chore(upstream): sync marcode through bab4b6f02b8b

[maarco]

What Changed

Merges 158 upstream commits, b73232bd..bab4b6f0, into main as one two-parent merge commit (791d415c), plus two follow-up fixes for breaks CI caught. 41 paths conflicted and every one was resolved by hand, combining both intents — no whole-file ours/theirs, no reset/restore/stash/clean, no force push.

Supersedes #29 (through 9e201941), #31 (through 184d8ef3), and #33 (through ad117235) — all three of those SHAs are ancestors of bab4b6f0, and all four branches share the same base. Closing them in favour of this one is your call. Resolves the upstream-sync-blocked issue #34.

Conflict decisions

Retired surfaces (Marcode owns the removal)

• files/{FileBrowserPanel,FilePreviewPanel}.tsx — kept deleted. Upstream only restyled them and added remote-open; that feature is taken in OpenInPicker instead.
• RightPanelTabs.tsx — took upstream's desktopByTabId threading (it now feeds the preview-tab favicon) and their Button-based add-panel trigger; dropped theme/PierreEntryIcon, which exist only for the retired file surface icon. Trimmed the matching props from upstream's new RightPanelTabs.test.tsx.
• ChatView.tsx — took upstream's PR tab-status keying fix (keyed by the shown surface, not a key rebuilt from the status) and their workspace file drag-and-drop; dropped activeFileSurface.
• ChatMarkdown.tsx / diffFileActions.ts — kept upstream's call shape and repointed the shared producer at the floating editor. diffFileActions keeps upstream's new resolveDiffPathForWorkspace (a real fix for repository-relative diff paths in nested projects) and feeds the result to the editor rather than the right panel; its tests now assert on the editor store.

Navigation and shell — AppSidebarLayout.tsx and sidebar/SidebarChrome.tsx keep Marcode's no-op SidebarControl and update-only footer; upstream's SidebarBrand/T3Wordmark/footer nav would ship a second copy of controls FloatingPillNav already renders, and threadSidebarWidth.test.ts asserts that removal. chat/ChatHeader.tsx keeps the title-only header but takes upstream's remote-open imports. ui/tooltip.tsx keeps Marcode's inline FLOATING_SURFACE_Z stacking, which subsumes upstream's z-[140] bump.

Styling refactor followed, behaviour kept — index.css adopts upstream's nested @variant dark, @layer base stage-art defaults, alert-glass utility and theme-id palettes; Marcode's monochrome .stage-blueprint override is ported onto the renamed --stage-art-* tokens, and its dark palette, sidebar surface rules and floating chrome are kept. Upstream's class retirements were followed at their call sites (.chat-composer-glass → surface-glass, .workspace-titlebar-controls and .chat-composer-horizontal-inset → inline utilities) — those classes no longer exist, so keeping them would have been a silent no-op. Pull-request panels and UsagePage take upstream's Button refactor inside Marcode's Tooltip wrappers.

Behaviour merged by hand

• threadSettled.ts — combined upstream's new autoSettleOnMerge setting with Marcode's warm-window guard, so a merged/closed PR settles a thread only once it has gone idle. Upstream's new test was rewritten to the combined rule, plus a new test pinning the warm-window half.
• ThreadTerminalDrawer.tsx — Marcode keeps xterm (for its search addon) where upstream runs the Ghostty WASM surface, so upstream's two fixes were ported by hand rather than merged: right-click paste (fix(terminal): right-click paste works in the terminal pingdotgg/t3code#5240) and the Ctrl+C selection-clear guard (fix(web): add copying terminal selection with ctrl+c in the web app pingdotgg/t3code#5638). Ghostty's pasteFromClipboard race claim has no xterm equivalent, so the same race is settled against the request id in the drawer, and the context menu binds to the mount element instead of a surface option.

Branding/identity conflicts (BitbucketSourceControlProvider, desktopUpdate.logic, ConnectionsSettings, MobileClientsUserProfilePage, _chat.pull-requests, README, AGENTS.md) all kept Marcode's product identity while taking the upstream fix in the same hunk — notably upstream's window.desktopBridge gate so the Connect toggle stops showing in the web app, and their removal of the Windows-only update warning (the platform parameter is gone from every caller). mobile-showcase.test.ts and infra/relay/scripts/deploy.test.ts keep the Marcode tests upstream deleted — they pin the marcode:// scheme and MARCODE_RELAY_URL — with the imports upstream removed restored. pnpm-lock.yaml was regenerated with pnpm, not hand-merged.

