chore: merge upstream pingdotgg/t3code

[andrewcai8]

Brings the fork up to date with 42 upstream commits through 88744f3. This is a true merge commit, like the previous syncs.

What came in

• Chat UI. Mermaid code blocks render as diagrams (feat(web): render mermaid code blocks as diagrams pingdotgg/t3code#15067). Composer and panel action icons morph (feat(web): morph composer and panel action icons pingdotgg/t3code#14924). Command palette results are virtualized (perf(web): virtualize command palette results pingdotgg/t3code#15266). DOM changes no longer restyle the whole page (perf(web): DOM changes no longer restyle the whole page pingdotgg/t3code#15265). Tool inputs are highlighted (fix(web): highlight tool inputs and remove nested work log indentation pingdotgg/t3code#15384). No-project drafts can switch machines (fix(web): no-project drafts can switch machines pingdotgg/t3code#15356). Sending past the resume banner compacts first (fix(web): sending past the resume banner compacts first pingdotgg/t3code#15290).
• Server. RPC scopes are checked in group middleware (refactor(server): check RPC scopes in group middleware pingdotgg/t3code#15324). Agents can watch a PR and get woken (feat(server): agents can watch a PR and get woken when checks, reviews, or conflicts need them pingdotgg/t3code#15057). Restarts keep delegated tasks, queued threads, and stops (fix(server): restarts keep delegated tasks, queued threads, and stops intact pingdotgg/t3code#15323). Runs no longer get stuck (fix(server): runs no longer get stuck pingdotgg/t3code#15048). Several Claude, Codex, and dev-server status fixes.
• Usage. Cost by token type, speed, and model detail (feat(usage): show cost by token type, speed, and model detail pingdotgg/t3code#15108). Codex Fast and Ultrafast pricing (fix(usage): Codex Fast and Ultrafast now cost what they bill pingdotgg/t3code#15101). Preview model IDs fold into their model (feat(usage): fold preview model IDs into the model they belong to pingdotgg/t3code#15333). Warm usage scans drop from seconds to milliseconds (perf(usage): cut warm usage scans from seconds to milliseconds on large histories pingdotgg/t3code#15149).
• Mobile. Beta Working section (feat(mobile): beta Working section hides busy threads until they need you pingdotgg/t3code#15346). Subagent details, iOS scroll jump, and Live Activity fixes.

Fork code deleted as superseded

• The fork's Mermaid renderer (MarkdownMermaidBlock.tsx, lib/mermaidRendering.ts, their tests) and the mermaid@12 dependency. Upstream's chat/MermaidDiagram.tsx with mermaid@11 replaces it. Cloud chats render through the same ChatMarkdown path, so they get upstream's diagrams.
• The fork's "Mermaid diagrams" section in docs/user/composer.md, which described the deleted renderer.

Conflicts resolved

• packages/contracts/src/rpc.ts. ...EnvironmentControlRpcs stays in WsRpcGroup, now under upstream's .middleware(RpcScopeAuthorization). Their scopes still come from ENVIRONMENT_CONTROL_REQUIRED_SCOPES.
• apps/server/src/ws.ts. Upstream's resolveEditorConfig, keeping the fork's rule that a cloud-only host has no Scratch root.
• apps/server/src/usage/UsageService.ts. Upstream's scanKey(input, settings) keyed by the fork's hourly window cap. Upstream's model aliases plus the fork's Cursor history and box usage imports.
• apps/web/src/components/ChatView.tsx. Upstream's No-project machine switching and compact-before-send. The fork's Run-on targets, cloud.onEnvironmentPicked, held cloud sends, and reconnect-on-send are layered on top.
• apps/web/src/components/ChatMarkdown.tsx, apps/web/package.json. Upstream wins (Mermaid).
• apps/mobile/.../ThreadArrangementSheet.tsx. Import union.
• third-party-licenses.config.json, pnpm-lock.yaml. Upstream's file plus the fork's Namespace and Connect entries. The lockfile was regenerated from upstream's.

Follow-up fixes from the merge

• Upstream removed addTotals and added optional per-bucket cost fields. boxUsage.ts now carries categoryCostUsd, fastCostUsd, ultrafastCostUsd, and speedPremiumUsd through the box fold, with a test.
• Upstream made EnvironmentOption.projectId nullable. A cloud chat redirect and the next-draft target skip a machine whose No-project folder does not exist yet.

Verification

• Typecheck passes for t3, @t3tools/web, @t3tools/mobile, @t3tools/desktop, @t3tools/client-runtime, @t3tools/contracts, and @t3tools/shared.
• Server: src/usage, src/environmentControl, RpcAuthorization tests, and ws.test.ts pass (59 files, 859 tests).
• Web: src/cloud, ChatMarkdown, and ChatView.logic tests pass (18 files, 243 tests).
• client-runtime: registry.cloud.test.ts and src/cloud pass (6 files, 120 tests). Mobile thread list tests pass.
• No live E2B or Namespace smoke in this PR.

