chore(upstream): sync marcode through 6c583620

[maarco]

What Changed

Merges 130 upstream commits from pingdotgg/t3code — merge base 52b2bf77, upstream head 6c583620 ("feat(mobile): add Android agent notifications and ongoing activity (pingdotgg#10416)") — into Marcode as one two-parent merge commit (3ba313f1, parents a9836f5f + 6c583620), plus two follow-up commits for fork-boundary breaks the merge carried in silently:

Commit	What
3ba313f1	The merge itself; 41 conflicts resolved by hand.
48b3610	Upstream's new window-capture surface claimed upstream's desktop identity — including a D-Bus allowlist that refused every Marcode capture request.
8a5e138	Upstream's new Android push path used t3code-relay/… Effect service keys and upstream bundle-id fixtures. Both CI failures were here.

All four required checks are green on 8a5e138: Check, Test, Mobile Native Static Analysis, Release Smoke (plus Test Server 1–3 and Rust). claude-review is red for an unrelated reason — see the comments.

This supersedes the two stale open sync PRs and the blocked-sync issue, all of which are ancestors of this merge:

• chore(upstream): sync marcode through 061543e9 #78 (through 061543e9)
• chore(upstream): sync marcode through 8b2838e0 #76 (through 8b2838e0)
• upstream sync blocked: pingdotgg/t3code@12391bd0d38e #79 upstream sync blocked: pingdotgg/t3code@12391bd0

41 paths conflicted. Every one was resolved by hand, combining both intents — no whole-file ours/theirs, no force push, reset, restore, stash or clean.

Conflict decisions

Path(s)	Decision
persistence/Migrations.ts	Kept Marcode's deployedMigrationEntries split and frozen 1–49 history; took upstream's un-export of makeMigrationLoader.
marcode-sqlite-state.ts, codexLaunchArgs.ts, cloud/publicConfig.ts	Kept Marcode's MARCODE_* names; took upstream's knip un-exports.
WorkspaceFileSystem.ts, contracts/project.ts	Kept Marcode's added error classes; adopted Effect rc.112's Schema.TaggedError rename.
contracts/settings.ts + test	Additive both sides — kept unifiedWorkspaceSidebar and upstream's snapShot settings.
AgentSessionScanner.test.ts	Took upstream's two new exclusion tests; kept Marcode's .marcode worktree test.
electron-launcher.mjs	Kept Marcode identity; took upstream LAUNCHER_VERSION 19 and un-exports.
electron-launcher.test.mjs	Upstream split env into a sourced script, so Marcode's MARCODE_PORT/MARCODE_HOME assertions moved onto makeDevelopmentEnvironmentScript — where they now actually cover the rename again.
Desktop Linux identity (6 files)	Adopted upstream's shared resolveLinuxDesktopEntryName helper but not their reverse-DNS rename — see the open questions below.
ElectronProtocol.ts, DesktopWindow.test.ts, shared/git.test.ts	Kept Marcode schemes/fixtures; took upstream's un-exports, new mocks, and ssh:// case.
.devcontainer/	Took upstream's rewrite (base image, on-create/update-content scripts, forwarded ports) with Marcode's name, MARCODE_HOME and .marcode state.
mobile/app.config.ts	Kept Marcode's black-on-white release mark; took upstream's new adaptive-background and splash keys.
SettingsRouteScreen.tsx, MobileClientsUserProfilePage.logic.ts	Took upstream's Android-aware copy and platform logic under Marcode branding.
ConnectOnboardingDialog.tsx, WelcomeWizard.tsx	Took upstream's shared wizard components (WizardPopup wraps Marcode's DialogPopup, so overlay/modal-layer behavior is preserved) and re-applied Marcode's product copy. Marcode's delta here was 10 lines against a 783/693-line upstream rewrite.
rightPanelStore.ts	Kept marcodeRightPanelPolicy's ownership of the storage key/version and panel-key predicate; took upstream's new PULL_REQUESTS_PANEL_REF, which other merged files already import.
SettingsSidebarNav.tsx	Took upstream's removal of the router-state read (the cause of the page-switch shift); kept Marcode's back control.
ThreadTerminalDrawer.tsx	Kept Marcode's own link provider; ported upstream's pingdotgg#10060 browser-override and toast error handling into it.
ChatView.tsx	Took upstream's activeProject record prop; kept Marcode's FloatingPillNav imports.
useTheme.ts/.test.ts, index.css	Kept Marcode's dark-onboarding seam and Mentiko chrome; combined upstream's additive rules.
DMG backgrounds	Kept Marcode artwork (pinned by build-desktop-artifact.test.ts).
95.astro	Kept Marcode's removal (pinned by retiredRoutes.test.ts).
pnpm-lock.yaml	Regenerated with pnpm, not hand-resolved.

