chore: merge upstream through 75d63d64c

[andrewcai8]

Merge this with a merge commit. Do not squash or rebase. A squash drops upstream's history, and the next sync would conflict on all 58 commits again.

This is the second catch-up merge from pingdotgg/t3code, through 75d63d64c5 (upstream/main today). After it lands, the fork has every upstream commit and the daily sync-upstream workflow can fast-merge again. It includes upstream's Cursor/OpenCode/Antigravity usage readers (e5a46d6c5), which duplicated the fork's Cursor usage history. This PR converges the fork on upstream's version of that feature.

A second, separate commit makes a failed daily sync open or update a single issue titled "Upstream sync needs a manual merge", so the fork cannot drift silently again.

Cursor usage: what changed

For users of the fork's host:

• The Usage page reads Cursor history through upstream's reader (cursor.com dashboard). It still reads every Cursor account configured on the server, not just the host's own login. Each account counts once, even when several instances share a login.
• On macOS, Cursor's keychain login works after Enable Cursor usage, as upstream designed.
• Limits shows upstream's three Cursor pools: Overall, Cursor Models and Other Models. The fork's single "Monthly usage" window is gone. Each pool keeps the fork's billing-cycle pace marker.
• Cloud chats choose a Cursor account by its Overall pool.

For whoever maintains this next: the fork's Cursor usage code is deleted, not kept alongside upstream's.

• Deleted: usage/cursorUsage.ts, provider/cursorDashboard.ts, their tests and two fixtures.
• Deleted contract fields: the account/unavailable fingerprint kinds, bucket sourceId, CURSOR_MONTHLY_WINDOW_ID, budgetUsd, and auth.accountIdentity (from the fork's GetMe call).
• Deleted helpers: displayUsageLimits, and the fork's exemption of Cursor from custom model prices.
• What stays on top of upstream:
  • The per-instance loop in UsageService.ts.
  • The settled-history cache, now usage/cursorAccountHistory.ts wrapping upstream's readCursorAccountUsage. It keeps rows older than an hour and re-reads only the unsettled tail once its 60s trust has passed. It drops the cache if a login now names a different account.
  • Routing's headroomWindows in packages/shared/src/usageLimits.ts.

Why routing ranks Cursor by the Overall pool

Cloud chats run Cursor's default model, auto (DEFAULT_MODEL_BY_PROVIDER). Upstream's pool descriptions say Auto "can use either pool", and Overall is "combined usage across both allowances". Overall is therefore the remaining capacity for the model agents actually run. Ranking by the tightest pool would mark an account spent while its Auto turns still succeed; the fork already saw the API pool read 100% while Auto worked (#29). If a report lacks Overall, the roomier of the two pools stands in, for the same reason. The comment on headroomWindows says this too.

Decision log

19 files conflicted, with 33 hunks.

