chore(upstream): sync marcode through 761d4bac

[maarco]

What Changed

Merges pingdotgg/t3code@761d4bac (705 upstream commits since f035a0f4) into main as one two-parent merge commit. 116 paths conflicted and were resolved by hand.

Retired surfaces — Marcode product contracts kept

• The right-panel file/files surfaces stay deleted: FileBrowserPanel, FilePreviewPanel and their exclusive dependencies. Upstream's new openFile/openAttachment store actions, file-surface tabs, copy-path menu item and the FilePreviewPanel branch in ChatView go with them. filePreviewMode.ts is restored — ChatMarkdown's retained task-checkbox tests need setMarkdownTaskChecked.
• ChatHeader keeps Marcode's title-only header plus the pill-nav ThreadActionsCluster. Upstream's entire delta there is the title action menu, project favicon/icon and new-thread-in-project machinery this fork deliberately does not mount.
• SidebarChrome stays the bare Electron drag strip. The pinning test in threadSidebarWidth.test.ts caught the merge reintroducing SidebarBrand — exactly what it exists for.

Upstream refactors adopted, Marcode behaviour re-applied on top

• terminalOutput.ts — took upstream's chunked output model and ported Marcode's ANSI escape-boundary trimming onto both cut points (reset and append), so a trim still never lands inside a CSI/OSC/bare-ESC sequence.
• fileSaveCoordinator — took upstream's confirmedRevision tracking. Combining it with Marcode's cancel() exposed a real bug: upstream's new entry guard compares latestRevision with confirmedRevision, so a write in flight when the buffer was discarded confirmed a stale revision and let the discarded buffer persist a second time. cancel() now zeroes both counters and a cancel token stops the in-flight write from confirming.
• PullRequestCandidatePicker, SidebarUpdateReleaseNotes, PullRequestListFilters, ComposerSurface, updatesTestHarness, writeFakeCli — upstream's extractions taken, with Marcode's tooltip, type-scale and glass-transparency intents re-applied at the new shared producer rather than kept as a divergent copy.
• rightPanelStore drops the dead updatePullRequestTabStatus; RightPanelTabs gains upstream's browser-profile submenu, tab scroll buttons and PR status seeds while keeping Marcode's surface-overflow menu and shelf geometry.

Migrations

Upstream's 042–047 renumbered to Marcode's 043–048. ProjectWorkspaceLayout keeps 033 and every shared migration stays one id higher, as the registry comment requires — renumbering an applied id would re-run or skip it on existing installs. Migration tests renumbered with them.

Fork-boundary breaks that merged cleanly and produced no conflict

These are the dangerous ones; each was found by grepping the merged tree and by typecheck:

Break	Fix
vite.config.ts lint overrides addressed the plugin as t3code/; seven oxlint-disable directives and two rule tests did the same	renamed to marcode/; the per-file effect-runtime debt map moved from the rule source into the config, merging both baselines
t3 theme and t3 app read T3CODE_HOME	MARCODE_HOME, the base-dir variable everywhere else in this CLI
updatesTestHarness exported T3CODE_HOME/T3CODE_DESKTOP_MOCK_*; DesktopRemoteUpdates and AnalyticsService tests set T3CODE_* names their sources no longer read	renamed to MARCODE_*
bootService's service-stopped message and six test assertions named t3code.service	marcode.service, via the BOOT_SERVICE_UNIT_FILE constant
AgentSessionScanner matched /.t3/worktrees/	/.marcode/worktrees/
~100 user-visible strings said "T3 Code"/"T3 Connect" across server CLI, desktop activation, onboarding, settings, clientMetadata, mobile authClientMetadata and user docs	rebranded to Marcode
ExpandedImagePreview and theme tests used t3code: / t3code:theme	marcode: / marcode:theme
scripts/package.json lost the yaml dependency the upstream-sync tooling parses the manifest with	restored
ci.yml folded ripgrep into an upstream step, silently breaking the pin in upstream-sync-workflow.test.ts	kept as its own Install workspace search dependency step

Compatibility identifiers left upstream-shaped on purpose: T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, the t3 CLI/package name, com.t3tools.t3code.service, T3CODE_DESKTOP_REUSE_RESOURCE_MONITOR, and the t3code: storage keys Marcode never migrated.

Terminal divergence

ThreadTerminalDrawer stays on xterm — kept for its search, which upstream's Ghostty surface has no equivalent for. Upstream's migration meant re-porting by hand: the wrapped-link range helpers upstream deleted from terminal-links.ts are restored, the drawer reads the new chunked output, openTerminalLinkInPreview drops the removed args, and writeTerminalOutputUpdate moved to the Ghostty surface that owns it. The divergence is now commented where it lives, per AGENTS.md.

Why

The scheduled sync could not land this delta on its own — 116 conflicted paths means the workflow files a blocked issue and pushes nothing. This is the hand resolution that unblocks it, and after it merges the next scheduled run sees a new merge base and returns to clean-merge on its own.

UI Changes

No screenshots: this container has no display and the sync makes no new Marcode-authored UI. The user-visible deltas are upstream's own (welcome wizard, browser-profile submenu, PR list filters, panel animations) plus the Marcode surfaces this merge preserves rather than changes. Worth one test-t3-app pass on a machine with a browser before this comes out of draft — see below.

Checklist

• This PR is small and focused — it is not, and cannot be: one upstream delta is one merge commit.
• I explained what changed and why
• I included before/after screenshots for any UI changes — see above
• I included a video for animation/interaction changes — not applicable

---

Verification run

• Full-workspace vp run -r typecheck: clean (15 packages).
• vp lint over apps packages scripts oxlint-plugin-marcode infra: 0 errors (warnings are pre-existing react-compiler/tooltip categories).
• vp fmt --check over all 1805 changed files: clean.
• Focused tests green: contracts, shared, client-runtime state, web stores/files/sidebar/connection/theme, server boot service/CLI/migrations/environment/providers, oxlint plugin, upstream-sync tooling.

