chore(upstream): sync marcode through 061543e9

[maarco]

What Changed

Merges 110 upstream commits, pingdotgg/t3code@52b2bf77..061543e9, into main as one two-parent merge commit. 35 paths conflicted and were resolved by hand. One follow-up commit fixes a CI failure the merge caused (see Verification).

Upstream work in this delta: Effect rc.112 / Alchemy beta.76, TypeScript 7.0.2, cross-platform window capture (SnapShot), a rewritten multi-computer onboarding wizard, a real devcontainer, and a batch of knip export classifications.

Conflict decisions

Path	Decision
(tree-wide)	Effect rc.112 renamed Schema.TaggedErrorClass → Schema.TaggedError. Marcode-owned error classes follow the rename.
.devcontainer/devcontainer.json	Took upstream's real devcontainer (ubuntu-24.04, node/rust/gh features, cache volumes, on-create/update-content, forwarded ports). Applied Marcode identity: name, MARCODE_HOME → .marcode, watcher excludes. Kept the bun feature AGENTS.md relies on for bun:sqlite seeding.
package.json, scripts/package.json	Kept Marcode's wider build filter; took upstream's icons:export:android + its sharp dep. prepare follows upstream (it dropped its own clean-tsgo-backups.mjs).
contracts/settings.{ts,test.ts}, ChatView, MessagesTimeline.test, index.css, AgentSessionScanner.test	Both sides added at the same spot — kept both.
contracts/project.ts	Kept Marcode's ProjectSearchContentError; applied the TaggedError rename.
publicConfig.ts, codexLaunchArgs.ts, marcode-sqlite-state.ts	Kept Marcode's names (__MARCODE_BUILD_*__, MARCODE_CODEX_LAUNCH_ARGS, marcode-sqlite-state); took upstream's knip un-exporting.
Migrations.ts	Kept Marcode's deployedMigrationEntries split. No new upstream migration in this delta; ids stay unique and ordered.
Desktop identity	Upstream moved the Linux entry name behind resolveLinuxDesktopEntryName. Took the refactor, made it emit marcode(.dev).desktop: the filename lands in the user's applications dir, must not collide with a real T3 Code install, and DesktopSnapShot derives the Linux app id from it (has to match linuxWmClass). Also took upstream's unification of the URL-handler entry with the main entry. LAUNCHER_VERSION follows upstream (19).
electron-launcher.test.mjs	Upstream moved captured env out of the launcher script into the environment script; the MARCODE_* pin moved with it onto makeDevelopmentEnvironmentScript.
WelcomeWizard.tsx	Upstream rewrote onboarding (pingdotgg#10465, ~1200 lines). Took the rewrite, re-applied Marcode's diff on top: Marcode Connect naming, a text product mark instead of the T3Wordmark component Marcode deleted, and Marcode's TerminalViewport contract.
useTheme.ts	See "Needs a decision" below.
rightPanelStore.ts	Took upstream's PULL_REQUESTS_PANEL_REF; storage key/version/isPullRequestsPanelKey stay in marcodeRightPanelPolicy.ts. The retired file/attachment surface was not reintroduced.
SettingsSidebarNav.tsx	Took upstream's pingdotgg#10705 removal of useRouterState/resolvedPathname; kept Marcode's useCanGoBack.
apps/mobile/app.config.ts	Kept Marcode's black-on-white release mark; took upstream's release splash icon and explicit absent background image.
DMG backgrounds	Upstream refreshed its artwork with a different viewBox and gradient ids. These are Marcode-branded assets — kept whole so each file stays internally coherent.
apps/marketing/src/pages/95.astro	Deletion kept; pinned by retiredRoutes.test.ts.
docs/user/welcome-wizard.md	Took upstream's rewritten content, applied Marcode naming.
pnpm-lock.yaml	Regenerated with pnpm 11.10.0; pnpm install --frozen-lockfile verifies it.

