feat(web): open unlinked GitHub PRs in the Pull Request panel

[shivamhwp]

GitHub PR links from repositories that haven't been added as projects currently open outside T3. That interrupts reviewing someone else's work from a conversation. For example, reviewing #9850 from an unrelated project opens GitHub.

Open those links in the Pull Request panel using the connected server's GitHub credentials. Cmd/Ctrl-click still opens externally, and the right-click menu offers the panel, system browser, and copy. Reading the PR and its diff no longer needs a checkout; checkout actions still require a linked project. Older servers retain the external fallback. Other Git hosts keep their existing linked-project requirement.

Rebased onto 0c200c5f, head cfd543a5. Validation across the rebase and review fixes:

• 309 focused tests passed after the rebase. The final rebase preserved all five patches and only added two desktop commits from main.
• After the review fixes, all 107 service tests and all 94 PR detail logic tests passed. Web and server typechecks, targeted lint, and formatting passed; lint reports existing warnings.
• Contracts, client-runtime, and mobile typechecks passed on the earlier rebased head. The web unused-export check also passed.
• CI and Macroscope correctness, UI consistency, and Effect conventions checks passed on cfd543a5. No unresolved review threads remain. Macroscope requires human review for the new workflow and its access behavior.

The review fixes reuse the repository-name validator, hide checkout-dependent finding controls for unlinked PRs, and require a project before identifying a PR as the thread's own.

Per-finding Fix controls are hidden without a linked project because an agent handoff needs a checkout. Remote review actions intentionally use the connected GitHub account's permissions without requiring a local project. The read-only restriction suggested in the automated review would remove that behavior. A regression test verifies both allowed actions and comments, then revokes access and verifies both are rejected before writing. Existing host authorization still governs description and comment edits.

Previous verification before this rebase: 403 focused tests passed; web, server, contracts, client-runtime, and mobile typechecks passed. Tested in Chromium against the real local server and GitHub: normal click, Cmd/Ctrl-click, context menu, clipboard, diff loading, and multiple unlinked PR tabs. No browser runtime errors.

Before	After

Context menu · Diff view

Test report

Model: GPT-6. Harness: Codex.

Note

Add support for opening unlinked GitHub PRs in the Pull Request panel

• Makes projectId and workspaceRoot nullable across PullRequestRef, PullRequestSummary, and PullRequestDetail contracts; a null project ID represents a GitHub.com PR without a linked local project
• Server resolves unlinked GitHub references by validating the owner/repo selector, building a synthetic project context with github.com as host and the user's home directory as workspace, and returning a detail with null workspaceRoot
• Web intercepts supported GitHub.com PR links from chat markdown and the external-link context menu, selects a capable environment via the new unlinkedGitHubPullRequests capability flag, and opens them in the thread right-panel or the global pull-requests page
• Review draft state (pullRequestReviewKey) is now keyed by environment identifier in addition to PR reference, isolating pending comments across environments for the same unlinked PR
• Behavioral Change: projectId is now nullable on PullRequestRef/PullRequestSummary/PullRequestDetail schemas and in rightPanelStore surface IDs; any out-of-tree consumer expecting a non-null projectId must handle the null case. Project-dependent features (checkout, agent fixes, environment selection) are disabled for projectless PRs in PullRequestDetailPanel

^{Macroscope summarized cfd543a.}

---

Note

Medium Risk
Nullable projectId/workspaceRoot is a contract change for any consumer that assumed a workspace checkout, and the server now fetches arbitrary validated GitHub repos using connected credentials.

Overview
Enables reading public github.com pull requests in-app when the repo is not a linked project, gated by a new unlinkedGitHubPullRequests server capability. Contracts and APIs now allow projectId: null and workspaceRoot: null on pull request refs, summaries, and detail.

On the server, PullRequestService resolves null-project refs only for GitHub: it validates owner/repo shape, uses the GitHub provider with homedir as cwd and an explicit github.com host, and skips list-stats recording for those refs. getViewerLogin accepts an optional hostname so viewer identity works outside a checkout.

On the client, GitHub PR links in chat and the link context menu can open the right-panel detail (including when no local project matches), routing to a capable environment if the primary server is older. Checkout, branch refs, and thread handoffs stay disabled without a project; review drafts are keyed by environmentId so the same PR on different servers does not share pending comments.

User docs note the behavior and that other hosts still need a linked project.

^{Reviewed by Cursor Bugbot for commit 0c87f64. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b04133c. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR adds a broad new workflow for reading and acting on unlinked GitHub pull requests, spanning authenticated server operations, shared contracts, navigation, and panel state. The capability is advertised enabled by default, so the resulting access and product-behavior change warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.5 KiB	−59 B (−0.4%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.5 KiB	−63 B (−0.9%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.1 KiB	57.0 KiB	−88 B (−0.2%)	66.4 KiB	✅
Codex	Live turn messages	10	8	−2 (−20.0%)	21	✅
Claude	Total thread wire	13.6 KiB	13.6 KiB	+40 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	+3 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.6 KiB	+37 B (+0.6%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.8 KiB	57.9 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	9	10	+1 (+11.1%)	21	✅

Baseline: 0c200c5 · PR result: cfd543a · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.