fix(web): open GitHub pull requests in browser when loading fails

[rynfar]

A GitHub API error left the pull request view with only Retry, even though
the pull request was still perfectly reachable on GitHub. Rate limiting is the
common case, and retrying is exactly what does not help.

The error view now offers Open on GitHub, built from the saved project host
and pull request reference with no extra API call — so it works precisely when
the API does not. Error states for GitLab, Bitbucket, Azure DevOps, and unknown
providers are unchanged.

Adopted from T3 Code 7068e86f76e908c77ff04d1a684840257eab3a8a
(pingdotgg/t3code#8507).

Adaptation

One conflict, in docs/user/source-control.md: upstream's new bullet named
"T3 Code" twice. Resolved Pylon-first, keeping Pylon's product name and its
existing command-click bullet. Confirmed no T3 branding leaked into any adopted
file.

Verification

• vp test run openPullRequestLink.test.ts PullRequestsUnavailableState.test.tsx — 33 passed

• vp run -F @t3tools/web typecheck — clean

• gitHubPullRequestBrowserUrl builds a URL that gets opened in a browser, so I
  mutation-probed its two guards rather than trusting the tests existed:

  • dropping the ./.. path-segment check produces
    https://github.com/repository/pull/1 where null is expected — caught;
  • dropping the http:/https: protocol allowlist breaks the SCP-style remote
    path — caught.

  Both guards are therefore genuinely covered, in both directions.

Before/after image pending the consolidated real-client pass for this batch.
Upstream's own before/after screenshots are on pingdotgg/t3code#8507.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−6 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−7 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+1 B (+0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−63 B (−0.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−69 B (−1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−88 B (−0.2%)	66.4 KiB	✅
Claude	Live turn messages	11	9	−2 (−18.2%)	21	✅

Baseline: 3d6035f · PR result: 42a669e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Independent review pass. Two findings — one fixed, one documented.

Fixed in d7109b3ec — the other pull request error surface was a dead end.
The thread right panel shows a second PullRequestsUnavailableState when the
environment's server is too old to browse pull requests, with no retry and no
GitHub link. That contradicted the docs sentence this branch adds, which promises
the button whenever Pylon cannot load a GitHub pull request. The surface already
carries projectId, repository, and number, and ChatView already reads every
project, so it now builds the link with the same helper and the same
conditional-spread pattern the detail panel uses.

Documented — self-hosted GitHub installs still get no button. The helper gates
on identity.provider === "github". A self-hosted GitHub Enterprise host without
a github DNS label carries provider: "unknown", yet the server serves its pull
requests as GitHub after refineUnknownProjectKinds
(PullRequestService.ts:493-588). So the panel works normally and only the error
view comes up empty. Upstream's gating; widening it means deciding what
provider: "unknown" should imply for URL construction, which is a bigger call
than this PR.

The review cleared the parts that mattered: SCP and git:// remotes fall back to
the canonical host, malformed hosts and repository paths return null, credentials
are stripped via URL.origin, non-GitHub providers are correctly excluded,
url.pathname assignment percent-encodes stray characters, and Electron's
setWindowOpenHandler means target="_blank" really does reach the system
browser on desktop.

[rynfar]

A GitHub API error left the pull request view with only Retry, even though
the pull request was still perfectly reachable on GitHub. Rate limiting is the
common case, and retrying is exactly what does not help.

The error view now offers Open on GitHub, built from the saved project host
and pull request reference with no extra API call — so it works precisely when
the API does not. Error states for GitLab, Bitbucket, Azure DevOps, and unknown
providers are unchanged.

Adopted from T3 Code 7068e86f76e908c77ff04d1a684840257eab3a8a
(pingdotgg/t3code#8507).

Adaptation

One conflict, in docs/user/source-control.md: upstream's new bullet named
"T3 Code" twice. Resolved Pylon-first, keeping Pylon's product name and its
existing command-click bullet. Confirmed no T3 branding leaked into any adopted
file.