Fork-boundary breaks that merged clean (no conflict)

These are the dangerous ones — each would have shipped silently:

1. Effect beta.103 → rc.112 removes Schema.TaggedErrorClass. Migrated the Marcode-only files still using it (the upstream-sync tooling), which upstream never touches.
2. The Linux desktop-entry name arrived as upstream's. resolveLinuxDesktopEntryName is new from upstream in this delta, so taking their side would have reverted DesktopEnvironment's marcode.desktop. Restored, and pinned with a test that DesktopEnvironment and DesktopEarlyElectronStartup agree — verified it fails when the seam is broken. Correction to an earlier version of this description: the window class half was already divergent on main (DesktopEarlyElectronStartup said t3code, DesktopEnvironment said marcode), so aligning it fixes a pre-existing bug rather than one this merge introduced.
3. ThreadTerminalDrawer would not have typechecked: openTerminalLinkInPreview's new forceBrowser is required, and Marcode's own link provider never passed it.
4. Upstream's new CaptureShortcutConfig test disabled a t3code/ oxlint rule; Marcode's plugin namespace is marcode, so the directive was dead and CI failed on the unused-directive error.
5. Sidebar.tsx and CommandPalette.logic.test.ts still used the removed projectCwdByKey map and lacked Marcode's required workspaceLayoutVersion.
6. Upstream's widened knip server-export scope (ci(knip): enforce server exports pingdotgg/t3code#10282) newly covers Marcode files. Un-exported four module-private helpers and covered defineMarcodeMigration with a test of its reserved-id guard.
7. useTheme's onboarding seam lost isOnboardingThemeActive and both onboardingActive bindings to an upstream rewrite; restored.
8. The GNOME extension refused every Marcode capture request (48b3610). Its D-Bus allowlist held com.t3tools.T3Code.SnapShot, but the client requests ${linuxDesktopEntryName without .desktop}.SnapShot → marcode.SnapShot. Runtime-only, Linux-only, and it surfaces as an authorization error. Pinned by gnomeCaptureClientNames.test.ts. Also fixed three install collisions with a real T3 Code install (extension uuid, shared ~/.local/share/t3code/ helper dirs, KDE .desktop entry) and a macOS permission prompt reading "T3 Code".
9. The relay's new Android push path kept upstream's identity (8a5e138). Five Context.Service keys spelled t3code-relay/…, which effect(deterministicKeys) rejects because the package is marcode-relay; and ApnsDeliveries.test.ts asserted a Marcode bundle id against an upstream fixture. These were the two CI failures.

Coupled changes

pnpm-workspace.yaml (Effect rc.112) and infra/relay/package.json (Alchemy beta.76) both moved, and upstream's own chore(refs) commits carried the matching .repos/effect-smol and .repos/alchemy-effect subtrees in the same delta. No separate sync:repos run was needed — verified the vendored Effect source is the one that renamed TaggedErrorClass.

Why

Scheduled daily upstream sync. Marcode is a maintained fork, so upstream correctness, security, protocol and dependency fixes have to land even when they touch customized files — hotspots are mandatory-review paths, not automatic keep-Marcode paths.

UI Changes

Not captured — this environment has no browser or simulator. The merge changes user-visible web and mobile surfaces (onboarding wizard, Connect dialog, settings sidebar, terminal links, mobile theme list, Android adaptive icons), so per the runbook the integrated client verification is still required before this leaves draft.