Two failures reproduce identically on origin/main in this container and are not from the merge — verified in a disposable detached worktree at origin/main:

• packages/shared/src/Net.test.ts → findAvailablePort returns preferred when it is free: the container's port allocation. Neither Net.ts nor its test is touched by this merge.
• apps/web/src/components/ThreadTerminalDrawer.test.ts → Failed to resolve entry for package "@aliimam/icons": the published package's main/module point at files only its build produces, so an --ignore-scripts install cannot resolve it. Fails the same way on main with vite-plus 0.2.2.

A third, Manager.test.ts > preserves non-notFound cwd stat failures, fails only here: the container runs as root and a chmod 000 directory does not block uid 0. It passes in CI.

Follow-up commits: CI, and three more silent breaks

The merge commit went red on four required jobs. Every cause was a fork-boundary
break of the same class as the table above — an upstream fixture or gate that
merged without a conflict and then did not describe Marcode.

Job	Cause	Fix
Check	upstream added a knip dead-code/dependency gate in this sync, running against Marcode's tree for the first time	dropped four deps the fork genuinely no longer imports (@types/react, react, @effect/atom-react from client-runtime; @radix-ui/react-popover from web) and added a scoped apps/web ignore, marked as a seam, for Marcode-owned modules knip cannot see mounted. Also reformatted projectWorkspace.ts, untouched by the merge but reformatted by this sync's oxfmt bump
Test	BrowserSession.test.ts asserted persist:t3code-preview-	persist:marcode-preview-, matching PREVIEW_PARTITION_PREFIX
Test Server 1	Manager.test.ts seeded T3CODE_SECRET to prove secret stripping; Manager.ts strips on the MARCODE_ prefix, so the fixture had stopped exercising the behaviour it names	MARCODE_SECRET
Test Server 2	six new upstream migrations slid Marcode's id-33 anchor out of the migration pin's slice(-10) window	widened to slice(-16), keeping id 33 inside — it is the anchor the one-id offset is measured from
Test Server 1 (2nd round)	apps/server/src/cli/app.test.ts, new in this sync, starts a fake desktop under <root>/.t3 and then invokes t3 app with no base directory. Marcode resolves that default to ~/.marcode, so the fake desktop listened on a socket the CLI never dialed	fixtures use the Marcode home; os-jank.test.ts now pins resolveBaseDir for undefined and blank input, so a future sync that reintroduces ~/.t3 fails at the resolver instead of in a fixture

WSL node-pty marker — a break CI could not have caught

Auditing the tree for ~/.t3 after that last failure turned up a genuine
runtime bug in new upstream code. DesktopWslEnvironment writes the WSL node-pty
prebuild marker as marcode-wsl-node-pty.json, but upstream's new
node_pty_payload_present() guard scans for t3code-wsl-node-pty.json.

That guard exists to stop a runtime whose pty.node went missing from staying
cache-ready forever. Pointed at a marker nothing writes, it inverts: every cached
WSL runtime reads as missing its native payload and is reinstalled on every
launch. The test suite agreed with the guard because its fixture staged the same
pre-rename name — both sides were self-consistently wrong, and green.

The marker is now one exported constant shared by the build script, the probe,
the install guard and the fixture, with a test asserting all three scripts carry
it and none carry the old name.

This also resolves the WSL question this description previously left open:
$HOME/.t3/wsl-runtime becomes $HOME/.marcode/wsl-runtime, through the same
kind of constant. That staging path is new in this sync and has never shipped, so
no installed runtime needs migrating. The .t3code-wsl-runtime-{ready,selected}
dotfiles inside a staged runtime are left alone: internal, written and read by
the same script, and not the user-visible identity the ~/.t3 rename was about.

Left for a decision

• Attachment preview. Upstream added "open a browser-previewable chat attachment in a right-panel file surface". Marcode retired that surface and the floating editor opens workspace paths, not attachment blobs, so attachments download for now. Porting an attachment surface into the floating editor is feature work, not merge work; the seam is commented in ChatView.
• cursor-hygiene-webhook.yml is a new upstream workflow keyed on CURSOR_T3CODE_WEBHOOK_* repo secrets. It skips cleanly when they are absent.
• Vendored subtrees: no sync needed. The effect catalog version did not move (4.0.0-beta.103) and infra/relay's alchemy dep is unchanged, so neither coupling in .github/upstream-sync.yml is triggered. .repos/effect-smol sits at beta.102, a skew that predates this merge.

Still worth doing before this leaves draft

CI is green on cfa4587a — Check, Test, Mobile Native Static Analysis and
Release Smoke all pass. Not yet done, and not doable from this container:

• a test-t3-app pass on a machine with a browser, per the sync runbook's UI-hotspot rule;
• a test-t3-mobile pass — the PR carries the 📱 Native Change label.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MXHnM9VTENCo5sjeucMArL

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.6 KiB	+166 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	7.0 KiB	+137 B (+1.9%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.6 KiB	+29 B (+0.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.0 KiB	57.1 KiB	+2.0 KiB (+3.7%)	66.4 KiB	✅
Codex	Live turn messages	16	10	−6 (−37.5%)	21	✅
Claude	Total thread wire	13.4 KiB	13.5 KiB	+90 B (+0.7%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	7.0 KiB	+144 B (+2.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.5 KiB	−54 B (−0.8%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	55.8 KiB	57.8 KiB	+2.0 KiB (+3.5%)	66.4 KiB	✅
Claude	Live turn messages	16	8	−8 (−50.0%)	21	✅

Baseline: 200e149 · PR result: cfa4587 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.