fix(desktop): remote media fallback, recording transfer, browser menus and installer art

[rynfar]

Five small desktop problems from upstream T3 Code, ported as one PR:

• Remote threads couldn't preview absolute media paths that only exist on the desktop machine.
• Browser recordings stopped by an agent stayed on the desktop, even when the agent runs in another environment.
• The embedded browser had no context menu.
• MCP preview snapshots were less useful to agents than upstream's final version.
• The macOS installer still used the older, smaller art.

What changed

• Remote media fallback (#10619).
  • When a remote environment can't find an image or video, the desktop app retries the same absolute path on its own primary environment and rewrites the URL to the primary's origin.
  • It only retries on not-found, inspection or context-not-found errors, never on authorization failures.
  • A file on the remote always wins, and web and mobile don't fall back.
  • Relative chat images resolve against the remote thread's workspace before the request, so they reach the fallback as absolute paths. A missing remote image can therefore show the desktop's file at the same absolute path.
  • Only POSIX / paths and Windows drive paths fall back. UNC and device paths (\\server\share, \\?\C:\, //server/share) never do, on the client or the server, so a remote thread cannot make a Windows desktop open a network share.
  • The server issues asset URLs for drive or POSIX absolute media without a thread lookup; asset access already allowed absolute media for any known thread. UNC and device paths still need a thread on that server.
• Recording transfer (#10572).
  • When an agent stops a recording, the desktop saves it. For a remote, relay or tunnel environment it uploads the finished file once through that environment's signed attachment upload, using the same prepared-connection path as composer uploads.
  • For the desktop's own primary environment it returns the saved path and uploads nothing, as before this PR. The response says so, and the server returns that path instead of treating the missing upload as an outdated desktop. The WSL backend is a separate environment, so it still gets a transfer.
  • Transfers are limited to 50 MiB and 120 s. Older desktops give the agent an update-required error instead of a desktop-local path.
• Browser context menus (#10670). Spelling suggestions, Copy Link, Copy Image and edit roles now work in attached webviews and their popups. Before, they only worked in the main renderer.
• MCP preview snapshots (#10501). Snapshot output is bounded and stays usable by the agent. save: true writes the PNG into the agent's environment and returns its path.
• macOS installer art (#10632, #10819, #10820).
  • Layout: upstream's 640×432 Finder window with 120 px icons at (166, 214) and (474, 214), a curved arrow and a ribbon.
  • Stable: neutral gray background with a silver ribbon, all vector.
  • Nightly: upstream's abstract night-sky raster, which I decoded and checked: stars and clouds only, no marks. It adds a pastel ribbon and a NIGHTLY label.
  • Both show the Pylon mark (paths from assets/prod/app-icon.icon/Assets/text.svg) where upstream shows its wordmark, with the text "Drag Pylon into Applications."
  • DMG titles, artifact names, signing and identity are unchanged.
• Docs. docs/user/composer.md and docs/user/browser-snapshots.md describe the media fallback, save: true, recording transfer and how long saved files last.

Sources

Upstream SHA	PR	Outcome
a01b227d6f37d1cfed7a2f47aaace2f72ea76ce3	#10619	Adopted, with UNC and device paths kept out of the fallback. Only test imports conflicted.
9e37f0c291974d084a59d7b9f165a1cb056e6043	#10572	Adopted, with local recordings left in place and recordings kept out of attachment storage (see below). Both #10572 recording tests were ported. The skipped upstream test, "routes gesture-free starts through the desktop capture trigger", comes from #9001's capture code, which #461 adds.
b5f7fa0ede2a0d791226e6474c9cc4374dd89cc9	#10670	Adopted. The test keeps Pylon's pylon-code-dev:// URL.
061543e9e5b54ec0048725c37d52fef2962df173	#10501	Adopted, using Schema.TaggedErrorClass for Pylon's Effect version. Saved screenshots are stored per thread (see below).
991526383f95eefdd66ffd2853136c6dd34ae008	#10632	Adopted with Pylon copy and mark.
5d14c0e9686d8bedf47dd93dd3811fd639255c7e	#10819	Adopted: Pylon's mark, not T3's logo.
0fe4c99ee6df4cbb7a9064d2d86ece65ecef5eb3	#10820	Adopted: neutral stable art.

Window capture (#8103, #10645, #9001) and the skipped v0.0.40 release bump are in #461. The ledger rows need a trivial rebase. Since #461's afa94547da moved recording capture to getDisplayMedia, apps/web/src/browser/browserRecording.test.ts also conflicts: whichever PR lands second must move #10572's two transfer tests from the getUserMedia mock to #9001's display-media capture trigger, which is how upstream wrote them. No other file this PR changes conflicts with #461 or #463; their remaining conflicts (pnpm-lock.yaml, MessagesTimeline.test.tsx) are with pylon itself.

