[Fryuni]

Problem

The fork is 362 commits behind upstream/main. This sync keeps the features recorded in docs/adr and uses upstream's implementation wherever it can.

Change

Merged pingdotgg/t3code main at 58e60bf5e808fc226d9b769d66d1ea9fec014d23. 45 files conflicted, and 7 upstream workflow edits hit workflows the fork deletes. The fork's diff against upstream came through almost unchanged; the real work was re-homing fork code onto upstream refactors.

Re-homed on upstream's structure

• ADR 0008 / 0009, mobile new task flow. Upstream now derives a draft's branch instead of writing it from effects (#25706). The fork's two effects (default base branch, local-branch sync) are gone. fillNewTaskWorkspaceBranch now takes the project's Default base branch, and picks no base while Create new branch is off. The new task flow, its send path, and the pending-drafts list share that one rule. resolveAutomaticWorktreeBaseBranch was deleted and its tests moved. Upstream removed queued-task editing (#25684), so the fork's copy of the toggle there went with it.
• ADR 0009, settings. Upstream gave worktrees their own settings page on web (#25651) and mobile (#25686). Default base branch moved there from Source Control, next to Start from remote. The user doc path is updated.
• ADR 0011, mobile update checks. Upstream merged both checks into environmentReleaseCheckAtom (#25895). Its reader now returns the server's version and releaseRepository together.
• ADR 0016, schedule tools. Upstream folded update_scheduled_task into schedule_task (#25423). The fork's target stays on the combined input, and the update branch now forwards it; upstream's does not.
• ADR 0023, mobile outbox. The drain hook became an app service (#25678). The fork's setup-command split and createNewBranch were reapplied there.
• ADR 0014, sidebar PR scoping. Upstream's sidebar filter now takes several projects (#25284), but the PR page filters by one. The fork's Pull requests button and palette entry scope the page only when exactly one project is selected, and otherwise open it unscoped like upstream. This pre-reset behavior wasn't described in any ADR; ADR 0014 now records it.
• Upstream deletions (#26238, #21039). Accepted the deletion of LegacySidebar.tsx, logicalProject.ts, the catalog store's unused clear, withRunningThreadContinuation, and the remaining capability gates (project overrides, link-resolution pullRequests). Fork tests that asserted those gates were reduced to the cases that still apply.
• Lint. Upstream replaced the per-file effect budget with reasoned exceptions (#26161). The branch selector's existing-branch effect now uses the new rule.
• Agent context budget. Upstream's new agentContextBudget.json must equal the measured context. It now records the fork's MCP tool list (46,912 bytes, about 1 KB over upstream's because of the fork's target and createBranch copy).
• ADR 0011, CI. Kept ci.yml on GitHub-hosted runners, without upstream's Blacksmith apt mirrors, and ported upstream's built-web boot check. Dropped upstream's new agent-context-budget.yml and mobile-fingerprint-label.yml; the release, relay, desktop, and mobile workflows stay deleted.

CI fix outside the merge. GitHub's ubuntu-24.04 image moved from Git 2.55 to 2.56, which reports a .git file pointing nowhere as "gitfile does not point to a valid repository". Upstream's storage cleanup only recognized "not a git repository", so its own test failed on the runner (and would on main). Storage cleanup now accepts both messages; ADR 0027 records it.

Implemented upstream: nothing new this round. Upstream's spoken short names (#24205) sit beside ADR 0007's slug qualifiers instead of replacing them.

ADRs

All ADRs now compare against 58e60bf5e. Notes were added or rewritten in 0007, 0008, 0009, 0011, 0014, 0016, and 0021, and ADR 0027 is new.

git show --remerge-diff HEAD shows the whole conflict resolution.

Scope and approval

This is a maintainer-requested sync of the fork onto upstream. Every fork divergence is covered by an ADR in docs/adr.

Verification

• vp run check:changed upstream/main: format, lint, knip, GraphQL, typecheck (36 packages), tests (136 files, including web browser tests), and React compiler coverage all pass.
• Local environment notes:
  • GitManager tests need GIT_CONFIG_GLOBAL=/dev/null here, because the global config sets push.default=upstream.
  • Chromium needed NixOS libraries on LD_LIBRARY_PATH.
• Not run locally: the full package suites, repo-wide vp check, and a manual pass in a real client. CI runs the suites.

Model: Claude Opus 5.5; harness: Claude Code in T3 Code.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T10:55:14.511637Z	fc5e138	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[fryuni-proval]

⚫️ [PROBLEM] Provide a supported refresh path for expiring GitHub App tokens

⚫️ [PROBLEM] In packages/source-control-github/src/server/GitHubAppSignIn.ts:210–212, the refresh grant sends client_id and refresh_token, but GitHub's GitHub App refresh endpoint also requires client_secret. The device-code exchange can succeed without a secret, so initial sign-in works while refreshing an expiring user token fails; once the access token expires, app-only users lose GitHub access and must sign in again. The mocked refresh responses do not exercise that requirement. Route refreshes through a confidential backend that holds the app secret, or explicitly support non-expiring tokens/re-authentication instead; do not bundle the app secret into distributed clients.

[fryuni-proval]

⚫️ [PROBLEM] Bound peer calls through response-body completion

⚫️ [PROBLEM] apps/server/src/peer/PeerMcpClient.ts:200–202 reads the whole response without an application deadline, and the initialization and POST requests at lines 103–151 are unbounded as well. A peer can answer its descriptor successfully and then stall /mcp or keep its SSE body open. In that case, the 50-second wait chunks in PeerForwarding do not bound the actual HTTP operation, so followers cannot reach their retry logic. Cancellation is also affected: RemoteDelegation.cancel awaits stopThere before recording the local cancellation (apps/server/src/peer/RemoteDelegation.ts:729–734). Add deadlines covering both headers and body consumption, allowing the requested wait duration plus transport grace for wait calls, and map expiry to a retryable failure.

[fryuni-proval]

Thanks for building out linked-environment workflows and the recovery paths around them.

Overview

This change adds peer linking and remote task delegation through MCP, GitHub App sign-in, shared terminal sizing across clients, and new diagnostics and startup recovery behavior. My review focused on the new peer transport, authentication, and related recovery and terminal paths; it was not an exhaustive review of all 2,382 changed files. I inspected code and tests but did not execute the test suite.

Main Issues

⚫️ GitHub App refresh cannot authenticate: packages/source-control-github/src/server/GitHubAppSignIn.ts:210–212 omits the client secret required by GitHub’s refresh grant, so expiring app sessions cannot refresh successfully.

⚫️ Stalled peer calls delay recovery and cancellation: apps/server/src/peer/PeerMcpClient.ts:200–202 consumes the response body without an application deadline; wait chunking does not bound transport stalls, and local cancellation can remain blocked behind the remote stop call.

Recommendation: request changes for these two issues. Both are detailed inline with suggested approaches.