Sync upstream 2fbd4318fc (stage 2: React Compiler rollout)

AGENTS.md

@@ -106,9 +106,13 @@ pnpm --filter @t3tools/source-control-core --filter @t3tools/source-control-gitl
 pnpm build
 ```
 
-Backend boundary changes need focused tests; `apps/coder-gateway/src/boundaryGuard.test.ts` checks
-the gateway's URLs, connections, and spawn targets. Do not launch browsers or use computer-control
-tooling without explicit user permission. Do not test against or modify `~/.t3/userdata`.
+`pnpm test:coder` includes upstream's web `browser` Vitest project, which runs headless Chromium
+through Playwright on the development machine; install it once with
+`pnpm --filter @t3tools/web exec playwright install chromium`. Backend boundary changes need
+focused tests; `apps/coder-gateway/src/boundaryGuard.test.ts` checks the gateway's URLs,
+connections, and spawn targets. Apart from that test project, do not launch browsers or use
+computer-control tooling without explicit user permission. Do not test against or modify
+`~/.t3/userdata`.
 
 ## Working practices
 

apps/server/src/coderWs.ts

@@ -59,6 +59,7 @@ import * as ScreenshotArtifacts from "./workspace/ScreenshotArtifacts.ts";
 import { readTurnItemAssetChunk } from "./workspace/TurnItemAssets.ts";
 import * as WorkspaceEntries from "./workspace/WorkspaceEntries.ts";
 import * as WorkspaceFileSystem from "./workspace/WorkspaceFileSystem.ts";
+import * as KnownWorkspaces from "./workspace/KnownWorkspaces.ts";
 import type * as WorkspacePaths from "./workspace/WorkspacePaths.ts";
 
 /** The methods only the helper serves; `ws.ts` builds every other `CoderWsRpcGroup` method. */
@@ -111,7 +112,8 @@ interface UpstreamHelpers {
   readonly projectFileFailureContext: (
     error:
       | WorkspaceFileSystem.WorkspaceFileSystemError
-      | WorkspacePaths.WorkspacePathOutsideRootError,
+      | WorkspacePaths.WorkspacePathOutsideRootError
+      | KnownWorkspaces.UnknownWorkspaceError,
   ) => {
     readonly failure: ProjectFileFailure;
     readonly resolvedPath?: string;

apps/server/src/git/GitManager.test.ts

@@ -1332,7 +1332,7 @@ it.layer(GitManagerTestLayer)("GitManager", (it) => {
       yield* runGit(repoDir, ["push", "-u", "upstream", "main"]);
       yield* runGit(repoDir, ["checkout", "-b", "develop"]);
       yield* runGit(repoDir, ["push", "-u", "upstream", "develop"]);
-      yield* runGit(remoteDir, ["symbolic-ref", "HEAD", "refs/heads/develop"]);
+      yield* runGit(remoteDir, ["--git-dir=.", "symbolic-ref", "HEAD", "refs/heads/develop"]);
       yield* runGit(repoDir, ["remote", "set-head", "upstream", "develop"]);
 
       const { manager } = yield* makeManager({
@@ -3906,9 +3906,13 @@ it.layer(GitManagerTestLayer)("GitManager", (it) => {
         ),
       ).toContain("?? .vercel/");
       expect(
-        yield* runGit(remoteDir, ["log", "-1", "--pretty=%s", "feature/push-dirty"]).pipe(
-          Effect.map((output) => output.stdout.trim()),
-        ),
+        yield* runGit(remoteDir, [
+          "--git-dir=.",
+          "log",
+          "-1",
+          "--pretty=%s",
+          "feature/push-dirty",
+        ]).pipe(Effect.map((output) => output.stdout.trim())),
       ).toBe("Push dirty branch");
     }),
   );
@@ -3958,7 +3962,11 @@ it.layer(GitManagerTestLayer)("GitManager", (it) => {
       expect(result.pr.number).toBe(303);
       expect((yield* runGit(repoDir, ["status", "--porcelain"])).stdout).toBe(statusBefore);
       expect(
-        (yield* runGit(remoteDir, ["rev-parse", "feature/create-pr-only"])).stdout.trim(),
+        (yield* runGit(remoteDir, [
+          "--git-dir=.",
+          "rev-parse",
+          "feature/create-pr-only",
+        ])).stdout.trim(),
       ).toBe(headBefore);
       expect(
         glabCalls.some((call) =>
@@ -4675,7 +4683,7 @@ it.layer(GitManagerTestLayer)("GitManager", (it) => {
       const remoteDir = yield* createBareRemote();
       yield* runGit(repoDir, ["remote", "add", "origin", remoteDir]);
