_ACCESS_TOKEN_REFRESH_SKEW_MS (60s) used for cache hits in authorization and for timing in EnvironmentSupervisor. While connected, the supervisor races session teardown with waitForAuthorizationRefresh, which sleeps until expiry minus the skew and triggers a reconnect with a fresh token.

When a pull request diff request gets invalid_credential, it is mapped to PullRequestDiffCredentialRejectedError with guidance to refresh the page or reopen T3 Code.

^{Reviewed by Cursor Bugbot for commit 62480b0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Refresh DPoP relay credentials before expiry in `EnvironmentSupervisor`

DPoP tokens now carry expiresAtEpochMs in PreparedHttpAuthorization.Dpop; a shared 60-second refresh skew constant in model.ts replaces the previous service-local constant in service.ts.
waitForAuthorizationRefresh in supervisor.ts sleeps until expiresAtEpochMs minus the skew for DPoP connections, then emits a refresh signal; the runAttempt connected lifecycle now races this waiter alongside session closure and lease monitoring, leaving the connected state to trigger reconnect when the token nears expiry.
Adds PullRequestDiffCredentialRejectedError in pullRequestDiffHttp.ts and maps invalid_credentialEnvironmentAuthInvalidError from fetchEnvironmentPullRequestDiff to it with a fixed recovery message; PullRequestDiffLoader.load now declares the widened error union.
Behavioral Change: PreparedHttpAuthorization.Dpop now requires expiresAtEpochMs, so all fixtures and consumers must supply it. DPoP-connected supervisors now leave the connected state when the token enters the 60-second refresh window, in addition to existing session/lease triggers.

^{Macroscope summarized 62480b0.}

macroscopeapp · 2026-09-02T06:38:52Z

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This changes the production lifecycle of relay DPoP connections and adds authentication-specific error handling. The affected authorization and credential paths are sensitive and warrant human review.

^{You can add or adjust custom eligibility rules. Learn more.}

…continuation, provider editor redesign, context meter opt-in, linked-PR summaries) Brings the fork up to origin/main e0da6c6..b57726c. Highlights: continue active threads across server self-updates (pingdotgg#9167), provider editor and models list redesign (pingdotgg#8508), opt-in context window meter (pingdotgg#9190), linked-PR summary RPC with last-good caching (pingdotgg#9176), relay credential refresh before expiry (pingdotgg#9178), composer draft preserved through worktree setup (pingdotgg#9197), project skill discovery for Claude (pingdotgg#9210), copy-path on diff headers (pingdotgg#2403), mobile long-press file references (pingdotgg#9258). Conflict resolutions (14 files), keep-both unless noted: - RpcAuthorization / contracts rpc / ws.ts: fork's PR rank, cherry-pick and upstream-release RPCs sit beside upstream's new pullRequestsSummary. - ws.ts route layer: fork's computer task/view brokers plus upstream's serverSelfUpdate wrapped in withRunningThreadContinuation. - PullRequestService: fork's upstream-project reads and scoped diff epochs kept; upstream's summary read, refCacheKey and viewer-flight invalidation added. invalidate() now scopes diff-only invalidation AND clears viewer flights on a whole-workspace refresh. Test file keeps both new suites. - client-runtime pullRequests: fork's PR stack atoms kept, TTL constant takes upstream's new name. - ChatMarkdown: upstream's one-character gutter rule replaces the fork's equivalent digitWidth fix. - ChatComposer: fork's voice-session button kept; context meter now honours settings.contextWindowMeterEnabled. - ConnectionsSettings: fork's EnvironmentLabelControl kept with upstream's min-w-0 truncate. - mobile ThreadFeed: upstream's markdownLinkHandlers plus the fork's onCancelQueuedMessage. - ClaudeDriver imports: fork's superset. build-desktop-artifact: distro and arch both threaded through. Integration: upstream's restart continuation and the fork's resume-on-restart both ran at boot on the same orphans. The continuation-marker helpers move to provider/serverUpdateContinuation.ts and SessionStartupReconciler now defers any binding carrying the marker to upstream's pass (logged as deferred), so a thread is never continued twice. Test added. Dependencies reinstalled for the expo-sharing pin; the stale pnpm copy of @t3tools/mobile-markdown-text was what broke the mobile typecheck. Typecheck clean: contracts, shared, client-runtime, server, web, mobile (desktop exits 1 on a pre-existing warning-level diagnostic). Startup and self-update suites 36 passing; web sidebar/composer/settings suites 419 passing; fork guard script OK. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

fix(connect): refresh relay credentials before expiry
29cebc2

github-actionsBot added vouch:trusted PR author is trusted by repo permissions or the VOUCHED list. size:M 30-99 changed lines (additions + deletions). labels Sep 2, 2026

style(client-runtime): apply pinned formatting
c9aa901

macroscopeappBot reviewed Sep 2, 2026
View reviewed changes

Comment threadpackages/contracts/src/environmentHttp.ts Outdated

macroscopeappBot reviewed Sep 2, 2026
View reviewed changes

Comment threadpackages/contracts/src/environmentHttp.ts Outdated

maria-rcks added 2 commits September 2, 2026 06:40

fix(pull-requests): explain rejected diff sessions
3bb8d45

fix(client-runtime): export diff load errors
b0551fa

macroscopeappBot reviewed Sep 2, 2026
View reviewed changes

Comment threadpackages/client-runtime/src/state/pullRequestDiffHttp.ts Outdated

fix(pull-requests): structure rejected session errors
62480b0

maria-rcks merged commit 9e646ad into pingdotgg:mainSep 2, 2026
27 checks passed

patroza mentioned this pull request Sep 2, 2026
merge: sync upstream through 70cd258d8 (8 commits) patroza/t3code#442
Merged

berghtho mentioned this pull request Sep 2, 2026
chore(upstream): sync 2026-09-02 berghtho/t3code#20
Draft