Fork-boundary breaks that merged without a conflict

These are the dangerous ones — clean merges that would have shipped broken:

• GNOME capture extension refused every request. CLIENT_NAMES only allowed com.t3tools.T3Code(.Development).SnapShot, but LinuxSnapShot requests ${appId}.SnapShot where appId derives from linuxDesktopEntryName — marcode here.
• Extension uuid and KDE capture .desktop file renamed so a Marcode install cannot overwrite or collide with a T3 Code install.
• macOS Info.plist usage descriptions said "T3 Code" in system permission prompts shown next to CFBundleDisplayName "Marcode".
• CaptureShortcutConfig.test.ts carried an oxlint-disable-next-line t3code/… directive; Marcode's plugin is marcode, so the rule was never suppressed and lint failed on the dead directive.
• Sidebar.tsx still read projectCwdByKey inside the unified-workspace seam after upstream's refactor(web): pass the project record to ProjectFavicon so icons cannot drift pingdotgg/t3code#10714 replaced it with projectByKey.
• CommandPalette.logic.test.ts fixture predated Marcode's required workspaceLayoutVersion/workspaceLayout.
• docs/internals/devcontainer.md and .devcontainer/on-create.sh arrived documenting T3CODE_HOME and .t3.

Upstream-shaped identifiers deliberately left alone: @t3tools/*, the t3 CLI, T3_BOOT_SERVICE_UNIT, T3_SERVICE_LAUNCHER_CONTEXT, the com.t3tools.SnapShot D-Bus interface, t3code: client storage keys, and "T3 Code" strings inside upstream-owned desktop runtime messages (which Marcode already tolerates elsewhere).

Coupled subtrees: pnpm-workspace.yaml and infra/relay/package.json both moved, and upstream's own pingdotgg#10653/pingdotgg#10654 brought .repos/effect-smol (4.0.0-rc.112) and .repos/alchemy-effect (2.0.0-beta.76) with them. Verified matching; no separate sync:repos needed.

Why

Scheduled fork sync. Upstream ships correctness, security, protocol and dependency fixes that Marcode should carry; the fork's job at merge time is to take those while preserving Marcode's intentional product behavior at every seam.

⚠️ Needs a decision: the dark onboarding wizard

.github/upstream-sync.yml records the invariant "Marcode intentionally keeps the onboarding wizard dark while retaining upstream theme plumbing." This merge retires it, and that should be a deliberate call rather than a silent one.

Upstream's pingdotgg#10465 turned onboarding into a Dialog overlay drawn over the workspace and deleted the document-wide onboarding theme (mountOnboardingTheme, data-onboarding-surface, isOnboardingThemeActive). Marcode's override cannot survive that shape — a document-wide dark palette would now darken the workspace behind the overlay, not just the wizard. It is removed rather than reworked, and the reasoning is documented at the seam in apps/web/src/hooks/useTheme.ts.

The wizard now follows the app theme. Reinstating a dark wizard means scoping it to the dialog and its portals. That is a design change, and it wants visual verification this environment cannot do — so it was left out rather than guessed at.

UI Changes

No before/after images: this environment has no browser or simulator. The user-visible surfaces this merge touches and that still want live verification are the rewritten onboarding wizard (including the theme question above), the sidebar after upstream's ProjectFavicon refactor, and the right panel.

Checklist

• This PR is small and focused — no: it is a 110-commit upstream sync, one merge commit plus one CI fix
• I explained what changed and why
• I included before/after screenshots for any UI changes — not possible in this environment; see above
• I included a video for animation/interaction changes — same

Verification

CI is green on da895a05 — all four required checks plus the rest of the run: Check, Test, Test Server 1/2/3, Rust, Release Smoke, Mobile Native Static Analysis, Mobile Native Changes.

The only red check is claude-review, which has failed on every run of that workflow since pingdotgg#83 — ten of them before this branch existed, across three unrelated branches. The review agent never starts (zero turns, zero cost, empty modelUsage), so it is not a finding about this diff; it needs secrets.CLAUDE_CODE_OAUTH_TOKEN rotated. Re-run once on 6659f3ba to confirm; details in this comment. claude-review is not among requiredPullRequestChecks.

One follow-up commit was needed

6659f3ba (the merge) failed Check on knip:check with seven unused exports — genuinely this PR's. Upstream's pingdotgg#10282 added apps/server and apps/desktop to knip's --exports scope, and this merge took that widened scope, so exports nothing had ever imported became visible for the first time. Fixed in da895a05: six were dead and are now module-private (three of them matching how upstream already declares them, including the two electron-launcher.mjs constants this PR had initially kept exported on mistaken reasoning). defineMarcodeMigration keeps its export and gains a test exercising its >= 9000 guard, since it holds the reserved migration namespace open and has no caller by design.

My first round of local verification missed this: dependencies were installed with --ignore-scripts, so prepare never ran effect-tsgo patch and the Effect language-service diagnostics were inactive, and knip:check was not in the focused scope. Re-verified afterwards the way CI runs it, with the patch applied: vp run knip:check clean, vp check 0 errors, vpr typecheck clean across all 15 packages.

