[Fryuni]

Problem

The fork is 896 commits behind upstream/main. This sync keeps the features recorded in docs/adr and uses upstream's implementation wherever it can.

Change

Merged pingdotgg/t3code main at 8d3b061121fe65669d5d43d011b48cd3027a4108. 100 files conflicted. Most conflicts came from three upstream changes: pingdotgg#22557 deleted about 258k lines of low-signal tests, ChatView and the command palette were split into hooks, and pingdotgg#21032 reworked where new worktrees start.

Upstream implemented part of two ADRs, and the fork now uses upstream's version

• ADR 0009, start from upstream. Upstream fix(server): new worktrees fetch their base branch's own remote pingdotgg/t3code#21032 renamed Start from origin to Start from remote. It now fetches the remote the base branch tracks, the remote an explicit ref names (upstream/main), or origin. ADR 0009 said to drop the fork's upstream source once upstream could start from a remote other than origin, so the fork's version is gone:
  • Removed: startFromRemote, WorktreeStartRemote, resolveWorktreeStartRemote, the status remoteNames, and GitWorkflowService.resolveWorktreeBase. This covers server, web, mobile, MCP tools and agent instructions.
  • Saved data still loads. Scheduled tasks and launch strategies drop the retired key, and the fork always stored startFromOrigin beside it. I read the live database read-only: all six stored tasks have startFromOrigin: true. Web drafts saved with "origin" keep Start from remote on. Mobile drafts and queued tasks fall back to the configured default.
  • Still kept on top of upstream's fetch: the fetch-stage detail (origin/main at abc1234), the "not found, using local branch" warning, and the exact-match-first ref search.
  • Lost: upstream falls back to the local branch when the remote lacks it. The fork's upstream choice failed the launch instead.
• ADR 0022, checkouts from settings.
  • Upstream fix(web): copy to machine clones the fork, not its upstream pingdotgg/t3code#22492 added RepositoryOrigin.remoteUrl, the same field the fork had added, so the fork keeps upstream's.
  • Upstream feat(web,server): add a project to another machine from Run on, .env files included pingdotgg/t3code#22180/fix(web,server): adding a project to another machine takes you there, with no toasts and the right favicon pingdotgg/t3code#22254 added a dialog that clones a project onto another machine from Run on. Web's settings Add checkout now opens that dialog instead of routing through the command palette. Its targets come from upstream's useAddProjectTargets, which means two losses on web: machines without clone permission are no longer listed as disabled, and projects without a remote get no folder fallback.
  • The dialog now strips credentials from the URL it clones. This one-line fork change also covers Run on. Upstream's cloneUrlForProtocol passes a same-protocol URL through unchanged, token included.
  • Mobile has no such dialog. Its Check out on rows now sit in upstream's always-visible Checkouts section.

Other upstream overlaps (ADR notes added)

• ADR 0021, desktop catalog keys. Upstream merged its own Beta-rename catalog recovery (fix(desktop): saved connections survive the Beta rename on macOS and Linux pingdotgg/t3code#20907), then reverted it (revert: "fix(desktop): saved connections survive the Beta rename on macOS and Linux" (#20907) pingdotgg/t3code#22219) because existing installs could not decrypt their catalogs. The fork keeps its Linux migration.
• ADR 0002, Forgejo identity. Upstream fix(shared): recognise Azure DevOps Server pull request links pingdotgg/t3code#14626 gives Azure DevOps Server links an authority too. GitManager's PR repository key now takes the authority shortcut only for Forgejo, skipping _git repositories, and a new test covers it. fix(server): Forgejo and GitCafe pull requests link to their threads again pingdotgg/t3code#22937's Forgejo /pulls/ case keeps the port, as ADR 0002 requires.
• ADR 0016, scheduled-task options. The shared target resolver uses fix(server): preserve subagent reasoning effort and fast mode pingdotgg/t3code#16595's per-option merge. The web dialog's options picker follows perf(web): typing no longer re-renders the traits picker or attach button pingdotgg/t3code#23040's new prompt props.
• ADR 0011, release source. Mobile update checks now read the fork's latest release through upstream's public release pages (fix(mobile): check for server updates without GitHub's API rate limit pingdotgg/t3code#17900). Upstream's new outdated-server offer (fix(mobile): update outdated servers and respect provider permissions pingdotgg/t3code#21402) passes releaseRepository too.