Verification

• vp test run openPullRequestLink.test.ts PullRequestsUnavailableState.test.tsx — 33 passed

• vp run -F @t3tools/web typecheck — clean

• gitHubPullRequestBrowserUrl builds a URL that gets opened in a browser, so I
  mutation-probed its two guards rather than trusting the tests existed:

  • dropping the ./.. path-segment check produces
    https://github.com/repository/pull/1 where null is expected — caught;
  • dropping the http:/https: protocol allowlist breaks the SCP-style remote
    path — caught.

  Both guards are therefore genuinely covered, in both directions.

Before/after image pending the consolidated real-client pass for this batch.
Upstream's own before/after screenshots are on pingdotgg/t3code#8507.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−6 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−7 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+1 B (+0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−63 B (−0.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−69 B (−1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−88 B (−0.2%)	66.4 KiB	✅
Claude	Live turn messages	11	9	−2 (−18.2%)	21	✅

Baseline: 3d6035f · PR result: 42a669e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Independent review pass. Two findings — one fixed, one documented.

Fixed in d7109b3ec — the other pull request error surface was a dead end.
The thread right panel shows a second PullRequestsUnavailableState when the
environment's server is too old to browse pull requests, with no retry and no
GitHub link. That contradicted the docs sentence this branch adds, which promises
the button whenever Pylon cannot load a GitHub pull request. The surface already
carries projectId, repository, and number, and ChatView already reads every
project, so it now builds the link with the same helper and the same
conditional-spread pattern the detail panel uses.

Documented — self-hosted GitHub installs still get no button. The helper gates
on identity.provider === "github". A self-hosted GitHub Enterprise host without
a github DNS label carries provider: "unknown", yet the server serves its pull
requests as GitHub after refineUnknownProjectKinds
(PullRequestService.ts:493-588). So the panel works normally and only the error
view comes up empty. Upstream's gating; widening it means deciding what
provider: "unknown" should imply for URL construction, which is a bigger call
than this PR.

The review cleared the parts that mattered: SCP and git:// remotes fall back to
the canonical host, malformed hosts and repository paths return null, credentials
are stripped via URL.origin, non-GitHub providers are correctly excluded,
url.pathname assignment percent-encodes stray characters, and Electron's
setWindowOpenHandler means target="_blank" really does reach the system
browser on desktop.

[rynfar]

A GitHub API error left the pull request view with only Retry, even though
the pull request was still perfectly reachable on GitHub. Rate limiting is the
common case, and retrying is exactly what does not help.

The error view now offers Open on GitHub, built from the saved project host
and pull request reference with no extra API call — so it works precisely when
the API does not. Error states for GitLab, Bitbucket, Azure DevOps, and unknown
providers are unchanged.

Adopted from T3 Code 7068e86f76e908c77ff04d1a684840257eab3a8a
(pingdotgg/t3code#8507).

Adaptation

One conflict, in docs/user/source-control.md: upstream's new bullet named
"T3 Code" twice. Resolved Pylon-first, keeping Pylon's product name and its
existing command-click bullet. Confirmed no T3 branding leaked into any adopted
file.

Verification

• vp test run openPullRequestLink.test.ts PullRequestsUnavailableState.test.tsx — 33 passed

• vp run -F @t3tools/web typecheck — clean

• gitHubPullRequestBrowserUrl builds a URL that gets opened in a browser, so I
  mutation-probed its two guards rather than trusting the tests existed:

  • dropping the ./.. path-segment check produces
    https://github.com/repository/pull/1 where null is expected — caught;
  • dropping the http:/https: protocol allowlist breaks the SCP-style remote
    path — caught.

  Both guards are therefore genuinely covered, in both directions.

Before/after image pending the consolidated real-client pass for this batch.
Upstream's own before/after screenshots are on pingdotgg/t3code#8507.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−6 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−7 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+1 B (+0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−63 B (−0.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−69 B (−1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−88 B (−0.2%)	66.4 KiB	✅
Claude	Live turn messages	11	9	−2 (−18.2%)	21	✅

Baseline: 3d6035f · PR result: 42a669e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Independent review pass. Two findings — one fixed, one documented.

