chore(upstream): sync marcode through cd096b9ad5a4

[maarco]

Merges pingdotgg/t3code@cd096b9ad5a4156ffeab85de617cbb219057007f (2026-08-17) into main. 163 upstream commits, merge base b73232bdd31e. 693 files changed.

This supersedes the four stacked draft syncs — #29 (9e201941), #31 (184d8ef3), #33 (ad117235), #35 (bab4b6f0) — all of which are ancestors of this SHA. It also resolves the blocked-sync issue #36. Merging this one and closing the other four is the intended outcome.

47 conflicted paths were resolved by hand. No file was taken wholesale from either side, and no reset / restore / checkout --ours|--theirs / stash / clean / force push was used. MERGE_HEAD stayed at cd096b9ad5a4 for the whole resolution.

Hotspot decisions, by owner

editor-runtime — the floating editor is the only file-editing surface

• components/files/File{Browser,Preview}Panel.tsx — accepted upstream's edits as deletions; Marcode retired both surfaces.
• ChatMarkdown.tsx — kept upstream's fix: a bare filename reference now resolves through the workspace index instead of assuming the workspace root (fix(web): open the file a bare filename reference names pingdotgg/t3code#6297). Retargeted from useRightPanelStore.openFile (which does not exist on Marcode) to openFileInFloatingEditor. Upstream's onOpenInPanel prop shape is kept so the seam stays one line wide.
• diffFileActions.ts — kept upstream's fix: resolveDiffPathForWorkspace rebases a repository-relative diff path onto the workspace root so diffs in nested projects open the right file (fix(web): open diff files from nested projects pingdotgg/t3code#6174). Its result feeds the floating editor. Note the file could not compile without it — the merged fallback already referenced workspaceFilePath.
• RightPanelTabs.tsx — threaded upstream's desktopByTabId (captured browser-tab favicons, feat(desktop): add favicons to the Browser panel pingdotgg/t3code#5644) but not theme, which only tints PierreEntryIcon for the retired file surface.

web-navigation / web-shell — FloatingPillNav owns brand, nav and settings

• AppSidebarLayout.tsx, sidebar/SidebarChrome.tsx — kept Marcode's no-trigger / no-brand shape. Upstream's SidebarBrand, T3Wordmark and footer actions stay out; taking their block would also have referenced symbols this file does not import.
• threadSidebarWidth.test.ts — kept Marcode's "brand stays out of the sidebar header" removal pin and dropped upstream's opposing wordmark assertion.
• chat/ChatHeader.tsx — kept the title-only header (no thread action menu, no inline rename; thread actions already live on the sidebar row's context menu) and added upstream's remote-open imports.
• ChatView.tsx titlebar controls — took upstream's shared-inset fix (fix(web): align every titlebar control cluster on one shared inset pingdotgg/t3code#6592). Their refactor deleted the .workspace-titlebar-controls utility in favour of inline positioning plus a data-workspace-titlebar-controls attribute, and that utility is gone from the merged index.css, so Marcode's class could not be kept.
• ChatView.tsx composer inset — .chat-composer-horizontal-inset was removed by upstream's global-styling refactor (refactor(web): simplify global styling pingdotgg/t3code#6381). Their inline classes are the same 0.75rem / 1.25rem safe-area pair; Marcode's hero centering is kept on top.

design-system — apps/web/src/index.css

Adopted upstream's Tailwind v4 restructure — @variant dark nested inside :root, top-level @utility blocks, @layer base ahead of @layer components — and moved every Marcode rule into the new structure unchanged (--workspace-titlebar-content-left, Mentiko monochrome .stage-blueprint, topbar and scroll-fade utilities, floating chrome, ultrathink, composer chips).

• Kept Marcode's Mentiko near-black dark palette over upstream's restored palette (fix(web): restore dark theme palette pingdotgg/t3code#6663). Marcode's token set is a strict superset there, so no upstream token is dropped.
• Upstream's zinc [data-app-sidebar] overrides stay out, as the existing in-file comment already records.
• Took upstream's new theme-id stage-art aliases — the --stage-art-celeste-* / --stage-night-glow-* tokens their @layer base introduces are unset for the built-in themes without them.

⚠️ This is the part that most needs your eyes. Brace count balances and every affected package typechecks, but a CSS restructure of this size wants a real look at the app — including 390px and 820px — and I have no browser in this container.