Fork code re-applied on upstream's refactors

• Create new branch (ADR 0008) moves into upstream's useComposerSelection/useComposerSend. The palette's "New thread on branch" moves into the split palette.
• Mobile's project-only base-branch write (ADR 0009) goes through useSettingsWriter.
• ADR 0014's PR-page navigation and ADR 0002's PR-list matching follow the page into its new logic modules.
• Upstream's new t3code/require-disposable-render and prefer-effect-fn rules flagged five fork files. Four browser tests (ADRs 0004, 0014, 0018 and shared PR summaries) now use await using screen = await render(...). The ADR 0021 safe-storage method uses Effect.fn.

Tests

• Base tests that test: delete 11k low-signal tests so CI runs faster and flakes less pingdotgg/t3code#22557 deleted stay deleted. Tests the fork added stay, adapted to upstream's code. The only exceptions are tests that covered startFromRemote alone.

CI (ADR 0011)

• Upstream-only workflows stay deleted, and so does upstream's new vercel-deployment-output.test.cjs, which reads them.
• ci.yml takes upstream's Electron download cache and the new Expo GraphQL generate --check step.
• Upstream fix(build): pin Node 26.12.1 for development and standalone releases pingdotgg/t3code#23165 now requires native single-executable builds to run on engines.node (26.12.1). server-linux-release.yml drops its VP_NODE_VERSION: 26.8.2 pin, which would now fail the build.
• ci-changes.cjs is back, because upstream's vp run check:changed imports it. The ci-changes action stays dropped.

Follow-ups after the first CI run

• Knip: upstream test: delete 11k low-signal tests so CI runs faster and flakes less pingdotgg/t3code#22557 deleted the tests that were knip's only path to scripts/resolve-nightly-release.ts and to isRemoteReachableHost in the fork. knip.jsonc now lists the resolver as an entry, since release-smoke.ts runs it by path. The helper is no longer exported, because the fork's auth policy uses isRemoteReachableServer.
• The fork's PR-link and sidebar PR-scope browser tests seeded atoms that are derived from the connection catalog: the primary environment, server configs and project list. When the catalog finished loading mid-test under CI load, it replaced the seeded values, so these tests failed intermittently. They now seed plain atoms, as upstream's tests do. The full web browser project passed twice locally (59 files, 196 tests).

git show --remerge-diff on the merge commit (16944c7) shows the whole fork-side resolution. ADRs now compare against 8d3b06112.

Scope and approval

This is a maintainer-requested sync of the fork onto upstream. Every fork divergence is covered by an ADR in docs/adr.

Verification

• Typecheck: clean for contracts, shared, client-runtime, provider-core, source-control-forgejo, server, web, mobile, desktop and scripts.
• Format and lint: vp fmt --check is clean on all 253 files that differ from upstream. vp lint on them has 0 errors; the warnings are upstream's.
• Tests: I ran every test file that differs from upstream, the tests beside every changed file, and node --test .github/scripts/*.test.cjs. Browser tests ran in real Chromium.
  • Server: 26 fork test files (771 tests) pass. Another 50 files beside changes give 390 passing and 1 failing. The failure is environmental: upstream's unchanged pinnedRuntime test copies /bin/sleep, which this NixOS machine lacks.
  • Web: 20 fork test files (515 tests) and 62 nearby files (463 tests) pass. The 4 rewritten browser tests (33 tests) also pass.
  • Mobile: 45 files (1350 tests) pass, and the React Compiler coverage ratchet holds.
  • contracts, shared, client-runtime, forgejo, scripts and desktop: 25 files (417 tests) pass.
• Generated code: both GraphQL generate --check steps pass.
• Not run: repo-wide checks (vp check, knip, the full suites), per AGENTS.md; CI runs them. I did not do a manual UI pass in a real client.

Model: Claude Opus 5.5; harness: Claude Code in T3 Code.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T11:02:23.650274Z	a0e75f0	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[fryuni-proval]

Thanks for this sweep. It's a big one, and several pieces land well: the Tailscale status cache keyed on addresses, SIGKILL exit reporting, and the narrow 422 catch in the thread-transfer report are all careful work.

Overview

Summary. This PR covers several areas:

• CI: jobs are now gated by changed packages, using ci-changes.cjs for check:changed; installs are full and cached; Node now comes only from engines.node.
• Desktop tooling: the Electron runtime install tries install.js first and keeps a curl fallback; the pgrep-escaping test is new.
• Desktop runtime fixes: the Linux device scale factor is persisted; the Tailscale status cache is keyed by address; SIGKILL exits are reported; there are new IPC methods revealWindow and getRelayTelemetryEnabled; Zed user@host links are allowed.
• Effect.fn migration and docs across desktop services.

It also deletes a large number of tests for behaviour that this PR leaves unchanged and still running. That is the main risk here. Most of the Main Issues below are about coverage lost on paths users hit every day, not about bugs in the new code.