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	4.9 KiB	4.9 KiB	0 B (0.0%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.7 KiB	3.7 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.4 KiB	20.4 KiB	0 B (0.0%)	29.3 KiB	✅
Codex	Live turn messages	2	2	0 (0.0%)	8	✅
Claude	Total thread wire	4.9 KiB	4.9 KiB	0 B (0.0%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.7 KiB	3.7 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	0 B (0.0%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	20.8 KiB	20.8 KiB	0 B (0.0%)	29.3 KiB	✅
Claude	Live turn messages	2	2	0 (0.0%)	8	✅

Baseline: 6fcfe4b · PR result: df43386 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 106.1 KiB
• Claude decoded thread snapshot: 106.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[andrewcai8]

Independent verification: PASS+NOTES

Verified head df4338646bb8e071d4398b10e83cc1747eca3aeb against base 6fcfe4be8e. The verifier did not write this code. Nothing was merged or deployed. The only contact with the live host was a read-only VACUUM INTO snapshot, and its temp files were deleted afterwards.

1. Protocol. ORCHESTRATION_PROTOCOL_VERSION is 2 on both base and head (packages/contracts/src/environment.ts:13). Running boxes are not stranded. The contract changes are additive optional fields only (usageModelAliases, threadPullRequestWatch, PR watch). The stored chat-card thread shell schema is unchanged.

2. Host DB. I took a live statev2.sqlite snapshot (sha256 2a073ae3…, matches the container) and started the PR server on it in a fresh temp home with no cloud credentials. The PR adds no migrations. Results:

• Server healthy, still alive after 8s, descriptor protocol 2.
• Upstream ledger 1-56 and fork ledger 1-5, unchanged.
• Leases 195/195, chat cards 22/22 (all 22 carry a V2 thread title), provision operations 238, projects 3, auth sessions 8, box_usage 119 and 3308 hours.
• Lease and card content digests identical before and after.
• settings.json byte-identical, with 29 provider instances.
• The main build on the same copy gives the identical result. Each build logs the same 3 error lines, caused by provisioning/*.json files I deliberately did not copy.

3. Live smokes. These ran on a local manager built from the head as a cloud-only host (T3CODE_LOCAL_AGENT_RUNS=false, no CLAUDE* env).

• E2B, claudeAgent,codex, provision/turns/resume/delete: 45/46 pass. 0 checks differ from the last V2 baseline (v2head-smoke-e2b). The only failure is host.skills.codex, which also fails on main (config).
• Namespace, run with the smoke's default agents: 46/49 pass. On the claudeAgent and codex checks, 0 differ from v2head-smoke-ns-2. Pause, resume, reconnect and the post-resume turn all pass, as do all 4 delete checks.

4. RPC scope middleware on fork RPCs, live.

• Read-only bearer (orchestration:read): environmentControl.list and listProvisioned succeed. stop and dispose are rejected with EnvironmentAuthorizationError (requiredScope: orchestration:operate).
• Full bearer: stop reaches the handler and returns refused/unknown. The smokes ran provision, claim, pause, resume and dispose through the middleware.
• RpcAuthorization and boxUsage server tests pass, 3 files and 22 tests.

Mermaid. In the built web bundle, the ChatMarkdown chunk lazy-imports mermaid@11.17.2 core. I rendered that exact chunk in headless Chromium with MermaidDiagram's initialize options. It produced an <svg> with 3 nodes and all 4 labels, and a syntax error was rejected. ChatMarkdown.test.tsx passes 51/51.

Notes (not blockers)

• The Namespace run included cursor because I used the default agents. turn.cursor.provider and account.cursor failed because the manager logged Provisioning without cursor: no account is usable. That is the known V2 Cursor sign-in step and the same on main. It is not from this PR.
• scripts/cloud/local-manager.sh start does not set T3CODE_LOCAL_AGENT_RUNS=false. With local agent runs on, the host hides provisionedSkills, so host.skills.* fail as a harness artifact (smoke-e2b-localagents.json). That earlier run's provision, turns, resume and delete checks all passed.

Cleanup

I created 3 boxes (E2B ircrv2jbt5kaqm8g3i31y and if97d26tfx26zsvnzhq98, Namespace t9mhui6q82uje), and all 3 were disposed through the manager. Managers were stopped by spawned PID (60844, 72132). Afterwards nsc list shows only the user's pre-existing qdt1o044i1beo, and none of my E2B sandboxes remain.

Evidence: /Users/andrew/.t3/worktrees/verify-159/.t3/verify/runs/ (hostdb-pr.json, hostdb-main.json, smoke-e2b.json, smoke-ns.json, scope-probe.json, mermaid-render.json, test logs). Tools: .t3/verify/tools/ (check-host-db.sh, fetch-host-file.sh, verify159-probe-scopes.tmp.ts, mermaid-render.mjs, e2b-list.mjs).