Open questions for review

1. Linux desktop-entry filename format. Upstream moved to reverse-DNS (com.t3tools.T3Code.desktop) and centralized it in one helper. I took the refactor but kept Marcode's existing marcode.desktop / marcode-dev.desktop, because that filename is what existing installs' xdg-mime associations point at — renaming it would silently drop every user's marcode:// handler. If upstream's format change was carrying a Linux packaging fix, Marcode needs the equivalent deliberately, as a migration rather than a merge side effect.
2. How far to carry Marcode naming into the new capture surface. I renamed what breaks or collides (D-Bus allowlist, extension uuid, shared data dirs, the macOS prompt) and left ~19 "T3 Code" strings in desktop runtime messages alone, since main already carries 16 such files and AGENTS.md rules out mass-replacing internal upstream-shaped identifiers. That boundary is a judgement call, not a rule.

Verification

CI on 8a5e138 — all four required checks green:

Check	Result
Check	✅
Test	✅
Mobile Native Static Analysis	✅
Release Smoke	✅
Test Server 1 / 2 / 3, Rust, Mobile Native Changes	✅
claude-review	❌ unrelated: unset ANTHROPIC_API_KEY, red repo-wide including on main

Locally, run the way CI runs it: vp check 0 errors, vpr typecheck clean across all 14 packages, vp run knip:check clean, and focused suites across contracts, shared, marketing, desktop, server, web, scripts, mobile and relay.

Two tests fail in the authoring container but pass in CI, confirmed from CI's own log rather than assumed: scripts/dev-runner.test.ts (no IPv6 here — ::1 binds return EAFNOSUPPORT) and scripts/update-release-package-versions.test.ts (chmods to 0400 and expects a write to fail; the container runs as uid 0). Neither was modified.

Not covered here

• Integrated web/mobile client verification, per UI Changes above.
• Pre-existing and out of scope: docs/operations/development.md and the Clerk auth-redirect fixtures still describe upstream's ~/.t3 / T3CODE_HOME / t3code://. Those are on main already, not introduced here.

Checklist

• This PR is small and focused — no: it is a 130-commit upstream merge, which is the unit of work for a fork sync.
• I explained what changed and why
• I included before/after screenshots for any UI changes — not captured; no browser in this environment
• I included a video for animation/interaction changes — not applicable

🤖 Generated with Claude Code

https://claude.ai/code/session_017aktzmLA2BYiyzBZUSikhq

[maarco]

Two follow-ups on this PR: one correction to the description above, one more round of fork-boundary fixes, and a note on a red check.

Correction: the linuxWmClass divergence was pre-existing, not this merge's

The description says the Linux window class "silently reverted to upstream identity" in this merge. That is wrong for the window class, and it changes what the diff should be read as fixing.

On main (a9836f5f), the two producers already disagreed:

• DesktopEarlyElectronStartup.ts:84 — linuxWmClass: … ? "t3code-dev" : "t3code"
• DesktopEnvironment.ts:240 — linuxWmClass: … ? "marcode-dev" : "marcode"

The pre-ready path is the one that sets Chromium's --class switch, so shipped Marcode has been advertising t3code while its desktop entry says marcode — a pre-existing bug, now fixed here rather than introduced and fixed here.

The desktop entry name half of that claim does hold: resolveLinuxDesktopEntryName is new from upstream in this delta, and taking their side of the conflict would have reverted DesktopEnvironment's marcode.desktop. The pin test covers both halves either way.

48b3610 — the new capture surface carried upstream identity, and none of it conflicted

Upstream's cross-platform window capture (pingdotgg#8103) landed in this sync. Reviewing the merged tree for renamed identity turned up one functional break and three install collisions, none of which produced a conflict marker:

• The GNOME extension refused every Marcode capture request. Its CLIENT_NAMES D-Bus allowlist held com.t3tools.T3Code.SnapShot, but the client requests ${linuxDesktopEntryName without .desktop}.SnapShot — marcode.SnapShot. Runtime-only, Linux-only, and it fails as an authorization error rather than a missing feature. gnomeCaptureClientNames.test.ts now pins the allowlist against both halves of that derivation; I confirmed it fails when the list is put back to upstream's.
• Install collisions with a real T3 Code install: the extension installed under upstream's uuid snap-shot@t3.codes, capture helpers and extension backups staged under a shared ~/.local/share/t3code/, and a com.t3tools.T3Code.KdeCapture.desktop entry written into the user's applications dir.
• NSScreenCaptureUsageDescription said "T3 Code" in the macOS permission prompt for an app whose CFBundleDisplayName is "Marcode".