Good points

• 🟢 DesktopServerExposure.ts replaces the single TTL read with a capacity-1 Cache keyed by Tailscale IPv4 addresses. Status refreshes right away when the network changes, and the CLI spawns (and their macOS TCC prompts) stay rare. The new test checks both refresh and reuse.
• 🟢 thread-transfer-report.cjs only swallows the exact 422 No commit found for SHA case. Its table test checks that a generic 422 and a 403 rate limit still reject.
• 🟢 DesktopBackendManager.ts maps the spawner's signal-exit error to killed by SIGKILL instead of a misleading exit-status error, using the same regex as effect-acp, and has a test for the exact result.
• 🟢 ci-changes.cjs fails open: unknown or unowned paths run everything, so a missing mapping costs CI minutes instead of skipping checks.

Main Issues

• ⚫️ apps/desktop/src/app/DesktopEarlyElectronStartup.ts:184-197: the saved linux-device-scale-factor is re-applied forever and there is no way to clear it (a one-way door).
• ⚫️ apps/desktop/src/backend/DesktopBackendManager.test.ts:274: tests for restart backoff, the preflight cap, readiness re-probe, stop/restart races and the quit bound were deleted, while that code is still live.
• ⚫️ apps/desktop/src/backend/DesktopServerExposure.test.ts:363: the local-only "no Tailscale spawn" guard (DesktopServerExposure.ts:579) lost its only test, along with the typed-error and persistence-chain tests.
• ⚫️ apps/desktop/src/ipc/DesktopIpcHandlers.ts:156: the new revealWindow has no test, and the only test that the IPC sender is forwarded (DesktopIpc.test.ts) was deleted.
• ⚫️ apps/desktop/src/electron/ElectronShell.test.ts:87: the widened Zed regex has no positive user@host test, and the vscode command-URI rejection test is gone.
• ⚫️ .github/scripts/check-nightly-release.test.cjs:123 (old side): the six-hour boundary, identical skip, no-nightly guard and positive release-source tests were removed, but the script is unchanged.

If these deletions are deliberate (for example, a suite trim to satisfy the new no-polling lint rules), please say so in the PR description so maintainers can accept the coverage loss knowingly.

Additional Notes

• apps/desktop/src/app/DesktopObservability.test.ts line 283: only the "SDK disabled" export test is left. Consider restoring one positive OTLP export test and the "no endpoint means no requests" test.
• apps/desktop/src/backend/tailscaleEndpointProvider.ts line 51: the tests for the Serve-reachable HTTPS endpoint, the absent-local-address filter and the single readStatus call were removed, but that code is unchanged.
• apps/desktop/src/app/DesktopEarlyElectronStartup.test.ts line 81: the negative Hyprland color-management cases were dropped, and so were the URL-handler stall/timeout tests in DesktopLinuxUrlHandler.test.ts.
• apps/desktop/src/backend/DesktopBackendConfiguration.ts line 420: setting stagedFailure on a prepareRuntime failure changes which reason is shown when the mounted fallback also fails fatally. Consider a test, and including both reasons.
• apps/desktop/src/backend/DesktopLocalEnvironmentAuth.test.ts line 198: the transient 503 bootstrap retry test was removed, while TRANSIENT_BOOTSTRAP_STATUS_CODES is still live.
• .github/scripts/ci-changes.cjs line 129: decide() has no sibling *.test.cjs, even though CI already runs node --test .github/scripts/*.test.cjs.
• .github/scripts/ci-changes.cjs line 67: MOBILE_NATIVE duplicates the regex in ci.yml, and the two have already drifted apart. It also references a non-existent .github/actions/ci-changes/ path.
• .github/scripts/thread-transfer-report.test.cjs line 55: the renderComment and unsupported-scenario tests were removed, but the comment markers are still used by upsertCommentForCurrentHead.
• apps/desktop/scripts/verify-preload-bundle.test.mjs line 63: the require?.("node:fs") rejection test was removed. It is the most likely way to slip past the sandbox-import check.
• apps/desktop/scripts/electron-launcher.mjs line 263: the macOS Info.plist privacy strings and codesign arguments no longer have test coverage now that their helpers are un-exported.
• apps/desktop/src/app/DesktopCliCommand.ts line 90: the large-foreign-binary guard in isOurLink lost its test, and that test protects uninstall from removing links it did not create.
• apps/desktop/src/electron/ElectronWindow.test.ts line 105: the module-load guard and the sendAll tests were removed, even though sendAll was just converted to Effect.fnUntraced.

[fryuni-proval]

Thanks for pulling this sync together. It covers a lot of ground, and the targeted fixes are well thought out.