Fork-boundary breaks that merged cleanly (no conflict)

These are the dangerous ones — they produced no marker and would have shipped silently. Two of the nine were caught by CI rather than by the pre-push sweep.

1. pair-client.sh — upstream's new mobile pairing helper used T3CODE_PORT, the t3code-dev scheme and com.t3tools.t3code.dev. Marcode uses MARCODE_PORT, marcode-dev, com.t3tools.marcode.dev, so it could not have paired a single device. Fixed, along with three stale t3code-dev references already sitting in that skill's SKILL.md.
2. release.yml wired publish_aur into the release pipeline. Marcode does not own the t3code-bin AUR packages, and the PKGBUILDs fetch from pingdotgg/t3code releases — a Marcode release would have failed on the missing AUR_SSH_PRIVATE_KEY or pushed upstream's package. Removed the call site only, leaving publish-aur.yml and packaging/aur untouched so future syncs don't conflict on them, and added scripts/release-fork-boundary.test.ts to pin the removal.
3. DesktopWslServerTree.test.ts seeded its config layer with T3CODE_HOME/T3CODE_MODE (new upstream file, so no marker). Marcode reads MARCODE_HOME/MARCODE_MODE, so marcodeHome stayed unset, the desktop state dir resolved off the test's temp tree, and its sweep assertions never saw the directories they set up. Caught by CI — fixed in 9bc1a299.
4. Upstream added an isPublicFaviconHost guard to faviconUrlForOrigin, so it stops sending private, loopback and reserved-TLD hostnames to Google's s2 favicon endpoint. That is a privacy fix and is kept — Marcode's unified workspace tree resolves URL-shortcut icons through the same helper, so it was leaking internal hostnames too. Its capability-flag test asserted a favicon for a http://localhost:3000 shortcut, exactly the case upstream now refuses. Caught by CI — fixed in cf90a76c, with a new test pinning the behaviour because the leak is invisible in the UI (the sidebar renders its globe fallback either way). ⚠️ This is user-visible: URL shortcuts pointing at a dev server or intranet host lose their favicon.
5. DMG installer artwork — upstream's new backgrounds read "T3 CODE" / "Drag T3 Code to Applications". Rebranded.
6. A new "T3 Connect" account page and sidebar tab (T3ConnectUserProfilePage.tsx, T3ConnectSidebarSignIn.tsx). Rebranded to Marcode Connect; the t3-connect route slug and file names stay upstream-shaped.
7. The new mobile theme picker labelled its default palette "T3 Code." Relabelled to Marcode; the persisted t3-code id is deliberately unchanged so upgrades don't reset anyone's theme. docs/user/mobile-appearance.md rebranded to match.
8. Issue templates and CONTRIBUTING.md moved to a Discussions-first model pointing at pingdotgg/t3code/discussions. Marcode tracks everything in its own Issues, so the issues-first wording is kept and the cross-repo contact link dropped.
9. build-desktop-artifact.test.ts hard-coded upstream's productName in a new DMG assertion. Repointed at Marcode's.

Verified still correct on purpose: T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, the t3 package name and t3code: storage keys remain upstream-shaped; MARCODE_HOME still drives the service launcher; no t3code/<hex> branch fixtures leaked past the renamed WORKTREE_BRANCH_PREFIX. After #3, every file this merge touched was re-swept for a T3CODE_* name whose MARCODE_* twin is what actually gets read — the only remaining mismatches are in electron-launcher.mjs and dev-electron.mjs, both byte-identical to main and listed under pre-existing findings below.

Why

Scheduled upstream sync. The delta was too large to land as a clean auto-merge, and several of the resolutions are product decisions (which surface owns file editing, whether a merged PR buries a warm thread, which terminal implementation Marcode carries) rather than mechanical ones.

UI Changes

Not captured — the sync container has no display, and the touched surfaces (sidebar chrome, floating editor entry points, PR panels, terminal drawer, usage page, Connect account page) need a real client. Per the runbook this needs a test-t3-app pass at 390px and 820px before the PR leaves draft.

Checklist

• This PR is small and focused — no. It is a 158-commit upstream merge; that is the unit of work.
• I explained what changed and why
• I included before/after screenshots for any UI changes — see above, not possible from the sync container
• I included a video for animation/interaction changes

---

Verification

CI is green on cf90a76c — all four required checks passed: Check, Test, Mobile Native Static Analysis, Release Smoke (plus claude-review). Thread transfer stays within every enforced ceiling. Native fingerprint diff is queued rather than complete; it is not a required check.