Focused tests pass across contracts, shared, server persistence/provider/project/http, desktop app + snapShot + gnome-extension, web store/theme/timeline/palette/sidebar/unified-workspace, marketing retired routes, and scripts. pnpm install --frozen-lockfile succeeds against the regenerated lockfile.

The one local failure reported in the first draft of this description — scripts/dev-runner.test.ts "accepts a dry run without the optional browser flag" — was this container lacking IPv6 (::1 binds return EAFNOSUPPORT), not the diff. Test passing in CI confirms it.

Still unverified

Live web and mobile verification — this environment has no browser or simulator. The surfaces that want it are the rewritten onboarding wizard (including the theme question above), the sidebar after upstream's ProjectFavicon refactor, and the right panel.

🤖 Generated with Claude Code

https://claude.ai/code/session_01U3kz6cvULzXAHG2jfiVRWf

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	13.4 KiB	—	15.1 KiB	✅
Codex	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Codex	Live turn WebSocket wire	—	6.4 KiB	—	7.8 KiB	✅
Codex	Live turn WebSocket decoded	—	56.2 KiB	—	66.4 KiB	✅
Codex	Live turn messages	—	8	—	21	✅
Claude	Total thread wire	—	13.5 KiB	—	15.1 KiB	✅
Claude	Thread snapshot wire	—	7.0 KiB	—	7.3 KiB	✅
Claude	Live turn WebSocket wire	—	6.4 KiB	—	7.8 KiB	✅
Claude	Live turn WebSocket decoded	—	57.0 KiB	—	66.4 KiB	✅
Claude	Live turn messages	—	8	—	21	✅

Baseline: unavailable · PR result: da895a0 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

claude-review is failing repo-wide, not on this PR

Standing down on this one check, with evidence.

Claude Code Review has failed on every run since pingdotgg#83 — runs 84 through 93, ten consecutive failures spanning 2026-09-07T02:30 to now, across three unrelated branches (chore/upstream-52b2bf77a941, claude/gracious-bohr-c3jslq, and this one) and eight different commits, two of which were already re-run attempts. Runs 64–83 all succeeded. The breakage starts between 2026-09-06T22:42 and 2026-09-07T02:30, well before this branch existed.

The job log shows the SDK erroring before any model call:

{"type":"result","subtype":"success","is_error":true,"duration_ms":1907,
 "num_turns":1,"total_cost_usd":0,"modelUsage":{}}
##[error]Claude execution failed: result is_error:true

Zero turns, zero cost, empty modelUsage after 1.9s — the review agent never ran, so this is not a finding about the diff. The shape and the timing point at secrets.CLAUDE_CODE_OAUTH_TOKEN in .github/workflows/claude-code-review.yml having expired or been revoked around 2026-09-07.

No fix to port — the remedy is rotating a repository secret, which needs @maarco. I re-ran the failed job once on this exact commit (6659f3ba) to confirm; it failed identically, which is the one re-run spent. claude-review is also not among requiredPullRequestChecks in .github/upstream-sync.yml (Check, Test, Mobile Native Static Analysis, Release Smoke).

The failure that was this PR's is fixed

Check failed on knip:check with seven unused exports — genuinely mine. Upstream's pingdotgg#10282 added apps/server and apps/desktop to knip's --exports scope, and this merge took that widened scope, so exports that were never imported became visible for the first time. Fixed in da895a05: six were dead and are now module-private (three of them matching how upstream already declares them), and defineMarcodeMigration keeps its export and gains a test that exercises its >= 9000 guard — it holds the reserved migration namespace open and has no caller by design, which is exactly why it needed pinning rather than deleting.

Re-verified the way CI runs it, after reinstalling without --ignore-scripts so effect-tsgo patch was applied and the Effect language-service diagnostics were active — that gap is why local verification missed this the first time:

• vp run knip:check — clean
• vp check — 0 errors
• vpr typecheck — clean across all 15 packages
• Migrations, commandInvariants, http, httpResponseErrorGuard, electron-launcher, projectWorkspace tests pass

Everything else on 6659f3ba was already green: Test, Test Server 1/2/3, Rust, Release Smoke, Mobile Native Static Analysis. Test passing in CI also confirms the one local failure I reported in the PR description (dev-runner dry run) was this container lacking IPv6, not the diff.

---

Generated by Claude Code