Overview

Summary
This is a large upstream sync (about 3.4k files). For the desktop app it brings:

• A Tailscale status cache keyed by tailnet IPv4 addresses.
• Signal exits (e.g. SIGKILL) reported as a normal backend exit.
• Zed remote links that include a user@.
• An Electron runtime install that tries the @electron/get cache first, then falls back to curl with timeouts.
• A persisted Linux --force-device-scale-factor.
• The revealWindow and relay-telemetry IPC methods.
• More Effect.fn tracing, plus narrowed exports.

On the CI side, it adds change-based job gating (ci-changes.cjs), Node versioning driven by engines.node, and a 422 soft-skip in the thread-transfer report.

The main risk is not in the new code. The sync deletes a large number of tests for code it leaves unchanged, and some of the new behavior has no positive test.

Good points

• 🟢 The Tailscale cache key is the sorted, de-duplicated list of tailnet IPv4 addresses (apps/desktop/src/backend/DesktopServerExposure.ts:420-458). MagicDNS refreshes after a tailnet switch, the 60s protection against TCC prompts is kept, and the new test covers both refresh and reuse.
• 🟢 The 422 skip only applies when the status and the exact No commit found for SHA message both match (.github/scripts/thread-transfer-report.cjs:257). The test confirms that other 422s and 403s are still rethrown.
• 🟢 cleanupStaleDevApps now escapes regex metacharacters and anchors the pkill pattern (apps/desktop/scripts/dev-electron.mjs:97). A pgrep-only test checks the pattern against tricky paths, in line with AGENTS.md's "killing by pattern" warning.
• 🟢 The release workflow drops the stale VP_NODE_VERSION pin in favor of engines.node (.github/workflows/server-linux-release.yml:99). It can no longer drift from the SEA build's Node check.

Main Issues

• ⚫️ apps/desktop/src/app/DesktopEarlyElectronStartup.ts:184-197: once the forced Linux scale factor is persisted, nothing can clear it. This applies to every Linux install, not only AppImage.
• ⚫️ apps/desktop/src/electron/ElectronShell.ts:26: the widened Zed regex has no positive test, because the only test that accepted Zed links was deleted.
• ⚫️ apps/desktop/src/backend/DesktopServerExposure.test.ts (old 463-478): the test that "local-only never spawns tailscale" was deleted, and that guard is what prevents the TCC prompt.
• ⚫️ apps/desktop/src/ipc/DesktopIpc.test.ts (deleted): the sender-forwarding test is gone, but revealWindow and pasteAsText rely on event.sender.id.
• ⚫️ apps/desktop/src/backend/DesktopBackendManager.test.ts:274: the restart, stop, preflight-cap and quit-bounding lifecycle tests were removed without replacement.
• ⚫️ .github/scripts/thread-transfer-report.test.cjs (old 56-87): the renderComment and V2-scenario tests were removed, but the production code is unchanged.

Additional Notes

• apps/desktop/scripts/ensure-electron-runtime.mjs line 124: the spawnSync call to install.js has no timeout. A stalled download can hang ensure:electron and never reach the bounded curl fallback. timeout: 300_000 would fall through cleanly.
• .github/scripts/check-nightly-release.test.cjs lines 64 and 109: the six-hour boundary, identical-skip, basehead-format and happy-path release-source tests were removed. The logic in check-nightly-release.cjs is unchanged.
• .github/scripts/ci-changes.cjs line 129: decide() (dependent closure, TEST_ONLY_DEPS ordering, fail-open null) has no test. A small ci-changes.test.cjs would run automatically through the existing node --test step.
• apps/desktop/src/backend/DesktopBackendConfiguration.ts line 420: the new failedStaged(stagedFailure) branch, where staging fails and the mounted tree then fails fatally, has no test.
• apps/desktop/src/backend/DesktopBackendManager.ts line 579: the regex that parses Effect's signal message duplicates packages/effect-acp/src/_internal/stdio.ts:62. A shared helper would keep the two from drifting apart.
• apps/desktop/src/app/DesktopCliCommand.ts line 91: the test for the 16 KB size guard in isOurLink ("does not read a large binary another t3 links to") was deleted in the same change that rewrote the function.
• apps/desktop/src/app/DesktopAppActivationBroker.test.ts line 52: no desktop test checks request-timeout or renderer requeue anymore. DesktopAppActivation.test.ts line 83 no longer checks that close() unlinks its own socket.
• apps/desktop/src/app/DesktopObservability.test.ts line 120: tests for OTLP endpoint precedence and "no network when unconfigured" were removed.
• apps/desktop/src/app/DesktopLegacyLocalStorage.ts line 37: the new span names (DesktopLegacyLocalStorage.*, DesktopCliCommand.*) don't follow the module's desktop.* convention.

