merge: upstream through 6f34ad3e8 (2026-07-21) — pre-Sidebar-v2 cut

[DanielGGordon]

Summary

True merge of ~130 upstream commits (last sync base dad0889, 2026-07-07 → upstream 6f34ad3e8, 2026-07-21). The cut point deliberately stops before the churny 7/22+ wave: Sidebar v2 beta (+ DB migration 033), the glass UI redesign, and the mobile thread-sync overhaul — those are planned as a follow-up merge once upstream stabilizes.

This is a strategy change from per-commit cherry-picks to a real merge; see the new dated entry in UPSTREAM_DIVERGENCE.md for full rationale, superseded skip-decisions, and per-file conflict notes.

Highlights pulled in

• Headless t3 connect for SSH hosts; lightweight connection probe; faster new-chat propagation and offline catch-up; localhost preview URL resolution for remote environments
• Claude: handle all SDK stream messages (no more spurious work-log warning rows), capability probe isolated from user MCP servers, CLAUDE_CONFIG_DIR respected, Bedrock auth recognized
• New defaults: Claude 1M context, Codex gpt-5.6, worktrees from origin main
• Codex launch-arguments setting; regenerated Codex protocol bindings
• Drag files from explorer into composer; archive threads from context menu; diffs default to working changes; image-upload crash fix; stale-active-turn cleanup
• Clerk stack upgrade, desktop packaging fixes (previously deferred — now along for the ride)

Notable resolutions

• Mobile: resolved wholesale to upstream's official Android implementation (supersedes our hand-rolled Android commits, per the standing no-mobile-investment policy). Kept fork-only: self-signed-TLS trust plugin + APK publish script.
• Shell resume: our fix(sync): stop the shell thread list from wedging on a stale cache #40 stale-cache fix retired in favor of upstream's rework (c14a5ca49/db4b2d8a0), which covers both failure modes with tests.
• Unions: dotfiles toggle + root input (FileBrowserPanel), Solarized theme layer + file-viewer worker pool (FilePreviewPanel/index.css), ThemeToggle — all preserved alongside upstream's new composer file links, workspace image preview, and sidebar width work.
• .claude/skills → upstream's .agents/skills symlink layout; /redeploy skill moved accordingly.

Verification

• Typecheck clean: apps/server, apps/web, packages/client-runtime
• Tests: shell-sync.test.ts + shell.test.ts (5/5), server.test.ts -t subscribeShell (7/7)

🤖 Generated with Claude Code

[DanielGGordon]

Test deployment (degraded / tunnel mode)

This branch is running on a local test instance, but the external HTTPS
port is not reachable yet (Caddy not bootstrapped or OVH port closed), so
there is no public URL. Reach it over an SSH tunnel:

# Open the tunnel from your laptop (keep this session open):
ssh -L 8080:127.0.0.1:3776 dgordon@<SERVER_IP>
# THEN, inside that SSH session (i.e. on <SERVER_IP>, not your laptop),
# mint a link whose URL points at your tunnel origin:
node scripts/test-status.ts --pair 7446 --base-url http://127.0.0.1:8080
# finally open the printed http://127.0.0.1:8080/pair#token=... in your local browser

Slot: external 7446 ⇄ loopback 3776.

[DanielGGordon]

Test deployment (degraded / tunnel mode)

This branch is running on a local test instance, but the external HTTPS
port is not reachable yet (Caddy not bootstrapped or OVH port closed), so
there is no public URL. Reach it over an SSH tunnel:

# Open the tunnel from your laptop (keep this session open):
ssh -L 8080:127.0.0.1:3776 dgordon@<SERVER_IP>
# THEN, inside that SSH session (i.e. on <SERVER_IP>, not your laptop),
# mint a link whose URL points at your tunnel origin:
node scripts/test-status.ts --pair 7446 --base-url http://127.0.0.1:8080
# finally open the printed http://127.0.0.1:8080/pair#token=... in your local browser

Slot: external 7446 ⇄ loopback 3776.

[DanielGGordon]

Test deployment (degraded / tunnel mode)

This branch is running on a local test instance, but the external HTTPS
port is not reachable yet (Caddy not bootstrapped or OVH port closed), so
there is no public URL. Reach it over an SSH tunnel:

# Open the tunnel from your laptop (keep this session open):
ssh -L 8080:127.0.0.1:3777 dgordon@<SERVER_IP>
# THEN, inside that SSH session (i.e. on <SERVER_IP>, not your laptop),
# mint a link whose URL points at your tunnel origin:
node scripts/test-status.ts --pair 7447 --base-url http://127.0.0.1:8080
# finally open the printed http://127.0.0.1:8080/pair#token=... in your local browser

Slot: external 7447 ⇄ loopback 3777.