Sync upstream main into personal

[jln13x]

Upstream: bcb855a (updated 2026-08-29)

Changelog

New things to try

• Web and desktop can attach PDFs, ZIP archives, text files, and other files to a turn, up to the server-advertised limit; mobile remains image-only.
• The sidebar project filter is now searchable, threads can be pinned from the keyboard, and unpinning can require confirmation.
• Provider settings use a two-pane list and editor with separate Models and Configuration tabs, compact device selection, and Advanced controls.
• Grok discovers skills, supports reasoning controls and proposed plans, reports usage, and recovers more reliably from stalled turns and approval edge cases.
• Eligible macOS preview DMGs can be downloaded without a GitHub sign-in while the preview remains active.

Improvements

• Mobile moves to Expo SDK 57 with compiled semantic themes, steadier native headers and composer menus, and restored glass styling.
• New threads honor project default models, while OpenCode handles child approvals, stops, and model catalogs more consistently.
• Windows desktop can cache its WSL runtime on the Linux filesystem for faster launches; browser previews support OAuth popups and avoid hidden rendering work.
• Codex shows child-agent models and buffers large app-server input streams without quadratic growth.
• Codex 0.150 account plans and multi-agent events are recognized, so authenticated providers and collaboration history continue to load normally.
• Ordinary command failures stay visually muted while genuine runtime and orchestration failures remain prominent.

Bug fixes

• Failed draft bootstraps can retry their first send, stale approval cards clear through shared recovery, and un-settled conversations return to active ordering.
• Server startup replays the complete un-applied event backlog instead of stopping after the first 1,000 events.
• Pull requests fall back to the browser when embedded loading fails, preview automation works in agent-created threads, and DPoP connection failures are explained.
• Ignored-only staged changes no longer fail the formatter hook.

Fork compatibility

• Desktop fork identity, separate storage, orange packaged icon, all three signing modes, and local signed-install tooling are preserved. Upstream versioning, preload verification, preview updates, WSL runtime caching, and packaging changes were retained. One manual test resolution adapted the new WSL packaging argument to the fork's signing-mode API. Live macOS build, signing, install, and permission-continuity checks were unavailable on this Linux host.
• Completion and attention sounds remain always on with silent startup baselines and the 1.1 success-volume override. Automated sound tests passed; a live UI completion transition was not exercised.
• Native macOS completion notifications and the per-environment delivery ledger are preserved. Upstream client-platform metadata was retained alongside the fork bridge. Automated bridge and ledger tests passed; live delivery, presentation, and click-through were unavailable on this Linux host.
• Worktree-grouped threads and checkout-scoped resources are preserved. Upstream searchable project filtering, keyboard pinning, unpin confirmation, drafts, lifecycle actions, provider badges, shelves, and pull-request snapshots remain intact. Manual resolutions combined the fork's branch-transfer and cleanup paths with upstream confirmation behavior.
• Codex project-scoped skills, structured explicit invocation, visible unknown-skill failures, and active-turn steering are preserved. The Codex conflict retained the shared turn/steer decoder and start-response handoff while adding upstream child-model metadata; large-stream buffering was also retained.
• Cross-environment chat transfer remains client-only with its history capsule, context overlay, integrity checks, Git transport, and source recovery intact. Upstream generic file attachments remain fully available in ordinary threads; imported history preserves their visible metadata as non-downloadable, while the documented portable capsule continues to embed image bytes. The inventory was updated to record this boundary.
• No retired customization or fork flag was restored, and no maintained difference was silently dropped.

Validation

• PASS: vp install --frozen-lockfile completed from the frozen lockfile, changed the installed set by +160/-164 packages, and passed supply-chain policy checks for 2,014 entries.
• PASS: vp check completed with all 2,838 files formatted, 0 errors, and 11 warnings.
• PASS: vp run typecheck completed with 0 errors and suggestions only.
• PASS: vp run lint:mobile found 8 Swift and 11 Kotlin source files and passed the repository static wrapper. SwiftLint, ktlint, and detekt are unavailable on this Linux host and were skipped.
• PASS: the focused fork suite passed with the repository-pinned runner: 23 files, 416 tests. A file-parallel run exposed one timing-sensitive ProviderRegistry reprobe failure (415 passed/1 failed); that test passed alone (44/44) and the complete suite passed serially.
• NOT RUN (Linux host): live macOS sounds, notifications, signing/install continuity, and live iOS behavior.