Conflict	Resolution	Why
packages/contracts/src/usage.ts	Upstream's v6.	Both sides bumped USAGE_CONTRACT_VERSION to 6 with different Cursor shapes. Upstream's (sourcePath, the enableCursorKeychain action, the cursor-account:<hash> fingerprint) wins so future syncs stay clean.
packages/shared/src/usageMerge.ts (6 hunks), usageMerge.test.ts	Upstream's.	The fork's changes there were only for its Cursor history.
packages/shared/src/usageLimits.ts	Upstream's CURSOR_USAGE_WINDOWS and displayLimitWindows, plus the fork's rankAccounts/isAccountSpent, with a Cursor rule for which window counts.	See the routing section above.
apps/server/src/usage/UsageService.ts (5 hunks)	Upstream's file, with its single-login Cursor block replaced by a loop over every Cursor instance. Keeps the fork's addTranscript out-of-window fast path and a scan key that includes providerInstances.	Hosts with several Cursor accounts need each one read. Upstream reads only the default login.
usageAggregation.ts (2 hunks)	Upstream's sourcePath bucket key, plus the fork's admits window check.	Keeps the perf work from #35.
cursorUsageLimits.ts, CursorDriver.ts	Upstream's pools and keychain setting, passed through from server settings. Keeps the fork's logged failure (#43), billing-cycle pace marker, log annotation and skills discovery.
CursorProvider.test.ts (3 hunks)	Upstream's pool and keychain tests. Keeps the fork's logging test. The Limits-window test is rewritten as a pace-marker test.
UsageService.test.ts (2 hunks)	Upstream's file, plus a new test: three Cursor instances on two accounts give two cursor.com sources and one total per account.
ChatView.tsx (3 hunks)	Upstream moved queued sends out of onSend. The fork's heldCloudSend stays in onSend, and #77's buildCloudHandoff is unchanged.	heldCloudSend holds the live draft of a cloud chat whose box is still provisioning. That thread has no server thread yet, so it never has a queue, and sendQueuedMessage.ts does not need it. What queued sends did lose was the fork's handoff hold, so QueuedMessageSender and Send now wait out a handoff (new test).
__root.tsx	Mount both ThreadLifecycleOverlayCoordinator and QueuedMessageSender.
ProviderCommandReactor.ts	Upstream's TerminalManager import, plus the fork's revival prompt. The error guards the fork removed stay removed.
Usage UI: web UsagePage/usageProviders, mobile UsageLimitsPooled/usageProviders	Upstream's. Keeps the fork's "to now" label and selected-environment status (#36). The fork's Cursor paragraph and coverage notices are dropped.
apps/server/package.json, pnpm-lock.yaml	Both @namespacelabs/sdk and @napi-rs/keyring. The lockfile is regenerated with vp i.
docs/user/usage.md	Upstream's, plus one sentence that each Cursor account on the server is read from its own login.

Also in the merge commit:

• A comment next to the migration list in Migrations.ts gives the numbering rule for later syncs: upstream migrations numbered 055 or higher become 058 or higher here, and one whose contents match a fork migration is matched by rename. Upstream adds no migrations in this range.
• usage.query.test.tsx mocks upstream's new providersValueAtom.
• UsageProviderChart.test.ts is upstream's.

Follow-up commit: test(client-runtime) gives persistence.test.ts a 30s timeout. That test comes from upstream (pingdotgg#13767) and samples 2,000 generated snapshots. It runs in under a second locally and on upstream's 8-vCPU runners. It timed out at 7s twice in a row on this fork's shared ubuntu-latest runners (it is CPU-bound, not waiting on anything).

Wire compatibility

Both the old fork and upstream call their contract v6, but the Cursor shapes differ. A client built from this branch cannot decode Cursor sources from a server that has not updated. It shows that environment as "could not report usage" until the server updates. Web clients update with the host. Only an older mobile build would see this, until the host deploys.

Verification

• Targeted vp test run:
  • Server: apps/server/src/usage (including the new cursorAccountHistory.test.ts), CursorProvider, CursorDriver, cursorCredentialStore, cursorCredentialPath, ProviderCommandReactor, ProvisioningProviderProfile, accountLoad, claudeUsageLimits, 057_ProjectionThreadsAutoSettleDisabledAt, handoff. All pass except two Cursor skills tests, which fail the same way on origin/main on macOS (/var vs /private/var).
  • Shared, client-runtime, web and mobile: usageLimits, usageMerge, usageFormat, client-runtime usage, ChatView.logic, usage.query, settingsSearch, components/usage, queuedMessageStore, QueuedMessageSender, and mobile UsageLimitsSection and usageEnvironmentSelection. All pass.
• vp lint on the touched files: no errors.
• A script checked every named relative and @t3tools/* import in the 256 changed TS files, and all resolve. No identifier that upstream removed is still referenced.
• I ran the sync-upstream.yml steps with a fake gh. A failed merge creates the issue when none is open and comments on it when one is.
• I did not typecheck locally. CI (Check, Test, Test Server 1-3) is green on f966dfe08.

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	+24 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+6 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+18 B (+0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	56.2 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	+12 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−2 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+14 B (+0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: 714e4c7 · PR result: f966dfe · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 114.0 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.