chore(upstream): sync marcode through 2c4158f8

[maarco]

What Changed

Merges pingdotgg/t3code@2c4158f8 into Marcode — 92 upstream commits since the last sync point (82b8a938), as one two-parent merge commit. 25 paths conflicted and were resolved by hand.

This supersedes the three older stacked sync drafts (#41 through f2d5fc91, #43 through beab6886, #45 through be7d35aa); their ranges are all contained in this one. Close them if this lands.

CI is green on 480c621a — all four required checks (Check, Test, Mobile Native Static Analysis, Release Smoke) plus Rust, Test Server 1/2/3. The red checks on the two earlier commits are the three failures described below, each fixed in a follow-up commit.

Fork-boundary breaks that merged cleanly — no conflict, silent regressions

These are the dangerous ones. Every item below produced zero conflict markers and would have shipped broken.

Break	Fix
Upstream's new macOS launch agent (pingdotgg#6286) exports T3CODE_HOME into the plist. resolveLauncherBaseDir reads MARCODE_HOME and throws without it — the background service would never start on macOS.	Renamed to MARCODE_HOME; pinned with a test asserting the plist names it and never T3CODE_HOME.
The launch-agent label was com.t3tools.t3code.service, so an upstream T3 Code install writes the same ~/Library/LaunchAgents/…plist path and the two overwrite each other.	Derived from BOOT_SERVICE_NAME → com.t3tools.marcode.service, matching the reason Marcode already renamed the systemd unit. Pinned with a test.
Upstream's new uninstall assertion hardcoded systemctl --user disable --now t3code.service.	Now reads BOOT_SERVICE_UNIT_FILE so it can't drift from Marcode's unit name again.
The new t3 triage command (pingdotgg#6563) resolves its base dir from T3CODE_HOME, while its own comment claims parity with t3 pair — which reads MARCODE_HOME.	Switched to MARCODE_HOME.
Upstream moved CI to Blacksmith runners (pingdotgg#7286, pingdotgg#7283). A blacksmith-* label matches no runner on this fork, so those jobs queue forever rather than failing.	All CI jobs back on GitHub-hosted runners. Marcode's existing runner-pinning test caught this — it now also rejects any blacksmith label outright.
Second-order consequence of that runner change, and the one CI caught: upstream also moved the server suite into a new sharded test_server job (pingdotgg#7286), and Marcode's ripgrep install — needed only because of the runner conversion — stayed on the old test job. WorkspaceFileSystem search tests failed with spawn rg ENOENT. Upstream never hits this; their Blacksmith images ship ripgrep.	Install step added to test_server. The parity test now derives the job list from whatever actually runs a test suite, so the next split or rename fails there instead of in CI.
Background-draft promotion (pingdotgg#7821) landed its usage of handleNewThread but not its declaration, which fell in a region Marcode had diverged.	Restored useNewThreadHandler(); apps/web typechecks.
The new platform docs section named upstream's unit paths.	Corrected to marcode.service / com.t3tools.marcode.service.plist.

Conflict decisions

Kept Marcode, ported the upstream fix inside the hunk

• SidebarChrome / SettingsSidebarNav — upstream's SidebarUtilityMenu adds Settings, Usage, Pull Requests and Back to surfaces where FloatingPillNav already owns them. SidebarChrome.fork.test.tsx already pinned the thread sidebar; added a matching pin for the settings footer, which had no test and would have merged silently.
• ChatHeader — kept Marcode's title-only header. Upstream's inline rename and title action menu (feat(web): double-click chat header title to rename thread pingdotgg/t3code#7817, feat: refine thread action menus pingdotgg/t3code#7476) duplicate entry points Marcode provides from the sidebar row and pill nav.
• ThreadTerminalDrawer — kept Marcode's terminal chrome and FitAddon padding; took upstream's themed terminal background and routed every close through upstream's close confirmation (feat(web): confirm before closing a terminal pingdotgg/t3code#7592).
• ChatView — kept the title-only header call and the ThreadActionsCluster portal inside upstream's WorkspacePageHeader; kept the single container-level panelLayoutControls render so it isn't drawn twice.
• Sidebar.tsx — kept Marcode's 12px empty-state type, took upstream's cursor-pointer fix (fix(web): show pointer on add project button pingdotgg/t3code#5545).
• files/{FileBrowserPanel,FilePreviewPanel}.tsx — kept Marcode's deletion. Upstream's fix(web): refresh open file with the file tree pingdotgg/t3code#7490 is confined to the retired right-panel file surfaces and has no floating-editor analogue.