Terminal — Marcode keeps xterm for its search addon; upstream now runs Ghostty

ThreadTerminalDrawer.tsx was the hardest file: upstream's version of it drives GhosttyTerminalSurface, Marcode's drives xterm, and parts of upstream's new code had already merged cleanly into Marcode's effect (leaving selectionActionMenuOpenRef undefined and openSelectionMenuRequestIdRef declared but unused).

Kept the xterm surface and ported upstream's two behaviour fixes onto it:

• right-click context menu with an always-offered Paste (fix(terminal): right-click paste works in the terminal pingdotgg/t3code#5240)
• Ctrl+C copy of the terminal selection in the web app (fix(web): add copying terminal selection with ctrl+c in the web app pingdotgg/t3code#5638)

Their pure helpers (terminalContextMenuItems, terminalSelectionMenuItems, shouldClearTerminalSelectionAction, shouldHandleTerminalExit) are taken verbatim; shouldHandleTerminalExit now backs what was an inline condition. pasteFromClipboard is reimplemented against terminal.paste with the supersede check made explicit, since xterm has no pasteFromClipboard(read, isCurrent) hook, and the context menu binds a DOM contextmenu listener because xterm has no onContextMenu option. Skipped terminalSelectionLineRange, which reads Ghostty's selection-position shape.

Added focused tests for the ported helpers so the next sync fails loudly instead of reverting them.

⚠️ The pure helpers are covered by tests; the interactive clipboard behaviour is not runtime-verified — no browser here. Worth a manual right-click → Paste and a Ctrl+C-with-selection in a real terminal panel.

product-identity / release-branding

• ConnectionsSettings.tsx — kept "Marcode Connect" and took upstream's window.desktopBridge guard (fix(web): hide T3 Connect toggle in web app settings pingdotgg/t3code#5068), so the web app no longer offers a desktop-only toggle.
• clerk/MobileClientsUserProfilePage.tsx — adopted upstream's ClerkUserProfilePage / Row / RefreshButton extraction, keeping Marcode wording. The surrounding merged code had already moved to the new closing tags, so their refactor was the only coherent resolution.
• _chat.pull-requests.tsx — "Update your Marcode servers…" keeps upstream's all-server phrasing (feat(web): pull request surfaces — filters & qualifiers, all-server listing, update branch, reactions, in-place editing, smarter diffs pingdotgg/t3code#6039) with Marcode's name.
• BitbucketSourceControlProvider.ts — MARCODE_BITBUCKET_* names plus upstream's added "user read" scope (docs: mention Bitbucket user read scope needed by auth probe pingdotgg/t3code#6291).
• desktopUpdate.logic.ts — followed upstream in deleting the Windows install warning and the platform parameter (fix(web): align Windows update confirmation copy pingdotgg/t3code#7208). That warning was upstream's own feature that Marcode had only rebranded, and all three call sites merged without the argument, so keeping it would have left dead code behind a compile error.
• CodexSessionRuntime.test.ts — upstream's codexDefaultModeDeveloperInstructions(true) call with Marcode's /Marcode/ branding assertion.
• electron-launcher.mjs — Marcode bundle ids and schemes, upstream's LAUNCHER_VERSION bump and assets/<brand> icon sources; the now-unused resources/icon.icns path dropped alongside upstream's deletion of that file. Marcode's assets/ already carries its own artwork under upstream-shaped filenames, so their new lookup works unchanged.

Upstream test cleanups that were pinning Marcode behavior

• infra/relay/scripts/deploy.test.ts, scripts/mobile-showcase.test.ts — kept the blocks test: remove redundant and stale tests pingdotgg/t3code#6267 deleted as "redundant". They are the only assertions pinning the MARCODE_-prefixed relay env keys and the marcode:// production deep-link scheme, and both producers are still exported. Imports restored, and a comment explains why they stay.
• threadSettled.ts — a genuine behavioural collision. Composed upstream's autoSettleOnMerge switch (feat: allow disabling auto-settle on merge pingdotgg/t3code#5880) with Marcode's warm window: upstream decides whether the change-request state settles at all, Marcode then gates it on an hour of idleness. Upstream's new test asserted that a close settles a still-warm thread, contradicting Marcode's two existing warm-window tests, so it now proves the switch is merge-only (against an idle shell) and warm-hold (against a recent one).