[Fryuni]

Replying to the review overview: every main issue and additional note is on a file identical to upstream/main (8d3b06112). The test deletions are upstream's deliberate trims (pingdotgg#22557, pingdotgg#22589), and the description already says the fork keeps them deleted. Restoring upstream tests or changing upstream behavior is out of scope for this sync.

The two ci-changes.cjs notes refer to upstream's script, which the fork restored unchanged only because upstream's local vp run check:changed imports it. Fork CI does not run it: ci.yml keeps the fork's own layout and mobile-native regex (ADR 0011), so the regex drift and the missing .github/actions/ci-changes/ path only affect that local tool's job mapping.

[fryuni-proval]

Thanks for the follow-up. This push is small and tidy, and I found nothing new that needs changing.

Overview

Summary
The push changes five files:

• Flaky browser tests: Two browser tests seed state that comes from the connection catalog. The catalog can finish loading mid-test and overwrite those seeded values. Both tests now use plain atoms instead.
• Knip: scripts/resolve-nightly-release.ts is now a knip entry.
• isRemoteReachableHost: It is no longer exported from apps/server/src/auth/utils.ts.
• ADR 0011: Updated to match.

The inline threads from the last review (removed tests, the device scale factor that can't be cleared, Zed allowlist coverage) aren't touched by this push. I haven't reposted them.

Good points

• 🟢 In apps/web/src/lib/openPullRequestLink.behavior.browser.test.tsx (lines 55-58), the test replaces only readProjects and keeps everything else in ../state/entities real. So readThreadShell and the repository matching in openPullRequestLink.ts:138 still run for real. state.projects is reset in setup() (line 192) and set in mount() (line 211), so one test can't leak projects into the next. That removes the flakiness without weakening what the test covers.
• 🟢 The replacement for primaryEnvironment (SidebarChrome.browser.test.tsx:58-63) has a comment explaining why it exists. It only needs to provide primaryEnvironmentIdAtom, because apps/web/src/state/primaryEnvironment.ts:5 exports nothing else. That makes it unlikely someone deletes it later and brings the flaky failure back.
• 🟢 The new knip entry has a comment (knip.jsonc:24-25) explaining why it's needed: scripts/release-smoke.ts:258 runs the resolver by file path, and knip can't follow that. ADR 0011 (line 42) gives the same reason, so the config and the decision record agree.

Main Issues

None in this push.

Additional Notes

• apps/server/src/auth/utils.ts line 72: making isRemoteReachableHost private is safe. It's only called inside this module (lines 44, 99, 100). The only other place it appears is a comment in apps/web/src/components/settings/pairingUrls.ts line 22, and that comment is still accurate.

[Fryuni]

Replying to the second overview: its main issues are the six threads I already declined and resolved. The additional notes cover ensure-electron-runtime.mjs, check-nightly-release.test.cjs, ci-changes.cjs, DesktopBackendManager.ts, DesktopCliCommand.ts, the activation and observability tests, and DesktopLegacyLocalStorage.ts. Each of those files is identical to upstream/main (8d3b06112).

The one exception is DesktopBackendConfiguration.ts. The fork changes it only to pass --public-url to WSL backends (ADR 0010); the failedStaged(stagedFailure) branch is upstream's. These belong upstream rather than in this sync, so I'm leaving them as they are.

[chatgpt-codex-connector]

💡 Codex Review

t3code/apps/web/src/hooks/useOpenPullRequestList.ts

Lines 59 to 62 in a0e75f0

	? [group.representative, ...group.members.map((member) => member.project)].find(
	(candidate) =>
	serverConfigs.get(candidate.environmentId)?.environment.capabilities.pullRequests ===
	true,

Select a connected checkout for the PR scope

When a grouped project has a checkout on a disconnected primary environment and another on a connected environment, this search examines the primary representative first and checks only its cached capability. Because enabled environments retain their server configuration while offline, the hook can scope the pull-request page to the disconnected checkout, leaving it unable to query even though a usable checkout exists. Prefer connected candidates before falling back to cached/offline ones.

AGENTS.md reference: AGENTS.md:L65-L75

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Fryuni]

Re the Codex P2 on useOpenPullRequestList.ts lines 59-62 (prefer a connected checkout for the sidebar PR scope): I'm declining it for this sync. This PR doesn't touch the file, which is identical on main (33cf90ba0), so the gap already exists there. A fix would change how the sidebar's PR scope chooses between checkouts (ADR 0014), which is a behavior change rather than a merge resolution. It should be its own PR.