       yield* runGit(repoDir, ["push", "-u", "origin", "main"]);
-      yield* runGit(remoteDir, ["symbolic-ref", "HEAD", "refs/heads/main"]);
+      yield* runGit(remoteDir, ["--git-dir=.", "symbolic-ref", "HEAD", "refs/heads/main"]);
 
       const peerDir = yield* makeTempDir("t3code-git-peer-");
       yield* runGit(peerDir, ["clone", remoteDir, "."]);

apps/server/src/mcp/OrchestratorMcpService.activity.test.ts

@@ -27,6 +27,7 @@ import * as GitVcsDriver from "../vcs/GitVcsDriver.ts";
 import * as ThreadManagementService from "../orchestration-v2/ThreadManagementService.ts";
 import type * as McpInvocationContext from "./McpInvocationContext.ts";
 import * as OrchestratorMcpService from "./OrchestratorMcpService.ts";
+import { liveThreadShell } from "./McpToolAccess.testkit.ts";
 
 const layerOrchestratorService = OrchestratorMcpService.layer.pipe(
   Layer.provide(Layer.mock(ThreadLaunchService.ThreadLaunchService)({})),
@@ -363,6 +364,7 @@ it("taskStatus returns task.providerInstanceId rather than the driver kind", asy
 });
 
 it("readThread and sendToThread reach threads in other projects", async () => {
+  let parentShell: OrchestrationV2ThreadShell | null = null;
   let parentRuns: ReadonlyArray<unknown> = [
     makeRun({ id: RunId.make("run-parent-live"), ordinal: 1, status: "running" }),
   ];
@@ -435,7 +437,9 @@ it("readThread and sendToThread reach threads in other projects", async () => {
             Effect.succeed(
               threadId === foreignThreadId
                 ? (foreignProjection(threadId).thread as unknown as OrchestrationV2ThreadShell)
-                : null,
+                : threadId === parentThreadId
+                  ? parentShell
+                  : null,
             ),
           getTimelinePage: (threadId) =>
             Effect.succeed({
@@ -528,5 +532,74 @@ it("readThread and sendToThread reach threads in other projects", async () => {
       .deleteScheduledTask(makeScope(), { scheduledTaskId: ScheduledTaskId.make("task-foreign") })
       .pipe(Effect.flip);
     expect(staleDelete.code).toBe("parent_not_active");
+
+    // A background item keeps only its owning instance live, even after a switch.
+    const backgroundTasks = [
+      {
+        taskId: "background-subagent",
+        kind: "subagent" as const,
+        providerInstanceId: parentInstanceId,
+      },
+    ];
+    parentShell = {
+      ...liveThreadShell(parentThreadId, { activeRunId: null }),
+      pendingBackgroundTasks: backgroundTasks,
+    };
+    const backgroundSent = yield* service.sendToThread(makeScope(), {
+      threadId: foreignThreadId,
+      message: "background",
+    });
+    expect(backgroundSent.threadId).toBe(foreignThreadId);
+    const delegate = yield* service
+      .delegateTask(makeScope(), { task: "requires a run" })
+      .pipe(Effect.flip);
+    expect(delegate.code).toBe("parent_not_active");
+    const create = yield* service
+      .createThreads(makeScope(), { threads: [{ prompt: "requires a run" }] })
+      .pipe(Effect.flip);
+    expect(create.code).toBe("parent_not_active");
+    const secret = yield* service
+      .requestSecret(makeScope(), { label: "Secret", reason: "requires a run" })
+      .pipe(Effect.flip);
+    expect(secret.code).toBe("parent_not_active");
+
+    parentShell = { ...parentShell, providerInstanceId: customCodexInstanceId };
+    const switchedScope = {
+      ...makeScope(),
+      thread: { ...makeScope().thread!, providerInstanceId: customCodexInstanceId },
+    };
+    const switched = yield* service
+      .sendToThread(switchedScope, { threadId: foreignThreadId, message: "wrong owner" })
+      .pipe(Effect.flip);
+    expect(switched.code).toBe("parent_not_active");
+    const mismatched = yield* service
+      .sendToThread(makeScope(), { threadId: foreignThreadId, message: "stale provider" })
+      .pipe(Effect.flip);
+    expect(mismatched.code).toBe("parent_not_active");
+
+    // A fresh active run wins over the earlier inactive projection and empty roster.
