chore(upstream): sync marcode through f035a0f4

[maarco]

What Changed

Daily upstream sync: merges pingdotgg/t3code@f035a0f4 (143 commits above merge base 82b8a938) into Marcode via a two-parent --no-ff merge. 32 files conflicted; each was resolved by hand to combine upstream and Marcode intent — no whole-file ours/theirs.

Highlights of the conflict decisions:

• Fork-boundary breaks that merged cleanly (no conflict) and were fixed:
  • launchd boot service exported T3CODE_HOME; changed to MARCODE_HOME (the service launcher reads it and exits without it) and added a test pinning it.
  • an upstream bootService test fixture hardcoded the systemd unit as t3code.service; corrected to marcode.service.
  • triage.ts read T3CODE_HOME; changed to MARCODE_HOME.
• Migrations: upstream's new AuthSessionClientConnection migration was renumbered 041→042 (Marcode's ProjectWorkspaceLayout occupies 033, so shared ids sit one higher); focused test updated.
• Navigation shell: kept Marcode's FloatingPillNav ownership — dropped upstream's re-added SidebarUtilityMenu, kept the title-only ChatHeader with thread actions portaled into the pill nav — while taking upstream's WorkspacePageHeader refactor and its cmd+enter background-thread flow.
• Right panel: took upstream's surface-dropdown shortcuts (feat(web): add shortcuts to the surface dropdown pingdotgg/t3code#7318) and desktop tab mute (feat(desktop): mute a browser tab pingdotgg/t3code#7252); kept Marcode's hover-swap tab close and header-placed add-surface menu; kept the retired Files surface out.
• Terminal drawer: kept Marcode's terminal chrome divergence but carried upstream's confirm-before-close (feat(web): confirm before closing a terminal pingdotgg/t3code#7592) into it.
• Thread settling: replaced Marcode's one-hour warm-window heuristic with upstream's more precise anchor rule; rewrote the Marcode-owned tests.
• Approvals/composer: took upstream's compact app-access approval panel (fix(codex): show app access approval prompts pingdotgg/t3code#8058) and top-drawer composer.
• CI: took upstream's launchd-gated mobile lint job; kept GitHub-hosted runners (the fork has no Blacksmith access).
• Lockfile: took upstream's Clerk bump and anthropic-sdk binary overrides; regenerated pnpm-lock.yaml with pnpm (kept Marcode's @aliimam/icons). No coupled vendored subtree moved.

The full per-path rationale is in the merge commit message.

Compatibility identifiers left upstream-shaped on purpose: com.t3tools.t3code.service (launchd label), @t3tools/*, the t3 package/CLI name, T3_BOOT_SERVICE_UNIT.

Follow-up commits (CI fixes on top of the merge)

The first CI run surfaced three failures, all of them fork pins firing or a fork step going missing during an upstream refactor. Each is fixed here:

Failure	Cause	Fix
Test	The fork's runner pin compared the whole runs-on list positionally against 4 entries; upstream added 3 jobs.	Rewritten as a label-membership rule (2e3f60c2), so it trips on a Blacksmith label — the real failure mode — not on job count.
Test Server 2	Migrations.test.ts is deliberately fail-loud on any added migration.	Window extended to include [42, "AuthSessionClientConnection"] (2d94db2d).
Test Server 3	Real bug. Upstream split the server suite into a test_server matrix; the shards inherited the tests but not Marcode's ripgrep install step, so WorkspaceFileSystem.searchContent died with spawn rg ENOENT. The step is Marcode-only — upstream's Blacksmith images ship rg, GitHub-hosted runners do not.	Install step moved to follow the tests, and the guard widened from "ci.jobs.test installs ripgrep" to "every job with a Test step installs ripgrep" (2d94db2d) — the narrow guard is exactly why the split slipped through.

Why

Marcode is a maintained fork of T3 Code. This keeps it current with upstream correctness, security, protocol, dependency, and operational fixes while preserving Marcode's intentional product behavior (floating nav, unified workspace, floating editor, retired right-panel file surfaces, branding). Resolves the upstream-sync-blocked tracking issue for f035a0f4 (#50).