Fixed in d7109b3ec — the other pull request error surface was a dead end.
The thread right panel shows a second PullRequestsUnavailableState when the
environment's server is too old to browse pull requests, with no retry and no
GitHub link. That contradicted the docs sentence this branch adds, which promises
the button whenever Pylon cannot load a GitHub pull request. The surface already
carries projectId, repository, and number, and ChatView already reads every
project, so it now builds the link with the same helper and the same
conditional-spread pattern the detail panel uses.

Documented — self-hosted GitHub installs still get no button. The helper gates
on identity.provider === "github". A self-hosted GitHub Enterprise host without
a github DNS label carries provider: "unknown", yet the server serves its pull
requests as GitHub after refineUnknownProjectKinds
(PullRequestService.ts:493-588). So the panel works normally and only the error
view comes up empty. Upstream's gating; widening it means deciding what
provider: "unknown" should imply for URL construction, which is a bigger call
than this PR.

The review cleared the parts that mattered: SCP and git:// remotes fall back to
the canonical host, malformed hosts and repository paths return null, credentials
are stripped via URL.origin, non-GitHub providers are correctly excluded,
url.pathname assignment percent-encodes stray characters, and Electron's
setWindowOpenHandler means target="_blank" really does reach the system
browser on desktop.

[rynfar]

A GitHub API error left the pull request view with only Retry, even though
the pull request was still perfectly reachable on GitHub. Rate limiting is the
common case, and retrying is exactly what does not help.

The error view now offers Open on GitHub, built from the saved project host
and pull request reference with no extra API call — so it works precisely when
the API does not. Error states for GitLab, Bitbucket, Azure DevOps, and unknown
providers are unchanged.

Adopted from T3 Code 7068e86f76e908c77ff04d1a684840257eab3a8a
(pingdotgg/t3code#8507).

Adaptation

One conflict, in docs/user/source-control.md: upstream's new bullet named
"T3 Code" twice. Resolved Pylon-first, keeping Pylon's product name and its
existing command-click bullet. Confirmed no T3 branding leaked into any adopted
file.

Verification

• vp test run openPullRequestLink.test.ts PullRequestsUnavailableState.test.tsx — 33 passed

• vp run -F @t3tools/web typecheck — clean

• gitHubPullRequestBrowserUrl builds a URL that gets opened in a browser, so I
  mutation-probed its two guards rather than trusting the tests existed:

  • dropping the ./.. path-segment check produces
    https://github.com/repository/pull/1 where null is expected — caught;
  • dropping the http:/https: protocol allowlist breaks the SCP-style remote
    path — caught.

  Both guards are therefore genuinely covered, in both directions.

Before/after image pending the consolidated real-client pass for this batch.
Upstream's own before/after screenshots are on pingdotgg/t3code#8507.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−6 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−7 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+1 B (+0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−63 B (−0.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−69 B (−1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−88 B (−0.2%)	66.4 KiB	✅
Claude	Live turn messages	11	9	−2 (−18.2%)	21	✅

Baseline: 3d6035f · PR result: 42a669e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Independent review pass. Two findings — one fixed, one documented.

Fixed in d7109b3ec — the other pull request error surface was a dead end.
The thread right panel shows a second PullRequestsUnavailableState when the
environment's server is too old to browse pull requests, with no retry and no
GitHub link. That contradicted the docs sentence this branch adds, which promises
the button whenever Pylon cannot load a GitHub pull request. The surface already
carries projectId, repository, and number, and ChatView already reads every
project, so it now builds the link with the same helper and the same
conditional-spread pattern the detail panel uses.

Documented — self-hosted GitHub installs still get no button. The helper gates
on identity.provider === "github". A self-hosted GitHub Enterprise host without
a github DNS label carries provider: "unknown", yet the server serves its pull
requests as GitHub after refineUnknownProjectKinds
(PullRequestService.ts:493-588). So the panel works normally and only the error
view comes up empty. Upstream's gating; widening it means deciding what
provider: "unknown" should imply for URL construction, which is a bigger call
than this PR.

The review cleared the parts that mattered: SCP and git:// remotes fall back to
the canonical host, malformed hosts and repository paths return null, credentials
are stripped via URL.origin, non-GitHub providers are correctly excluded,
url.pathname assignment percent-encodes stray characters, and Electron's
setWindowOpenHandler means target="_blank" really does reach the system
browser on desktop.