+    parentShell = liveThreadShell(parentThreadId);
+    const restarted = yield* service.sendToThread(makeScope(), {
+      threadId: foreignThreadId,
+      message: "new run",
+    });
+    expect(restarted.threadId).toBe(foreignThreadId);
+
+    parentShell = {
+      ...parentShell,
+      activeRunId: null,
+      pendingBackgroundTasks: backgroundTasks,
+      archivedAt: now,
+    };
+    const archived = yield* service
+      .sendToThread(makeScope(), { threadId: foreignThreadId, message: "archived" })
+      .pipe(Effect.flip);
+    expect(archived.code).toBe("parent_not_active");
+
+    parentShell = { ...parentShell, archivedAt: null, pendingBackgroundTasks: [] };
+    const stopped = yield* service
+      .sendToThread(makeScope(), { threadId: foreignThreadId, message: "after stop" })
+      .pipe(Effect.flip);
+    expect(stopped.code).toBe("parent_not_active");
   }).pipe(Effect.provide(layer), Effect.runPromise);
 });

apps/server/src/mcp/OrchestratorMcpService.ts

@@ -50,6 +50,7 @@ import {
   type OrchestratorMcpThreadWaitInput,
   type OrchestratorMcpThreadWaitResult,
   type ProviderInteractionMode,
+  type ProviderInstanceId,
   type ProviderOptionDescriptor,
   type ProviderOptionSelection,
   type RuntimeMode,
@@ -199,6 +200,29 @@ function failure(code: OrchestratorMcpFailure["code"], message: string): Orchest
   return new OrchestratorMcpFailure({ code, message });
 }
 
+/**
+ * A caller's thread is live while it is not archived, runs on the caller's
+ * provider instance, and has an active run or a background subagent that
+ * instance started. A background subagent outlives its run and calls tools
+ * with its thread's credential, which is revoked when the provider process
+ * goes away.
+ */
+export const isLiveCallerShell = (
+  shell: Pick<
+    OrchestrationV2ThreadShell,
+    "archivedAt" | "activeRunId" | "providerInstanceId" | "pendingBackgroundTasks"
+  > | null,
+  providerInstanceId: ProviderInstanceId | undefined,
+) =>
+  shell !== null &&
+  shell.archivedAt === null &&
+  shell.providerInstanceId === providerInstanceId &&
+  (shell.activeRunId !== null ||
+    (shell.pendingBackgroundTasks?.some(
+      (task) => task.kind === "subagent" && task.providerInstanceId === providerInstanceId,
+    ) ??
+      false));
+
 function threadManagementFailure(error: unknown): OrchestratorMcpFailure {
   if (!isThreadManagementError(error)) return failure("orchestration_error", errorMessage(error));
   switch (error._tag) {
@@ -1059,13 +1083,26 @@ const make = Effect.gen(function* () {
     scope: McpInvocationScope,
     parent: Pick<OrchestrationV2ThreadProjection, "thread" | "runs">,
   ) => {
+    const notActive = failure(
+      "parent_not_active",
+      "The calling provider no longer owns an active thread run.",
+    );
     const activeRun = ThreadManagementService.latestActiveRun(parent);
+    if (parent.thread.archivedAt === null && activeRun === undefined) {
+      // Decide from this one fresh snapshot: a run may have started since `parent` was read.
+      return threadManagement.getThreadShell(parent.thread.id).pipe(
+        Effect.mapError(threadManagementFailure),
+        Effect.flatMap((shell) =>
+          isLiveCallerShell(shell, scope.thread?.providerInstanceId)
+            ? Effect.void
+            : Effect.fail(notActive),
+        ),
+      );
+    }
     return parent.thread.archivedAt !== null ||
       activeRun === undefined ||
       activeRun.providerInstanceId !== scope.thread?.providerInstanceId
-      ? Effect.fail(
-          failure("parent_not_active", "The calling provider no longer owns an active thread run."),
-        )
+      ? Effect.fail(notActive)
       : Effect.void;
   };