UI Changes

No Marcode-visible UI change is intended: web navigation, composer, terminal, and right-panel surfaces keep Marcode's existing appearance and placement. Upstream UI features adopted where they don't touch a Marcode divergence (tab mute, surface-dropdown shortcuts, confirm-before-close, app-access approvals). Live client verification is deferred to review, since this environment is headless.

Verification

CI is green on 2d94db2d: Check, Test, Mobile Native Static Analysis, Release Smoke (the four required checks), plus Test Server 1/2/3, Rust, Mobile Native Changes, and claude-review. Thread-transfer budget report passes every ceiling. Nothing on this head failed.

Locally, before pushing:

• Typecheck: @t3tools/contracts, @t3tools/client-runtime, @t3tools/web, t3 (server) — all clean (only pre-existing Effect lint suggestions remain).
• Focused tests across the resolved paths, plus vp fmt --check and vp lint on changed files.
• The spawn rg ENOENT fix was verified by reproducing the failure locally with rg removed from PATH (this container has rg installed, which is why the first local run passed while CI failed), then confirming both test-running jobs install it.
• ChatHeader.test.ts could not run here: @aliimam/icons@1.1.3 (a pre-existing Marcode dep) ships index.js/index.mjs but declares main: dist/index.cjs, so the resolver fails; this reproduces identically on main and is unrelated to the merge. It passes in CI.

Reviewer notes

Why this PR reads "unstable" / "some checks haven't completed". Native fingerprint diff (mobile-fingerprint-check.yml) runs on blacksmith-8vcpu-ubuntu-2404, a runner this fork cannot reach, so it queues indefinitely rather than failing. That is pre-existing on main — this merge does not touch that workflow — so it is deliberately not fixed here, and it does not block merge (it is not a required check). The one-line fix, if you want it as its own PR, is the same override applied to ci.yml: runs-on: ubuntu-24.04. The same applies to web-preview.yml, mobile-eas-*.yml, publish-aur.yml, and most of release.yml.

Required-checks gap. Upstream split server tests out of Test into Test Server 1/2/3 and added Rust. The manifest's requiredPullRequestChecks still lists only Check, Test, Mobile Native Static Analysis, Release Smoke — so branch protection would not have blocked on the two genuine failures above. Changing that list means updating the manifest and the workflow literals together (the parity test enforces it) and changes what gates merges, so it is deliberately not folded into this sync PR.

Transfer budget headroom. The report shows the thread snapshot wire at 6.9 KiB against a 7.3 KiB ceiling (~94%, up ~10% from main) — passing, but with less headroom than before this sync.

Checklist

• Conflicts resolved by hand, combining upstream and Marcode intent (no whole-file ours/theirs)
• Fork-boundary identity swept (T3CODE_HOME, t3code.service, WORKTREE_BRANCH_PREFIX, boot-service naming) and corrected for Marcode
• Compatibility identifiers kept upstream-shaped
• Focused typechecks, tests, format, and lint run for the affected scope
• Lockfile regenerated with pnpm, not hand-edited
• CI green on the head commit
• Live client (web/mobile) verification — deferred to review (headless environment)

🤖 Generated with Claude Code

https://claude.ai/code/session_01593jwWRpRNPgQqJAhV9n19

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	12.6 KiB	13.4 KiB	+858 B (+6.7%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.3 KiB	6.9 KiB	+627 B (+9.8%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+231 B (+3.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	51.8 KiB	55.0 KiB	+3.2 KiB (+6.1%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	12.6 KiB	13.4 KiB	+887 B (+6.9%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.3 KiB	6.9 KiB	+638 B (+9.9%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.3 KiB	6.5 KiB	+249 B (+3.9%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	52.7 KiB	55.8 KiB	+3.2 KiB (+6.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 5bcc188 · PR result: 2d94db2 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

Verification on PR head 2d94db2d:

• Web: ran the isolated PR worktree with the full dev stack, authenticated the controlled preview, confirmed the Marcode shell/project flow, opened the Files surface and unified workspace tree/editor, opened project actions, and saw no browser console errors.
• Responsive: checked 820x800 and 390x844 viewports.
• Mobile: live simulator verification is unavailable in this environment. XcodeBuildMCP reports 0 iOS simulators; Android tooling (adb/ANDROID_HOME) is not installed.
• CI: all four protected checks are green. The queued Native fingerprint diff remains the pre-existing, non-required Blacksmith check documented in this PR.

No source changes were made during verification.