feat(mcp): update environment preferences

[juliusmarminge]

Problem

Agents could inspect current environment preferences but had no narrow, permission-aware way to update useful nonsecret server-owned defaults.

Change

Add t3_environment_preferences_update for an explicit typed allowlist: default thread environment mode, new-worktree origin behavior, provider update checks, normalized background-activity presets, and bounded source-control writing style.

Behavior

Omitted fields remain unchanged, explicit empty custom instructions clear them, and the result comes from normalized persisted settings rather than request inputs. Mutation requires a full-access/default caller. A fresh caller shell is checked under the canonical ThreadCommandExecutor lock held through settings persistence, so a concurrent V2 downgrade wins safely. Existing settings notifications continue to update web, desktop, and mobile clients. Provider configuration, credentials, paths, browser access, observability, and arbitrary settings remain excluded.

Focused validation

• real settings persistence, notification, normalization, omission/clear, and Unicode code-point tests
• Deferred-gated real V2 caller-downgrade race coverage
• production HTTP tools/list, Claude read-only allowlist, and presentation coverage
• 6 focused files / 18 tests passed across the complete native stack
• server and contracts scoped typechecks, targeted formatting, and git diff --check

Dependency

Upper layer of native stack 8782. Depends on #8726 for the safe current-environment read foundation and preference projection.

Implemented by GPT-5.6-Sol via Codex in T3 Code.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: be30e0c9-f657-4a2e-902b-cf8e8d569c62

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can activate Security or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for aae1adc.

This comment will update automatically after the next completed run.

[macroscopeapp]

Effect service conventions review: one deviation found in the new ThreadDispatchLockV2 service definition. The rest of the change (dependency acquisition via yield* Foo.Foo in EnvironmentMcpService.make, Layer.effect canonical layer, inline service interface, subpath namespace imports of effect/*, test-only Layer.succeed/Layer.mock/provideService seams) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

One convention finding on the new test module's service imports. The prior finding on threadDispatchLockLayer in KeyedSerialExecutor.ts still stands but is not re-posted.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This adds a production MCP mutation that durably changes environment-wide defaults and operational behavior, including thread environments, background activity, provider checks, and source-control writing. Its shared orchestration locking and cross-client settings notifications make the blast radius broader than a small isolated option.

Notes:

• Diff unchanged. Approvability was decided on eligibility alone.

No code changes detected at aae1adc. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[juliusmarminge]

Superseded as the active MCP proposal by #10560 in the rebuilt MCP stack, following the maintainer request to review thin service wrappers separately from service hardening.

This is not a full feature-parity replacement. Updates require a live full-access/default caller under the existing ThreadCommandExecutor. Provider configuration, secrets and admin controls are not exposed. No new settings store or lock service.

Closing this mixed proposal without merging. The remote branch agents/mcp-environment/preferences and exact head aae1adc5097ced03fa716e4222db448e6425310f are retained so the service changes can be extracted for separate review later.