[juliusmarminge]

Private GitHub uploads in a PR need the PR's repository context to obtain a signed media URL. The checkout can be a personal fork or an unrelated repository, which fails for Enterprise Managed Users.

Carry optional repository through the asset RPC contract and signed capability, and populate it from the actual PR in web/desktop and mobile. Image/video previews, galleries, refreshes, and media identities retain that context. Older clients and capabilities without the field remain compatible. The next stack layer consumes it for SSO media fetching; this layer changes no media fetch workflow or layout.

Rebuilt from @cbangera2's useful signed-upload work in #19191, incorporating the human EMU context finding.

Bottom layer; followed by #21632.

Independent Opus and Sol reviews completed two full-stack rounds; the final round found no code defects.

Verification: the capability round-trip and existing mobile preview cases went from 44 passing / 3 expected failures to 47 passing; 152 related tests passed. Scoped server/web/mobile/contracts types and targeted lint/format passed, with one existing test warning. No markup or callback-wiring tests were added.

Before/after protocol and runtime proof. The upper layer's full production dev server and actual route composition were exercised over loopback HTTP with mocked GitHub responses; this is not live SAML/EMU or full client UI proof. macOS, Windows, Electron desktop, iOS, Android, native playback, and remote/relay/tunnel execution remain unverified. There is no layout change to capture. Human approval of the authentication-sensitive behavior remains required before merging.

CI/review status: all executed current-head CI jobs passed, including Web, lint, build/types, package tests, all eight server shards, release smoke and the latest fingerprint job. The first Web attempt failed in unchanged AttachmentFilePreview.browser.test.tsx; one failed-job retry passed. An earlier redundant fingerprint run was cancelled and superseded by success. CI run. No unresolved review threads. Macroscope still requires human approval of the private-media context change; this is not a merge-ready claim.

Implemented with GPT-6 Astra and GPT-6.1 Sol on Codex through T3 Code; independently reviewed by Claude Opus 5.5 and GPT-6 Sol.

Takeover

Taken over from @juliusmarminge's original commit d104aff; that commit is kept and the takeover commits sit on top.

• The server now signs every decoded field of the resource into the capability instead of copying fields one by one. ResolvedAsset.repository is unchanged for https://git.cafe/pingdotgg/t3code/pulls/21632.
• Web reads the repository from PullRequestDetail.repository (the repository the server fetched the PR from) instead of re-parsing the PR URL. Mobile reads it from the route's PR ref.
• Dropped: the JSON.stringify(source) mobile image/video identity keys (back to the URL, since the bytes at a URL are the same in any repository context), and repository in the web video key and in ChatMarkdown's media scope key.
• Tests: one server round-trip (RPC decode → signed capability → resolve), the mobile gallery test, and one new web test that checks both PR-body image and video asset requests carry the PR's repository. Each fails with the fix reverted.

Evidence

Head 597f1ae (after) vs merge-base 15707a8 (before). Environment: VM fs-11, Linux x86_64, Chromium 156, no device emulation, DPR 2, font scaling 100%, CSS viewports 1440×1000 / 900×1000 / 390×1000, UI clock fixed at 2026-11-03T12:00Z. Each still matched a second capture taken 500 ms later. Data is synthetic: fresh T3CODE_DEV_SEED=0 servers, a synthetic PR-detail and media-byte proxy, and the live assets.createUrl RPC. Mobile ran in a labelled React-DOM harness with native views stubbed.

Row	What	Before → After	Diff0 / DiffT (>8/255)
Wide 1440 dark	PR body: GitHub images and video	sheet	0 px / 0 px
Wide 1440 light	same	sheet	0 px / 0 px
Narrow 900 light	same	sheet	0 px / 0 px
Narrow 390 light / dark	same	light · dark	0 px / 0 px
W2 fullscreen video	the player at full screen	W2	0 px / 0 px
W1/W2/W8 wire	assets.createUrl payloads	before no repository → after with the PR's repository	—
W9 control branches	relative, workspace and host-file media, audio, file/context chips	W9: unchanged, no repository	0 px / 0 px
W10 environment switch	E1→E2→E1 across two real paired dev servers, real asset hooks and RPC	W10: each assets.createUrl goes to the selected environment; head carries the PR's repository and caches per environment and repository	diagnostic text only
M1–M6 mobile	wrappers, gallery and paging, video, thumbnail keys, legacy	M2, others in the full evidence	harness diagnostic text only
S1–S4 server	signed round-trip, base-minted capabilities on head, tamper rejection, unchanged fetch	head runtime · legacy upgrade	—

What else changed:

• In settled stills: nothing at zero threshold.
• Rows W10 and M2: only the on-page repository diagnostic text the capture adds, (absent) → the PR's repository.
• Recordings: short media-loading intervals, video clock frames, cursor and tooltips, and capture-start offsets differ between runs.

Full evidence with every row, recordings and narrated steps: PR-Evidence-round3.md · fixture matrix: matrix.md · seed and driver scripts: REBUILD.md, Scripts-round2.md, artifact manifest.