Took upstream's refactor, re-applied Marcode's behavior on top

• WorkspacePageHeader — adopted upstream's shared header primitive on settings and usage, and added one sidebarless prop for SIDEBARLESS_TITLEBAR_INSET_CLASS. Those routes mount no sidebar, so upstream's collapsed-sidebar selector never matches and the header would slide back under the native window controls.
• UsagePage — took the redesign (feat(web): redesign usage insights pingdotgg/t3code#7147), re-applied Marcode's styled Tooltip on both refresh controls.
• _chat.pull-requests / PullRequestListFilters — took upstream's shared PullRequestRefreshControl and Button-based filter trigger, moved Marcode's Tooltip onto them instead of keeping a third refresh button in the header.
• RightPanelTabs — took tab mute (feat(desktop): mute a browser tab pingdotgg/t3code#7252) and surface-dropdown shortcuts (feat(web): add shortcuts to the surface dropdown pingdotgg/t3code#7318), minus copy-path and the Files entry, which address the retired right-panel file surface. Marcode's add-surface menu now renders from upstream's shared action list rather than duplicating it.
• ChatComposer / ComposerPendingApprovalPanel — took upstream's composer state drawers (feat(web): attach composer state drawers pingdotgg/t3code#7150); Marcode's in-surface approval banner depended on a container upstream removed. The glass treatment lives on chat-composer-glass-shell in ChatView and is unaffected.

Where Marcode's implementation was superseded

• threadSettled — retired Marcode's CHANGE_REQUEST_SETTLE_IDLE_MS warm window in favour of upstream's event-ordering rule (fix(threads): a merged PR settles its thread only once pingdotgg/t3code#7454). Both fix the same bug (a merged PR burying a warm follow-up), but upstream's also covers the inherited-PR case — a thread opened on a branch whose PR already merged must never settle — which the time window would have regressed. Marcode's warm-window tests are replaced with tests for the combined rule, and the retirement is documented where the constant lived.

Other

• Migrations — upstream's 041_AuthSessionClientConnection renumbered to 042. Marcode's ProjectWorkspaceLayout owns 033, so every shared migration sits one id higher; renumbering an applied id would re-run or skip it on real installs.
• .plans/** — took upstream's removal (chore: move implementation plans out of repository pingdotgg/t3code#7665). Marcode's only change there was a path rebrand inside a file the repo policy already says not to commit, and .plans/ is gitignored.
• AGENTS.md — kept Marcode's structure and its own Verifying / Pull-requests sections; adopted upstream's new "Plans and work artifacts" policy and folded its PR-assets rule into Marcode's list.
• cli/service.ts, cli/connect.ts — took upstream's macOS/launchd copy paths, kept Marcode's product name.
• index.css, __root.tsx, Sidebar.logic.ts — additive on both sides; kept both.

Coupled changes: pnpm-workspace.yaml moved only Clerk versions, not the effect catalog, so no .repos/ subtree sync is required. infra/relay/package.json is unchanged.

