feat(mcp): support thread attachments

[juliusmarminge]

Problem

MCP thread creation and send paths discarded attachments even though V2 already supports thread-scoped attachment claims.

Change

• Add a signed pending-upload preparation tool and bounded ready-to-send attachment references.
• Accept attachment references on thread creation and send without embedding file bytes in MCP results.
• Reuse the existing attachment store, claim, provider capability, and V2 dispatch paths.
• Recover accepted start/send receipts before mutable upload checks and retain claims on accepted or uncertain outcomes.

Behavior

Uploads use the existing POST route and bearer URL. New operations validate ownership, MIME support, and provider capability before creating a thread. Accepted retries return the original message and run identity after the pending upload disappears, while unused replay copies are cleaned up. OpenCode keeps path fallback behavior and Antigravity accepts image attachments only.

Validation

• 63 focused attachment, MCP, ThreadLaunch, ThreadManagement, receipt-replay, contract, and presentation tests.
• Scoped @t3tools/contracts, @t3tools/shared, and t3 typechecks.
• Formatting and type-aware lint for all changed files.

Base

Standalone PR on t3code/codex-turn-mapping at 415ed0f73b97f1655b6282492f81d0b2bba3a9cc.

Implemented by GPT-5.6-Sol via Codex in T3 Code.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c62e49a-4968-46bc-a1ba-91b5d2c332f8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Your free Security trial is over. An organization admin can activate Security or dismiss this notice.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for 6991ca7.

This comment will update automatically after the next completed run.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a substantial production MCP attachment workflow spanning upload authorization, filesystem claims, orchestration retries, contracts, and provider adapters. An unresolved provider-delivery concern and newly added static-analysis suppression directives make human review necessary.

No code changes detected at 6991ca7. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[cursor]

Stale Bugbot comment from a previous run.

[macroscopeapp]

UI consistency review

One concrete regression found: the shared markdown renderer now resolves its environment-scoped actions from the globally active environment instead of explicit scope.

Everything else in the changed web UI (panel/toolbar displayMode variants, ThreadDetailsPanel shared style constants, PopoverPopup positioner props) stays within the shared primitive contracts, and no apps/web/src CSS changed in this PR.

^{Posted via Macroscope — UI Consistency}

[macroscopeapp]

Reviewed the new/changed Effect service code in this PR (AttachmentMcpService, the attachment toolkit, OrchestratorMcpService, ThreadManagementService, Orchestrator). One convention deviation found; everything else (namespace imports, inline Context.Service interface, environment-based dependency acquisition, structured Schema.TaggedErrorClass failures with derived messages and preserved cause) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Effect service conventions review: one import-convention deviation in the new MCP attachment test. Everything else (new AttachmentMcpService tag/make/layer shape, environment-based dependency acquisition, and the new ThreadManagementPostDispatchProjectionError structural error with derived message and preserved cause) matches the repository conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Effect service conventions review: one finding on the new OrchestratorV2Shape.getCommandReceipt signature.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Effect service conventions review: one finding on the new transformEventSink type signatures in the replay harness.

^{Posted via Macroscope — Effect Service Conventions}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON, but a cloud agent failed to start.}

^{Reviewed by Cursor Bugbot for commit da38dd1. Configure here.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[juliusmarminge]

Superseded as the active MCP proposal by #10564 in the rebuilt MCP stack, following the maintainer request to review thin service wrappers separately from service hardening.

This is not a full feature-parity replacement. t3_thread_send remains unchanged. The new t3_thread_send_attachments checks target ownership and permission ceilings. Each call is a new message; claimed files are retained when dispatch outcome is uncertain. Provider support stays in adapters, and no keyed replay protocol is added.

Closing this mixed proposal without merging. The remote branch agents/mcp-queue-inputs/attachments and exact head 6991ca726981ad8a608484beffd0dd76c9bef020 are retained so the service changes can be extracted for separate review later.