Verification log

• Tests: AssetAccess.test.ts 37/37, pullRequestMediaSource.test.ts 1/1, PullRequestMarkdown.browser.test.tsx 9/9. All three new or rewritten tests fail with the fix reverted. vp run check:changed passed every step (format, lint, knip, typecheck of 36 packages, tests next to the changes, React compiler).
• Review round 1: Sol (Codex) MERGE and Opus (Claude) MERGE, no findings. A runtime check confirmed that a capability whose repository was altered without re-signing is rejected. A new client against an older server still works because the unknown key is dropped.
• Proof audit: pass 1 derived the 25-row matrix. Pass 2 found W2, W9, W10 and M2 missing; they were recaptured. W10 was first captured with stubbed asset hooks, which the auditor rejected, and was then recaptured against two real environments. Four stale W9 stills are excluded; W9 stands on its raw transcript. Final verdict: SUFFICIENT. An independent rebuild of the wide-dark capture at the head differed by 0 of 1,137,920 pixels.
• CI on 597f1ae: green (Build and Typecheck, Check +14, Native fingerprint diff, Agent context budget).
• Unverified: live GitHub EMU/SAML fetch (this layer doesn't fetch; https://git.cafe/pingdotgg/t3code/pulls/21632 does), native iOS and Android rendering and playback, Electron (optional row W11).
• Takeover by Claude Opus 5.5 (lead, tests, implementation, review B) and GPT-6.1 Sol (review A, proof audit, captures) on T3 Code.

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Approved at 597f1ae

Macroscope's review found this PR approvable — Preserves PR repository context through web and mobile media resources and signed asset tokens, including thumbnail cache identity. Existing media validation and access safeguards remain unchanged, with no material change to permissions or product defaults.

No code changes detected at 7c251d7. Prior analysis still applies.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	21.5 KiB	21.5 KiB	0 B (0.0%)	24.4 KiB	✅
Codex	Live turn messages	1	1	0 (0.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.9 KiB	21.9 KiB	0 B (0.0%)	24.4 KiB	✅
Claude	Live turn messages	1	1	0 (0.0%)	8	✅

Baseline: 37481f0 · PR result: 7c251d7 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Pull request media resources now accept optional repository context. Web and mobile pull request rendering pass that context into media resources. The server preserves it in signed asset claims and resolved assets. Mobile image and video identities use the serialized media source.

Changes: Pull request media context

Layer / File(s)	Summary
Repository-aware asset capabilities packages/contracts/src/assets.ts, apps/server/src/assets/AssetAccess.ts, apps/server/src/assets/AssetAccess.test.ts	The GitHub media resource accepts an optional repository value. Asset capability issuance and resolution preserve it when present. A test checks that it survives decoding, issuance, and resolution.
Web pull request media context apps/web/src/components/pullRequest/*, apps/web/src/components/ChatMarkdown.tsx	Pull request detail supplies a repository name to Markdown context. Markdown image and video rendering pass it into media resources. A browser test checks the repository on image and video resource requests.
Mobile media context and source identity apps/mobile/src/features/pull-requests/*, apps/mobile/src/lib/videoPreviewSource.ts	Mobile pull request media passes repository context to the shared source builder. Tests check repository values in generated resources. Image and video identities use the serialized media source, and the thumbnail key includes the repository.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Possibly related issues

• pingdotgg/t3code issue 26663: This issue concerns mobile pull-request description images that bypass authenticated media loading when inline. This change passes the pull request repository into mobile media resources used by that loading path.
• pingdotgg/t3code issue 26662: This change preserves the pull request repository in mobile gallery asset resources. The reported gallery-wide preparation delay is not addressed here.

Suggested reviewers: shivamhwp, t3dotgg

Merge Risk: Minimal · up to 7c251

No merge-blocking issue was identified. Native rendering and remote connection modes remain unverified.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely identifies the main change: preserving the pull request repository for GitHub media.
Description check		The description is detailed and covers the problem, implementation, scope, approval requirement, verification results, evidence, and known limitations. It is more complete than the required template, …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description is detailed and covers the problem, implementation, scope, approval requirement, verification results, evidence, and known limitations. It is more complete than the required template, despite not using every template heading explicitly.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: batch-07-pr-media/context
• File: .coderabbit.config.ts
• Commit: 7c251d7
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Team
• Run ID: 54e065e1-c3d7-44a0-9a15-6e25858db742

Commits

Reviewing files that changed from the base of the PR and between 597f1ae and 7c251d7.

Files selected for processing: 5

• apps/mobile/src/features/pull-requests/PullRequestMarkdown.tsx
• apps/server/src/assets/AssetAccess.test.ts
• apps/server/src/assets/AssetAccess.ts
• apps/web/src/components/ChatMarkdown.tsx
• apps/web/src/components/pullRequest/PullRequestMarkdown.tsx

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.

[juliusmarminge]

Taking over this one

Dismissing prior approval to re-evaluate 597f1ae