Pylon adaptations and removals

• Saved browser files live with their thread. Upstream stores a transferred recording as a thread attachment that no message references. Pylon's rollback (thread.reverted) prunes exactly those files, so a recording the agent embedded in a kept earlier turn was deleted by any later rollback. In remote mode the only other copy is on the desktop. Transferred recordings and save: true screenshots now go to <state>/browser-artifacts/<thread>/. Revert cleanup never looks there. Deleting the thread removes the folder from the same deletion path that removes its attachments, so feat(chat): attach files to question answers #463's cleanup cursor replays it too.

• preview_snapshot annotations. Upstream's read-only and idempotent hints are kept. save: true writes only to the thread's own browser-artifacts/<thread>/ store, never the workspace, and deleting the thread removes it. Dropping the hints would make Codex ask before every snapshot in Supervised and Auto-accept edits with no safety benefit, so review kept them. A comment at the annotation records why.

• MCP tool timeouts. preview_recording_stop can take up to 120 s. Pylon now configures 180 s for its MCP server where a provider accepts a per-server value:

  Provider	Default per-call timeout	Decision
  Codex	60 s through at least rust-v0.100.0, 120 s by May 2026, 300 s since July 2026 (DEFAULT_TOOL_TIMEOUT in codex-rs)	Set mcp_servers.t3-code.tool_timeout_sec=180.0. tool_timeout_sec predates bearer_token_env_var, which Pylon already requires.
  OpenCode	MCP SDK default of 60 s (timeout falls back to experimental.mcp_timeout, then the SDK)	Set timeout: 180000 on mcp.add. OpenCode also uses it for connecting and listing tools.
  Claude	100,000,000 ms hard limit (MCP_TOOL_TIMEOUT default) and a 300 s idle limit for HTTP servers, checked in Claude Code 2.1.267	No change needed.
  Cursor, Grok, Antigravity, Prime	ACP McpServerHttp has no timeout field	Not configurable; left at each agent's default.

• Only the previous DMG artwork and window geometry are replaced. Both came from an earlier upstream port, so they are not Pylon-original.

• Nothing Pylon-specific was removed from the MCP, asset or window code. Prime usage is unchanged (PRIME_AGENT_DRIVER_KIND still appears 3 times).

Risks for review

• Old desktop, newer server. A desktop too old to transfer recordings, connected to a newer server, now makes the agent get an error where it used to get a desktop-local path. Upstream made the same choice.
• preview_evaluate result shape. It now returns { value }. No Pylon consumer of the old raw result was found.
• Recordings saved by the desktop for its own environment stay where the desktop saved them, as before this PR. Thread deletion does not remove them.

Verification

• Tests (vp test run):
  • shared path: 6 passed;
  • client-runtime assets/runtime: 50 passed;
  • server src/mcp, AssetAccess, cli/config, attachmentStore, ProjectionPipeline, CodexAdapter and OpenCodeAdapter: 308 passed;
  • server.test.ts -t "asset|media|upload": 5 passed;
  • web recording, recording scope and preview automation: 79 passed;
  • desktop Manager, ipc/preview, DesktopWindow and ElectronMenu: 126 passed, and CI=true scripts/build-desktop-artifact.test.ts: 80 passed (first push; this round did not touch those files).
  • The new rollback test fails against the previous claim code and passes with the fix.
  • After keeping the snapshot hints: McpHttpServer, preview tools and handlers tests, 24 passed; vp fmt --check and lint clean on the changed files.
• Typechecks: shared, client-runtime, t3 and web clean this round; contracts, desktop, mobile and scripts clean on the first push.
• Lint and format: this round, scoped lint shows 0 warnings and 0 errors on 21 files and vp fmt --check passes on 24 files; the first push checked 27 and 29 files; git diff --check is clean.
• DMG art: rendered with sips, the builder's converter, and inspected at 1x and 2x.

No local client pass or Finder/Electron check was run; the orchestrator does one integrated pass. Upstream evidence: #10632, #10819, #10820, #10670, #10619 and #10572.

Ported by Claude Opus 5 in Claude Code.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pylon-marketing	Ready	Preview	Sep 11, 2026 1:54am UTC

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.1 KiB	13.9 KiB	−140 B (−1.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.2 KiB	7.2 KiB	+13 B (+0.2%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.9 KiB	6.7 KiB	−153 B (−2.2%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.8 KiB	58.0 KiB	−910 B (−1.5%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	14.1 KiB	14.1 KiB	−40 B (−0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.2 KiB	7.2 KiB	−5 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.9 KiB	6.8 KiB	−35 B (−0.5%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.7 KiB	59.7 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	10	9	−1 (−10.0%)	21	✅

Baseline: 16a9968 · PR result: 07b3fec · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.6 KiB
• Claude decoded thread snapshot: 116.3 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.