chore(upstream): sync marcode through fff33f9e

[maarco]

What Changed

Hand-resolved merge of 337 upstream commits pingdotgg/t3code f035a0f4..fff33f9e into Marcode. 79 conflicts resolved by combining upstream correctness/features with Marcode's product divergences (not whole-file ours/theirs). pnpm-lock.yaml regenerated with pnpm.

Branding / compatibility — kept Marcode identity, kept upstream-shaped compat ids:

• README / docs / AGENTS: Marcode branding; added Google Antigravity provider (merged in from upstream).
• cli/service.ts, cloud/bootService.ts: "Marcode service", systemd unit marcode.service, launchd plist exports MARCODE_HOME and took upstream's new PATH key. Kept BOOT_SERVICE_UNIT_ENV="T3_BOOT_SERVICE_UNIT" and launchd label com.t3tools.t3code.service (compat).
• Kept marcode:* storage keys, marcode-* mobile schemes, marcode: desktop scheme, marcode-preview-* browser partitions, "Marcode Connect".

Persistence (hotspot) — Marcode owns migration id 033 (ProjectWorkspaceLayout), so upstream's new migrations 042-047 were renumbered +1 to 043-048 (files, registry, tests, and the registry-pin test).

Server orchestration (unified-workspace seam) — kept Marcode's workspace-layout handling and folded in upstream's new project fields (autoPull, projectIcon); WorkspaceFileSystem keeps Marcode's resolveMutationTarget + upstream's new resolveReadTarget.

Web — kept Marcode's retired right-panel file surfaces + floating-editor file opening (rightPanelStore, RightPanelTabs, ChatView, ChatMarkdown, _chat.pull-requests) while adopting upstream's ComposerSurface, PR-status seeds, and browser-profile launcher. Kept the FloatingPillNav shell (AppSidebarLayout, SidebarChrome, ChatHeader) and the xterm terminal (ThreadTerminalDrawer; upstream switched to Ghostty). Adopted upstream's config-driven oxlint maxOccurrences and ported Marcode's baseline into vite.config.ts.

⚠️ Read this first: a silent data-loss regression in the editor save path

fileSaveCoordinator is the one break in this sync that is a behavior conflict, not a naming slip, and it is the thing most worth a careful look.

Upstream added a confirmedRevision counter and changed persistLatest's entry guard from latestRevision === 0 to latestRevision === confirmedRevision. That zero is Marcode's cancel() sentinel — the doc comment on cancel() names the old guard by hand — so:

1. Discarding a buffer mid-write no longer stopped the completing write from rescheduling, and the discarded contents were persisted a second time. Marcode's existing test caught this.
2. Not caught by any existing test: the completing write recorded confirmedRevision = 1 against a revision cancel() had zeroed, so the next edit — whose revision climbs back to 1 — compared equal to that stale confirmation and was silently never persisted. Discard, then keep typing, is an ordinary floating-editor sequence, so this was real data loss.

Both intents are kept: upstream's already-confirmed dedup stays, the zero sentinel is checked separately, a write confirming after a discard no longer records a confirmation, and cancel() resets both counters so they cannot drift apart. A regression test covers discard-then-edit; it fails against the merged code and passes now.

Silent fork-boundary breaks

None of these produced a merge conflict — upstream added new files and new call sites naming identifiers this fork renamed, so the merge took them cleanly. Most surfaced only as CI failures; several would not have surfaced at all.

Break	Effect if left
updatesTestHarness.ts used T3CODE_* env keys	harness diverges from MARCODE_* config
clientMetadata.ts / service.ts labelled "T3 Code"	wrong product name in user-visible strings
vite.config.ts oxlint namespace t3code/	rule overrides silently no-op
bootService.test.ts unit t3code.service	test stops pinning the installed unit name
scripts/package.json lost Marcode's yaml	Test red — Cannot find package 'yaml', plus TS2307 in Check
cli/app.test.ts fixtures assume ~/.t3	Test Server 1 red — fake desktop bound a socket the CLI never dialed
T3Wordmark re-added on web, dangling on mobile	Check typecheck red; web timeline rendered upstream's T3 lettermark
t3 app / t3 theme read T3CODE_HOME	MARCODE_HOME silently ignored; both commands target the default install
DesktopRemoteUpdates.test.ts seeded T3CODE_DISABLE_AUTO_UPDATE	failing test — config reads the MARCODE_ name
BrowserSession.test.ts asserted persist:t3code-preview-	failing tests — production builds persist:marcode-preview-
oxlint-plugin-marcode rule tests targeted plugin t3code	26 failing tests — oxlint rejects the fixture config at parse time
clientMetadata.test.ts asserted "T3 Code Desktop"	failing test — production reports "Marcode Desktop"
clientPersistenceStorage.test.ts seeded t3code:client-settings:v1	assertion stopped covering the stored-settings path
useEnvironmentThemeSync.test.ts seeded t3code:theme	setup stopped covering "a theme is already stored"
fileSaveCoordinator guard change	discarded buffer re-persisted; next edit silently dropped (see above)