Breaks that merged cleanly and produced no conflict

These are the dangerous ones and the reason a green auto-merge would have been wrong:

Where	What merged silently	Fix
.agents/skills/test-t3-mobile/scripts/pair-client.sh (new upstream file)	reads T3CODE_PORT, defaults to the t3code-dev scheme, targets com.t3tools.t3code.dev	MARCODE_PORT, marcode-dev, com.t3tools.marcode.dev; also aligned the stale t3code-dev references elsewhere in that skill with app.config.ts
apps/desktop/src/wsl/DesktopWslServerTree.test.ts (new upstream test)	seeds T3CODE_HOME / T3CODE_MODE, which DesktopConfig ignores → state dir resolves away from the temp dir	MARCODE_HOME / MARCODE_MODE
scripts/build-desktop-artifact.test.ts (new upstream assertion)	expects DMG title T3 Code (Alpha) 1.2.3 Installer	Marcode 1.2.3 Installer. The neighbouring Linux protocol assertion deliberately keeps the upstream-shaped t3code schemes that OAuth deep links depend on
clerk/T3ConnectUserProfilePage.tsx (new upstream page)	six user-visible "T3 Connect" strings	rebranded to Marcode Connect; component and file names stay T3Connect*
desktopUpdate.logic.test.ts (rewritten upstream test)	asserts the exact T3 Code confirmation string	Marcode wording
.github/workflows/release.yml	new publish_aur job would publish the t3code-bin / t3code-nightly-bin AUR packages from Marcode's repo, and needs an AUR_SSH_PRIVATE_KEY Marcode has no reason to hold	packaging/aur and the reusable workflow are carried unchanged but the job is gated behind a PUBLISH_AUR repository variable, so a release neither pushes to upstream's AUR repositories nor fails on a missing secret

👉 The AUR one is a policy call, not a mechanical fix — flagging it explicitly. Default is off. If Marcode should never publish Arch packages, deleting packaging/aur and publish-aur.yml outright is cleaner; if it should publish its own, the packages need renaming first. I noted the current state in the README.

The renamed-identity sweep (T3CODE_HOME, t3code.service, WORKTREE_BRANCH_PREFIX, t3code:* storage keys, ~/.t3 paths, boot-service naming) turned up no other regressions. WORKTREE_BRANCH_PREFIX is still referenced symbolically everywhere, so the previous sync's fix held. Compatibility identifiers left deliberately upstream-shaped: @t3tools/*, the t3 package/CLI name, t3code:* storage keys, t3code/t3code-dev desktop protocol schemes, T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, and the mobile app's "T3 Code" display name.

New lint rule required migrating Marcode's own call sites

Upstream added no-native-title-tooltip and registered it as an error (pingdotgg#7209). Upstream migrated their call sites in the same commit; Marcode has 25 of its own that upstream never had. Rather than weaken the rule, all 25 are migrated to Tooltip / TooltipTrigger / TooltipPopup: git-panel (8), file-tree (5), floating-code-pill (4 — one is a shared SidebarIcon helper that covers ten call sites), tab-bar (3), GitActionsControl (3), stash-selector (2), plus FloatingTerminalShell, branch-selector, editor-pane, OpenInPicker, Sidebar and DraftHeroHeadline.

Two judgement calls there:

• Disabled menu rows drop the attribute rather than gain a tooltip (OpenInPicker, GitActionsControl). A disabled button does not reliably fire the hover that would show it, and each row already renders its label as visible text beside an aria-label. The one thing lost is the "no working directory yet" / action-disabled explanation on hover — say the word if you want it back as a popover footer.
• branch-selector's current-branch dot was aria-hidden with a title, so the hint was never reachable by assistive tech; it is now purely decorative.

tooltip.tsx keeps Marcode's FLOATING_SURFACE_Z.portalOverlayTooltip inline style instead of upstream's z-[140] — Marcode already encodes exactly that "tooltips above dropdowns" ordering (pingdotgg#6241), applied inline so it outranks any stray z-* class.

Verification

Focused, per the repo's rules — no repo-wide suite.

• Tests — web components + editor: 140 files / 1370 passed. client-runtime + shared + contracts: 112/113 files, 1286 passed. server pullRequest/sourceControl/preview/auth: 41 files / 719 passed. provider/cloud/cli/desktop/scripts/plugin/infra: 181 files / 1774 passed.
• Typecheck — clean: @t3tools/web, @t3tools/client-runtime, @t3tools/shared, @t3tools/contracts, t3 (server), @t3tools/desktop, @t3tools/scripts.
• Format — vp fmt --check clean on all 658 changed files.
• Lint — 0 errors across apps/web/src, apps/server/src, apps/desktop/src, packages, scripts, oxlint-plugin-marcode, infra.