[rynfar]

A GitHub API error left the pull request view with only Retry, even though
the pull request was still perfectly reachable on GitHub. Rate limiting is the
common case, and retrying is exactly what does not help.

The error view now offers Open on GitHub, built from the saved project host
and pull request reference with no extra API call — so it works precisely when
the API does not. Error states for GitLab, Bitbucket, Azure DevOps, and unknown
providers are unchanged.

Adopted from T3 Code 7068e86f76e908c77ff04d1a684840257eab3a8a
(pingdotgg/t3code#8507).

Adaptation

One conflict, in docs/user/source-control.md: upstream's new bullet named
"T3 Code" twice. Resolved Pylon-first, keeping Pylon's product name and its
existing command-click bullet. Confirmed no T3 branding leaked into any adopted
file.

Verification

• vp test run openPullRequestLink.test.ts PullRequestsUnavailableState.test.tsx — 33 passed

• vp run -F @t3tools/web typecheck — clean

• gitHubPullRequestBrowserUrl builds a URL that gets opened in a browser, so I
  mutation-probed its two guards rather than trusting the tests existed:

  • dropping the ./.. path-segment check produces
    https://github.com/repository/pull/1 where null is expected — caught;
  • dropping the http:/https: protocol allowlist breaks the SCP-style remote
    path — caught.

  Both guards are therefore genuinely covered, in both directions.

Before/after image pending the consolidated real-client pass for this batch.
Upstream's own before/after screenshots are on pingdotgg/t3code#8507.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−6 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−7 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+1 B (+0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−63 B (−0.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−69 B (−1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−88 B (−0.2%)	66.4 KiB	✅
Claude	Live turn messages	11	9	−2 (−18.2%)	21	✅

Baseline: 3d6035f · PR result: 42a669e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Independent review pass. Two findings — one fixed, one documented.

Fixed in d7109b3ec — the other pull request error surface was a dead end.
The thread right panel shows a second PullRequestsUnavailableState when the
environment's server is too old to browse pull requests, with no retry and no
GitHub link. That contradicted the docs sentence this branch adds, which promises
the button whenever Pylon cannot load a GitHub pull request. The surface already
carries projectId, repository, and number, and ChatView already reads every
project, so it now builds the link with the same helper and the same
conditional-spread pattern the detail panel uses.

Documented — self-hosted GitHub installs still get no button. The helper gates
on identity.provider === "github". A self-hosted GitHub Enterprise host without
a github DNS label carries provider: "unknown", yet the server serves its pull
requests as GitHub after refineUnknownProjectKinds
(PullRequestService.ts:493-588). So the panel works normally and only the error
view comes up empty. Upstream's gating; widening it means deciding what
provider: "unknown" should imply for URL construction, which is a bigger call
than this PR.

The review cleared the parts that mattered: SCP and git:// remotes fall back to
the canonical host, malformed hosts and repository paths return null, credentials
are stripped via URL.origin, non-GitHub providers are correctly excluded,
url.pathname assignment percent-encodes stray characters, and Electron's
setWindowOpenHandler means target="_blank" really does reach the system
browser on desktop.

[rynfar]

A GitHub API error left the pull request view with only Retry, even though
the pull request was still perfectly reachable on GitHub. Rate limiting is the
common case, and retrying is exactly what does not help.

The error view now offers Open on GitHub, built from the saved project host
and pull request reference with no extra API call — so it works precisely when
the API does not. Error states for GitLab, Bitbucket, Azure DevOps, and unknown
providers are unchanged.

Adopted from T3 Code 7068e86f76e908c77ff04d1a684840257eab3a8a
(pingdotgg/t3code#8507).

Adaptation

One conflict, in docs/user/source-control.md: upstream's new bullet named
"T3 Code" twice. Resolved Pylon-first, keeping Pylon's product name and its
existing command-click bullet. Confirmed no T3 branding leaked into any adopted
file.

Verification

• vp test run openPullRequestLink.test.ts PullRequestsUnavailableState.test.tsx — 33 passed

• vp run -F @t3tools/web typecheck — clean

• gitHubPullRequestBrowserUrl builds a URL that gets opened in a browser, so I
  mutation-probed its two guards rather than trusting the tests existed:

  • dropping the ./.. path-segment check produces
    https://github.com/repository/pull/1 where null is expected — caught;
  • dropping the http:/https: protocol allowlist breaks the SCP-style remote
    path — caught.