Locally: typecheck clean across web, server, desktop, mobile, contracts, shared and client-runtime; the full web suite passes (274 files, 2795 tests); vp fmt --check and vp lint clean on the changed files and directories (warnings only, all pre-existing).

Still unverified — please read before marking ready

• No live client pass on any UI surface. This is the gap that matters, given how much of the merge lands in web chrome.
• The hand-ported terminal right-click paste is covered by ThreadTerminalDrawer.test.ts, but has never been exercised interactively against a real pty.

One local-only failure, named so nobody chases it: packages/shared Net.test.ts › "findAvailablePort returns preferred when it is free" fails in the sync container. It reserves an ephemeral port, releases it, then asserts the same port comes back — inherently racy under parallel test load. CI passes packages/shared on this commit, and this merge only adds a method to Net.ts without touching findAvailablePort.

Pre-existing findings, deliberately not fixed here

Not caused by this merge; flagging rather than widening the diff:

• build-desktop-artifact.ts registers schemes: ["t3code", "t3code-dev"] and name: "T3 Code" for packaged Linux builds, while macOS uses marcode. Changing it is an OAuth deep-link migration for existing installs, not a rename.
• electron-launcher.mjs and dev-electron.mjs forward T3CODE_PORT, T3CODE_HOME, T3CODE_COMMIT_HASH, T3CODE_OTLP_* and T3CODE_DESKTOP_APP_USER_MODEL_ID, while the server and DesktopConfig read the MARCODE_* names. Same class of bug as upstream sync blocked: pingdotgg/t3code@6154b46cb86b #3 above, but it predates this merge.
• desktopUpdate.logic.ts points DESKTOP_RELEASE_TAG_URL at pingdotgg/t3code/releases/tag.
• ThemePreviewCircles.tsx labels the web standard theme "T3 Code" (the mobile twin was fixed here because this merge introduced it).
• docs/user/** still says "T3 Code" throughout, and install.md points at upstream's Homebrew cask and AUR packages.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	12.6 KiB	+1.3 KiB (+11.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	6.3 KiB	+838 B (+15.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	6.3 KiB	+472 B (+7.9%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	51.8 KiB	+2.1 KiB (+4.2%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	12.6 KiB	+1.3 KiB (+11.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	6.3 KiB	+817 B (+14.6%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.8 KiB	6.3 KiB	+497 B (+8.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	52.7 KiB	+2.1 KiB (+4.2%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 1af3478 · PR result: cf90a76 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 99.9 KiB
• Claude decoded thread snapshot: 100.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

Two CI rounds, two more clean-merge fork-boundary breaks — both fixed, and one correction to the description above.

9bc1a299 — DesktopWslServerTree.test.ts seeded its config layer with T3CODE_HOME/T3CODE_MODE. Marcode reads MARCODE_HOME/MARCODE_MODE, so marcodeHome stayed unset and the sweep assertions never saw the temp tree they set up. New upstream file, so no conflict marker.

cf90a76c — favicon privacy guard. Upstream added isPublicFaviconHost to faviconUrlForOrigin, so it no longer sends private, loopback, or reserved-TLD hostnames to Google's s2 endpoint. That is a real privacy fix and is kept. Marcode's unified workspace tree resolves URL shortcut icons through the same helper, and its capability-flag test asserted a favicon for a http://localhost:3000 shortcut — precisely the case upstream now refuses. Repointed at a public host, and added a test pinning the new behaviour, because the leak is invisible in the UI: the sidebar renders its globe fallback either way.

That second one is worth a look during review. It is a behaviour change for anyone who has a URL shortcut pointing at a dev server or an intranet host — those rows lose their favicon and fall back to the globe. That is the correct outcome, but it is user-visible.

Correction to the "Not verified" section

I reported that ThreadTerminalDrawer.test.ts and FloatingTerminalShell.test.ts could not run. That was wrong — it was an artifact of invoking the runner from the repo root instead of the package, which is what broke @aliimam/icons resolution. Run properly they pass, and the full web suite is green locally: 274 files, 2795 tests. So the hand-ported terminal right-click paste is covered by ThreadTerminalDrawer.test.ts, including the pure helpers it adds.

What remains genuinely unverified is narrower than I said: no live client pass on any UI surface, and no interactive exercise of the right-click paste path against a real pty.

One local-only failure worth naming so nobody chases it: packages/shared Net.test.ts › "findAvailablePort returns preferred when it is free" fails in the sync container. It reserves an ephemeral port, releases it, then asserts the same port comes back — inherently racy under parallel test load. CI passed packages/shared on this exact commit, and this merge only adds a new method to Net.ts without touching findAvailablePort.

---

Generated by Claude Code