Three test failures are pre-existing and environmental, not merge-caused:

1. packages/shared/src/Net.test.ts > findAvailablePort returns preferred when it is free — proven by running the same file from a disposable detached worktree at 1af3478a, where it fails identically. The merge's only change to Net.ts is an additive hasListenerOnHost; findAvailablePort and its test are untouched.
2. scripts/update-release-package-versions.test.ts > preserves manifest write context… — chmod 0o400 then expects the write to fail, but this container runs as uid 0. The documented root exemption. File untouched by the merge.
3. .github/scripts/thread-transfer-report.test.cjs — "no test suite found" under this runner invocation. File untouched by the merge.

Separately, five suites could not load at first because @aliimam/icons@1.1.3 declares main: dist/index.cjs and its published tarball ships no such file — a pre-existing defect in a Marcode-only dependency, at the identical version in both lockfiles. I added a local-only CJS shim inside node_modules (not committed) so those suites could actually run; they pass. Worth fixing separately — it will bite anyone whose bundler resolves main.

pnpm-lock.yaml was regenerated with pnpm install --lockfile-only, not hand-merged. Neither pnpm-workspace.yaml nor infra/relay/package.json changed, so no .repos/ vendored-subtree sync is required.

Not verified

• No runtime client verification. No browser or simulator in this container, so nothing was driven in a real client. Given the index.css restructure and 25 tooltip migrations across the floating editor, the review checklist's runtime pass at 390px and 820px is the main outstanding gate — along with vp run icons:check, since apps/desktop/resources/** and assets/** are in the diff.
• Mobile: upstream's built-in themes (feat(mobile): add built-in themes pingdotgg/t3code#6619) and sheet/nav changes came in with only static checks here.

Intentionally left as a draft, and not marked ready.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	12.6 KiB	+1.3 KiB (+11.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	6.3 KiB	+841 B (+15.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	6.3 KiB	+476 B (+7.9%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	51.8 KiB	+2.1 KiB (+4.2%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	12.6 KiB	+1.3 KiB (+11.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	6.3 KiB	+818 B (+14.6%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	6.3 KiB	+484 B (+8.1%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	52.7 KiB	+2.1 KiB (+4.2%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 1af3478 · PR result: af104c0 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

All four required checks are green on af104c0e: Check, Test, Mobile Native Static Analysis, Release Smoke. The transfer-budget report is also within every ceiling (biggest movement is +15.0% on the Codex thread snapshot wire, against a +32% headroom).

The one real CI failure, and what it was

Test went red on the first push with a single assertion in unifiedWorkspace/buildTree.test.ts — and it was a genuine fork-boundary catch I had missed, not flake.

Upstream added an isPublicFaviconHost guard to faviconUrlForOrigin, so it no longer sends private, loopback or reserved-TLD hostnames to Google's s2 favicon endpoint. Marcode's unified workspace tree resolves URL-shortcut icons through that same helper, and its capability-flag test asserted a Google favicon URL for a http://localhost:3000 shortcut — exactly the case upstream now refuses.

Kept upstream's guard (it is a privacy fix), repointed the assertion at a public host, and added a test pinning the new behaviour for both a loopback and an intranet host. That one needs asserting because the leak is invisible in the UI — the sidebar renders its globe fallback either way.

I had missed it because my focused run covered apps/web/src/components and apps/web/src/editor but not apps/web/src/unifiedWorkspace. Before pushing the fix I re-ran the suites the way CI does — per package rather than from the repo root — and apps/web is 274/274 files and 2818 tests green, matching CI's file count exactly.

claude-review

Not a code finding: it died in its first step on a transient GitHub 5xx (Failed to check permissions for maarco: No server is currently available to service your request) before any review executed — the log ends with "No buffered inline comments". Re-ran it; it passed. Worth noting separately that its ANTHROPIC_API_KEY env resolved empty in that run, which may mean the review bot cannot actually run here regardless — unrelated to this PR.

Still outstanding before this should come out of draft

Green CI is not the whole gate for this one. Two things I could not do in a container with no browser or simulator:

1. Runtime client verification at 390px and 820px. The index.css Tailwind v4 restructure and the 25 tooltip migrations across the floating editor are exactly the kind of change that typechecks and tests clean while looking wrong. This is the main open item.
2. vp run icons:check — apps/desktop/resources/** and assets/** are both in the diff.

And one decision that is yours, not mechanical: the publish_aur job is currently gated behind a PUBLISH_AUR repository variable so it cannot publish upstream's t3code-bin packages from this repo. If Marcode should never ship Arch packages, deleting packaging/aur and publish-aur.yml outright is cleaner.

Leaving this as a draft and not marking it ready.

---

Generated by Claude Code

[maarco]

Superseded by #39 (merged, includes 82b8a93).