  Both guards are therefore genuinely covered, in both directions.

Before/after image pending the consolidated real-client pass for this batch.
Upstream's own before/after screenshots are on pingdotgg/t3code#8507.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−6 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−7 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+1 B (+0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−63 B (−0.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−69 B (−1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−88 B (−0.2%)	66.4 KiB	✅
Claude	Live turn messages	11	9	−2 (−18.2%)	21	✅

Baseline: 3d6035f · PR result: 42a669e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Independent review pass. Two findings — one fixed, one documented.

Fixed in d7109b3ec — the other pull request error surface was a dead end.
The thread right panel shows a second PullRequestsUnavailableState when the
environment's server is too old to browse pull requests, with no retry and no
GitHub link. That contradicted the docs sentence this branch adds, which promises
the button whenever Pylon cannot load a GitHub pull request. The surface already
carries projectId, repository, and number, and ChatView already reads every
project, so it now builds the link with the same helper and the same
conditional-spread pattern the detail panel uses.

Documented — self-hosted GitHub installs still get no button. The helper gates
on identity.provider === "github". A self-hosted GitHub Enterprise host without
a github DNS label carries provider: "unknown", yet the server serves its pull
requests as GitHub after refineUnknownProjectKinds
(PullRequestService.ts:493-588). So the panel works normally and only the error
view comes up empty. Upstream's gating; widening it means deciding what
provider: "unknown" should imply for URL construction, which is a bigger call
than this PR.

The review cleared the parts that mattered: SCP and git:// remotes fall back to
the canonical host, malformed hosts and repository paths return null, credentials
are stripped via URL.origin, non-GitHub providers are correctly excluded,
url.pathname assignment percent-encodes stray characters, and Electron's
setWindowOpenHandler means target="_blank" really does reach the system
browser on desktop.

[rynfar]

A GitHub API error left the pull request view with only Retry, even though
the pull request was still perfectly reachable on GitHub. Rate limiting is the
common case, and retrying is exactly what does not help.

The error view now offers Open on GitHub, built from the saved project host
and pull request reference with no extra API call — so it works precisely when
the API does not. Error states for GitLab, Bitbucket, Azure DevOps, and unknown
providers are unchanged.

Adopted from T3 Code 7068e86f76e908c77ff04d1a684840257eab3a8a
(pingdotgg/t3code#8507).

Adaptation

One conflict, in docs/user/source-control.md: upstream's new bullet named
"T3 Code" twice. Resolved Pylon-first, keeping Pylon's product name and its
existing command-click bullet. Confirmed no T3 branding leaked into any adopted
file.

Verification

• vp test run openPullRequestLink.test.ts PullRequestsUnavailableState.test.tsx — 33 passed

• vp run -F @t3tools/web typecheck — clean

• gitHubPullRequestBrowserUrl builds a URL that gets opened in a browser, so I
  mutation-probed its two guards rather than trusting the tests existed:

  • dropping the ./.. path-segment check produces
    https://github.com/repository/pull/1 where null is expected — caught;
  • dropping the http:/https: protocol allowlist breaks the SCP-style remote
    path — caught.

  Both guards are therefore genuinely covered, in both directions.

Before/after image pending the consolidated real-client pass for this batch.
Upstream's own before/after screenshots are on pingdotgg/t3code#8507.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−6 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−7 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+1 B (+0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−63 B (−0.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−69 B (−1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−88 B (−0.2%)	66.4 KiB	✅
Claude	Live turn messages	11	9	−2 (−18.2%)	21	✅

Baseline: 3d6035f · PR result: 42a669e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Independent review pass. Two findings — one fixed, one documented.

Fixed in d7109b3ec — the other pull request error surface was a dead end.
The thread right panel shows a second PullRequestsUnavailableState when the
environment's server is too old to browse pull requests, with no retry and no
GitHub link. That contradicted the docs sentence this branch adds, which promises
the button whenever Pylon cannot load a GitHub pull request. The surface already
carries projectId, repository, and number, and ChatView already reads every
project, so it now builds the link with the same helper and the same
conditional-spread pattern the detail panel uses.