Three further invariants worth a second look:

• Brand mark. Marcode renamed upstream's wordmark to MarcodeMark on web and mobile. The merge re-added apps/web/src/components/T3Wordmark.tsx as a new file and pointed the t3-code tool-server icon at it. Both surfaces now render MarcodeMark; the re-added component is deleted. The t3-code server name is an upstream-shaped compat identifier and is untouched — only the icon is brand identity.
• CLI home variable. Marcode's base-dir variable is MARCODE_HOME in config.ts, pair, triage and the installed systemd unit, and triage.ts already carried a seam comment saying upstream reads T3CODE_HOME here. Upstream's own comment in the new theme.ts states the intent — "same precedence as the rest of the CLI" — which on this fork selects MARCODE_HOME. (An earlier revision of this description wrongly listed T3CODE_HOME among the kept compat identifiers.)
• oxlint plugin namespace. The plugin declares name: "marcode". Two upstream rule-test files built fixture configs against plugin t3code, which oxlint rejects at parse time rather than as a type or lint error — which is why they survived the earlier vite.config.ts namespace fix.

Deliberately left upstream-shaped. A sweep of every production (non-test) file this merge touched found "T3 Code" in the new cli/app.ts and cli/theme.ts user-visible error messages. That is not a break: Marcode's own pair.ts and triage.ts on main use "T3 Code" in user-facing CLI prose, and apps/mobile/app.config.ts pairs appName: "T3 Code" with scheme: "marcode" exactly as main does. The CLI surface is deliberately upstream-shaped, consistent with t3 being a kept compat identifier, so none of it was changed. main is the oracle per surface — the fixes above are surface-specific, not a blanket rename.

Removals and renames are now pinned by tests, since they are otherwise invisible to the next merge: scripts/brand-mark-ownership.test.ts (no wordmark component or reference on web/mobile/desktop), os-jank.test.ts (default base dir is ~/.marcode), the corrected BrowserSession.test.ts prefix assertions, the CLIENT_SETTINGS_STORAGE_KEY seed read off the module rather than a literal, and the existing bootService.test.ts plist assertion.

Coupled subtrees: pnpm-workspace.yaml bumped clerk/tailwind/vite-plus but effect stayed at 4.0.0-beta.103, so the vendored effect-smol subtree is unchanged.

Why

Daily upstream sync. Brings upstream correctness, security, protocol, dependency, and feature work (Antigravity provider, server-side thread settlement, PR labels/status seeds, browser profiles, media previews, composer refactor) into the maintained fork while preserving Marcode's intentional product divergences.

Closes the tracking block in #70 (t3code@57a66608, included in this range).

UI Changes

Not captured in this automated sync. Web/mobile/desktop UI hotspots changed and should get runtime verification (test-t3-app / test-t3-mobile, 390px + 820px) before this leaves draft. Two changes are user-visible: the brand mark on both web and mobile timelines, and the editor discard/save behavior above.

Checklist

• Conflicts resolved by combining intents (no whole-file ours/theirs)
• vp check 0 errors; vpr typecheck clean across all 15 packages
• apps/web 3795/3795 (316 files); desktop 707/707; oxlint-plugin 72/72; ssh 358/358
• Server suite green apart from seven documented chmod container artifacts
• Full CI green on a1edd0e7 — Check, Test, Mobile Native Static Analysis, Release Smoke, plus all three Test Server shards, Rust, and claude-review (run 33786720079)
• Per-hotspot runtime verification for changed UI surfaces
• Human review of hotspot decisions before marking ready

Left draft deliberately. CI is green and the branch is mergeable, but this automated sync does not mark PRs ready or merge them. The two unchecked boxes are the remaining human steps.

Container-only artifacts seen while verifying locally, none of them regressions — every one of these files is byte-identical to main, and all of them pass in CI. chmod-injection tests cannot fail as intended in a root container: keybindings.test.ts, server.test.ts, terminal/Manager.test.ts, four cli/theme.test.ts cases, and update-release-package-versions.test.ts. Net.test.ts needs an IPv6 loopback the container lacks (::1 bind returns EAFNOSUPPORT, so isPortAvailableOnLoopback can never succeed).

🤖 Generated with Claude Code

https://claude.ai/code/session_016jdCVqZCzYw2dSFVgnqvob

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.7 KiB	+319 B (+2.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+134 B (+1.9%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.7 KiB	+185 B (+2.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	58.5 KiB	+3.5 KiB (+6.3%)	66.4 KiB	✅
Codex	Live turn messages	16	10	−6 (−37.5%)	21	✅
Claude	Total thread wire	13.4 KiB	13.8 KiB	+328 B (+2.4%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+141 B (+2.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.7 KiB	+187 B (+2.8%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	59.3 KiB	+3.5 KiB (+6.2%)	66.4 KiB	✅
Claude	Live turn messages	16	10	−6 (−37.5%)	21	✅

Baseline: 200e149 · PR result: a1edd0e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.