Left upstream-shaped on purpose: the t3-kde-snap-shot / t3-hyprland-snap-shot binary names (built from upstream's crates), the X-T3Code-Capture-Helper marker key, and the "T3 Code" strings in desktop runtime messages — main already carries 16 such files, and AGENTS.md rules out mass-replacing internal upstream-shaped identifiers. Flagging that boundary explicitly since it is a judgement call, not a rule.

claude-review is red, and it is not this PR's

The check failed 40s in with is_error: true, total_cost_usd: 0, no model usage and an empty ANTHROPIC_API_KEY in its env — it never performed a review. It has failed on all 10 most recent runs across 4 branches, including chore/upstream-52b2bf77a941, whose merge is on main today. This merge does not touch .github/workflows/claude-code-review.yml. It needs the repository secret configured; there is no fix to port into this PR, and I am not spending the re-run allowance on a deterministic credential failure.

It is not one of the four required checks. The rest of CI was still in progress at the time of writing and now runs against 48b3610.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.4 KiB	13.5 KiB	+100 B (+0.7%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	+10 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+90 B (+1.4%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	57.0 KiB	+822 B (+1.4%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.4 KiB	13.5 KiB	+118 B (+0.9%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.1 KiB	+10 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+108 B (+1.7%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.8 KiB	+840 B (+1.4%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: a9836f5 · PR result: 8a5e138 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

CI on 3ba313f1 failed Check and Test. Both were in infra/relay — the one package I did not typecheck locally before opening this, which is the miss that let them through. Fixed in 8a5e138.

Upstream's Android agent notifications (pingdotgg#10416) brought a new FCM path carrying upstream's identity, and none of it conflicted:

Check / vpr typecheck — five effect(deterministicKeys) errors. That diagnostic derives a Context.Service key from the package name, and Marcode's relay package is marcode-relay, so upstream's t3code-relay/… keys are rejected outright: WebCrypto, FcmAssertionSigner, FcmClient, FcmDeliveries, FcmDeliveryQueueSender. Every pre-existing service in the package already spells its key marcode-relay/….

Test — ApnsDeliveries.test.ts asserted com.t3tools.marcode.preview… against a fixture feeding it com.t3tools.t3code.preview. Marcode had renamed the bundle-id fixtures to its real mobile identity; upstream's new blocks reintroduced theirs, and the two halves met inside one assertion. Renamed the four new occurrences plus two in the new FCM test files, matching apps/mobile/app.config.ts.

I re-verified the way CI runs it this time rather than by focused scope: vp check 0 errors, vpr typecheck clean across all 14 packages, full relay suite green (30 files, 286 tests).

Two local failures that are not CI's, confirmed rather than assumed

Running CI's exact test command locally also fails scripts/dev-runner.test.ts and scripts/update-release-package-versions.test.ts. Both are artifacts of this container, and CI's own run on 3ba313f1 is the proof — its log shows dev-runner.test.ts (73 tests) ✓ and update-release-package-versions.test.ts (11 tests) ✓, with scripts green at Test Files 24 passed (24):

• dev-runner: no IPv6 here — a ::1 bind returns EAFNOSUPPORT, so every probed port reads as occupied. Verified directly.
• update-release-package-versions: the case chmods a file to 0400 and expects the write to fail. This container runs as uid 0, where that write succeeds. Verified directly.

Neither needs a change, and I have not touched either test.

On the "2 failed" counts

Both jobs reported 2 failed while showing one failing task each. Reading the full logs: vp check reported Found 0 errors and 743 warnings, the only typecheck errors were the five relay ones, and the only failing suite was relay's. The second count is a vp run accounting artifact, not a second real failure — worth stating explicitly since it would otherwise look like something is still unaccounted for.

claude-review remains red for the reason in my previous comment (unset ANTHROPIC_API_KEY, failing repo-wide); nothing changed there.

---

Generated by Claude Code