Documented — self-hosted GitHub installs still get no button. The helper gates
on identity.provider === "github". A self-hosted GitHub Enterprise host without
a github DNS label carries provider: "unknown", yet the server serves its pull
requests as GitHub after refineUnknownProjectKinds
(PullRequestService.ts:493-588). So the panel works normally and only the error
view comes up empty. Upstream's gating; widening it means deciding what
provider: "unknown" should imply for URL construction, which is a bigger call
than this PR.

The review cleared the parts that mattered: SCP and git:// remotes fall back to
the canonical host, malformed hosts and repository paths return null, credentials
are stripped via URL.origin, non-GitHub providers are correctly excluded,
url.pathname assignment percent-encodes stray characters, and Electron's
setWindowOpenHandler means target="_blank" really does reach the system
browser on desktop.

[rynfar]

A GitHub API error left the pull request view with only Retry, even though
the pull request was still perfectly reachable on GitHub. Rate limiting is the
common case, and retrying is exactly what does not help.

The error view now offers Open on GitHub, built from the saved project host
and pull request reference with no extra API call — so it works precisely when
the API does not. Error states for GitLab, Bitbucket, Azure DevOps, and unknown
providers are unchanged.

Adopted from T3 Code 7068e86f76e908c77ff04d1a684840257eab3a8a
(pingdotgg/t3code#8507).

Adaptation

One conflict, in docs/user/source-control.md: upstream's new bullet named
"T3 Code" twice. Resolved Pylon-first, keeping Pylon's product name and its
existing command-click bullet. Confirmed no T3 branding leaked into any adopted
file.

Verification

• vp test run openPullRequestLink.test.ts PullRequestsUnavailableState.test.tsx — 33 passed

• vp run -F @t3tools/web typecheck — clean

• gitHubPullRequestBrowserUrl builds a URL that gets opened in a browser, so I
  mutation-probed its two guards rather than trusting the tests existed:

  • dropping the ./.. path-segment check produces
    https://github.com/repository/pull/1 where null is expected — caught;
  • dropping the http:/https: protocol allowlist breaks the SCP-style remote
    path — caught.

  Both guards are therefore genuinely covered, in both directions.

Before/after image pending the consolidated real-client pass for this batch.
Upstream's own before/after screenshots are on pingdotgg/t3code#8507.

Claude Opus 5 via Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−6 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−7 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+1 B (+0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.5 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−63 B (−0.5%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−69 B (−1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.3 KiB	−88 B (−0.2%)	66.4 KiB	✅
Claude	Live turn messages	11	9	−2 (−18.2%)	21	✅

Baseline: 3d6035f · PR result: 42a669e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

Independent review pass. Two findings — one fixed, one documented.

Fixed in d7109b3ec — the other pull request error surface was a dead end.
The thread right panel shows a second PullRequestsUnavailableState when the
environment's server is too old to browse pull requests, with no retry and no
GitHub link. That contradicted the docs sentence this branch adds, which promises
the button whenever Pylon cannot load a GitHub pull request. The surface already
carries projectId, repository, and number, and ChatView already reads every
project, so it now builds the link with the same helper and the same
conditional-spread pattern the detail panel uses.

Documented — self-hosted GitHub installs still get no button. The helper gates
on identity.provider === "github". A self-hosted GitHub Enterprise host without
a github DNS label carries provider: "unknown", yet the server serves its pull
requests as GitHub after refineUnknownProjectKinds
(PullRequestService.ts:493-588). So the panel works normally and only the error
view comes up empty. Upstream's gating; widening it means deciding what
provider: "unknown" should imply for URL construction, which is a bigger call
than this PR.

The review cleared the parts that mattered: SCP and git:// remotes fall back to
the canonical host, malformed hosts and repository paths return null, credentials
are stripped via URL.origin, non-GitHub providers are correctly excluded,
url.pathname assignment percent-encodes stray characters, and Electron's
setWindowOpenHandler means target="_blank" really does reach the system
browser on desktop.