Two fork pins this sync relocated

Both guard Marcode divergences the merge moved rather than removed, so both failed CI on content that is actually correct. Rewritten to assert the invariant where it now lives:

• Migrations.test.ts pinned a fixed 9-entry tail, so adding migration 42 slid Marcode's own migration 33 out of the window — the diff read as "33 disappeared" rather than "42 is new". Now anchors on 33 by lookup.
• workspaceTitlebar.fork.test.ts scanned settings/usage for a drag-region line beside SIDEBARLESS_TITLEBAR_INSET_CLASS; adopting WorkspacePageHeader moved both out of the call sites. The guarantee still has two independently regressible halves, each now asserted where it lives.

Why

The daily sync had stalled behind three unmerged drafts, so the fork was 92 commits behind and drifting. Merging the full range in one reviewed pass is cheaper than resolving three overlapping stacks, and it re-establishes a single merge base for the next run.

Every fix above is either an upstream correctness/security/operational change Marcode needs, or a Marcode product contract that upstream's rewrite would have quietly removed. Hotspot paths were treated as mandatory-review, not as automatic keep-Marcode.

UI Changes

Not captured — this ran headless with no browser or display available. This is the main reason the PR is still draft. The following surfaces changed and want a look:

• Settings and Usage top bars, in Electron on macOS specifically — that's where the sidebarless inset matters (the header must clear the traffic lights).
• The composer's new top drawer against Marcode's glass shell (approval, user-input, and plan-follow-up states).
• Chat header, right-panel tabs (mute indicator, add-surface shortcuts), and the terminal drawer's close confirmation.
• 390px and 820px viewports, per the sync runbook's UI-hotspot rule.

Checklist

• This PR is small and focused — no. It is a 92-commit upstream sync; that scope is inherent to the task.
• I explained what changed and why
• I included before/after screenshots for any UI changes — not possible in this environment; see UI Changes above.
• I included a video for animation/interaction changes — same.

Verification

CI green on 480c621a: Check, Test, Mobile Native Static Analysis, Release Smoke, Rust, Test Server 1/2/3, Mobile Native Changes. Thread-transfer bot reports the merge stays within every enforced ceiling (+6.7% total wire against a 15.1 KiB cap).

Locally: apps/web fully green (289 files, 2961 tests); typecheck clean for web, server, contracts, shared, client-runtime, mobile, desktop; fmt --check and lint clean on the changed scope.

Each rewritten pin was verified to still fail on the regression it guards — the ripgrep step removed from test_server, the header primitive reverted to the collapsed-only inset, and a route dropping the sidebarless prop — and to pass when restored.

Known-noisy locally, green in CI

The sync container is resource-constrained and shares its port space, which produced local-only failures that CI does not reproduce. Treat CI as authoritative for these:

• packages/shared/src/Net.test.ts → findAvailablePort returns preferred when it is free. Both Net.ts and Net.test.ts are byte-identical to pre-merge main, and the test passes in CI.
• A GrokAdapter drain-window test hit its 120s timeout locally under a concurrently running suite. All three CI server shards pass.

Not verified here

• No live client verification (no browser or simulator available) — see UI Changes.

Worth a maintainer decision

• t3 triage's playbook still points at pingdotgg/t3code — a Marcode user running it would be told to file issues upstream. Left as-is: that's a product decision, not a merge decision.
• docs/internals/scripts.md still documents T3CODE_HOME and .t3/userdata. Pre-existing drift, not caused by this merge; left alone to keep the diff focused.
• Mobile Native Static Analysis is now conditionally skipped (upstream ci: only boot the macOS native lint runner when native sources change pingdotgg/t3code#7283 gates it on native source changes) and is a required check. It ran on this PR because the diff touches native sources, so the skip path is unverified — worth confirming branch protection treats a skipped required check as passing.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	13.4 KiB	+856 B (+6.6%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.9 KiB	+625 B (+9.7%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+231 B (+3.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	55.0 KiB	+3.2 KiB (+6.1%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	13.4 KiB	+878 B (+6.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.9 KiB	+631 B (+9.8%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+247 B (+3.8%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	55.8 KiB	+3.2 KiB (+6.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 5bcc188 · PR result: 480c621 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.