chore(fork): merge upstream 2026-10-17

[Yarden-zamir]

Merges pingdotgg/t3code main (371 commits) into fork main. The daily Fork Sync failed on 2026-10-15, 2026-10-16 and 2026-10-17 with merge conflicts. This merge also brings the Expo fixes that the fork APK needs: pingdotgg#20131 and pingdotgg#20389.

Commits

• chore(fork): merge upstream 2026-10-17: the merge and its conflict resolutions.
• fix(fork): fork web code follows the React Compiler lint rules: fork files drop useMemo/useCallback and follow the compiler rules that upstream now lints on every web file.
• test(fork): machine level standard keeps access and relay management out: test expectations for check 1 below.
• CI follow-ups: compactRelativeTimeLabel is no longer exported (knip); machineMap.ts formatting; five fork web files drop try/finally, because upstream's reactCompilerCoverage.test.ts fails on any file the compiler skips (sibling pairing moved to the module function pairSiblingOrigin); the Fork CI web job installs headless Chromium for upstream's new browser tests.

Conflicted files

Upstream code is kept everywhere. Fork behavior stays in fork files or one-line hooks.

Server

• orchestrator/tools.ts: the fork schedule_task text (model selection) plus upstream's new sentence about untrusted webhook data.
• ProviderRuntimeRecoveryService.ts: upstream's stoppedThisPass and the fork recoverInterruptedTurns both pass to reconcileProjection. The fork fallback settledRunWithOpenBackgroundWork still runs after upstream's restartContinuationRun.
• RestartContinuation.ts, RecoverInterruptedTurns.ts: isNativeMaintenanceCommand moved to CommandPolicy.ts upstream; imports follow.
• ReviewService.ts: upstream moved the workspace check to KnownWorkspaces. The fork check for worktrees from the worktree path template (isT3CreatedWorktree) stays after it.
• GitVcsDriverCore.ts: upstream's refuseOptionLikeRefName checks and -- separator, with the fork template branch name (newRefName).

Mobile

• ConnectionsNewRouteScreen.tsx: upstream dropped replaceWithHome. The fork staged client access (access.stage() and undo on failure) stays.

Web

• ChatView.tsx: upstream moved the right panel into chat/RightPanelSurfaceContent.tsx. The fork machines panel is one case "machines" there. onResumeLimitedThread stays on QueuedRunsControl. shouldShowScriptTerminal import stays.
• Sidebar.tsx: upstream moved the thread list into useSidebarThreads and useSidebarLookups. The owner filter (ForkSidebar.useSidebarOwnerFilter) now runs in useSidebarLookups. The group tabs (ForkSidebar.useSidebarGroups) run in useSidebarThreads and give the partition its visible threads. The settled tail resets on scope, tab and owner filter. Drag hooks, header rows, empty texts and draft scope are unchanged.
• routes/_chat.pull-requests.tsx: upstream moved the query parser to @t3tools/client-runtime/pull-request-query and the scope logic into usePullRequestScope / usePullRequestQueryFilters. The fork org:/owner: parsing is now a wrapper in pullRequestOwnerFilter.logic.ts (parsePullRequestQueryWithOwners) around the upstream parser. The owner filter runs inside usePullRequestScope, so the scope, project menu and per-server split read the owner's projects as before. Filter chips are unchanged. pullRequestList.logic.ts is now equal to upstream.
• SettingsPanels.tsx, useAvailableSettingsSearchItems.ts, useScopedSettings.ts, SettingsSidebarNav.tsx, ConnectionsSettings.tsx, ProjectActionsSettings.tsx, projectScriptEditor.tsx: upstream style without manual memo, with the same fork hooks (Fork.* rows, restore patch, idle install, sidebar group search item, machine map share, fork search items, selectVisibleNetworkEndpoints, previewOverlay/runInBackground).
• ChatMarkdown.tsx, ChatHeader.tsx, ThreadNotificationCoordinator.tsx, AppSidebarLayout.tsx, __root.tsx, useSidebarProjectGroups.ts: upstream code plus the fork hook (thread link chips, header pin menu, replacedByTag, pinned scripts, paused/pending surfaces with upstream's BrowserChromeThemeSync, unsorted groups).
• timestampFormat.ts: upstream added the same nowMs parameter; upstream version taken.

Card block (known exception): upstream changed one line in the thread card: the time label is now <RelativeTimeLabel>, so only the label re-renders each minute. The fork card keeps its layout and uses that component.

Checks

1. Client access scopes (feat(auth): pairing grants access and T3 Connect management by default pingdotgg/t3code#20432). Upstream removed AuthAdministrativeScopes, and AuthStandardClientScopes now has access:read, access:write and relay:write. Browser client sessions still drop access:write and relay:write (browserGrantFor). But the fork level standard mapped to AuthStandardClientScopes, so every standard arrow would have gained them. Fix in packages/contracts/src/machineMap.ts: standard is AuthStandardClientScopes without those three scopes, and admin is AuthStandardClientScopes. apps/machine-map/SPEC.md (MM-302 levels) is updated.
   The Cloudflare Access owner login (forkEnvironmentAuth.ts) also used AuthStandardClientScopes. That login covers every browser while clientAccess is off (the default), an unknown key under observe, and the desktop service token under enforce. With the new upstream set, a stolen owner cookie could mint pairing links that outlive it (MM-917, MM-922). It now uses MACHINE_LEVEL_SCOPES.standard, as before the merge. The owner-login tests in MachineMapAuth.test.ts compare against MACHINE_LEVEL_SCOPES.standard, so they catch this next time. Normal pairing links keep upstream's new default. No other fork code grants AuthStandardClientScopes to a browser or token.
2. React Compiler lint (chore(web): React compiler rules apply to every web file pingdotgg/t3code#20791, chore(web): lint rejects "use memo" directives pingdotgg/t3code#20843, chore(lint): fail lint when the React Compiler skips a listed file pingdotgg/t3code#20292). Lint on all 224 fork-changed files in apps/web, apps/mobile and packages/client-runtime exits with no errors. Behavior notes: the sidebar owner filter now clears the thread selection in setOwnerFilter (like upstream's scope change), not in an effect. Limit: an owner filter change from outside that handler, for example restore defaults, does not clear the selection. Five effects got a disable comment with a reason, as upstream does.
3. Webhook data tags (fix(server): webhook request values reach the agent marked as request data pingdotgg/t3code#20447). No fork code or fork test depends on the plain substitution. Not checked: the prompt of the VPS task "Fork repair". Its values now arrive inside <webhook-data-…> tags.

Verification

• Typecheck: apps/web, apps/server, apps/mobile, packages/contracts pass.
• Tests: server recovery, restart, review, git driver, orchestrator tools and machine map tests; web settings, pull request, timestamp, chat header and notification tests; pullRequestQuery and machineMapResources. All pass. On the agent machine, the git hook and split index tests need GIT_CONFIG_GLOBAL=/dev/null (a global core.hooksPath). One new upstream ReviewService test fails only inside a T3-created worktree, because the fork template worktree check accepts paths inside it. A plain CI checkout has no marker.
• scripts/fork-android-apk.sh is unchanged; its io.github.jakex7.peek rename is left for the Android thread.