chore(upstream): sync marcode through 78f462c4e18c

[maarco]

What Changed

Merges pingdotgg/t3code@78f462c4e18c8ea5e5037dc916389a3b72246025 (upstream v0.0.33, 28 commits) into Marcode as one --no-ff merge commit. Five conflicts, each resolved by hand combining both intents — no whole-file ours/theirs, no force push, reset, restore, stash, or clean.

Conflict decisions

Path	Upstream intent	Marcode intent	Resolution
apps/server/src/http.ts	Sandbox user-provided SVGs (pingdotgg#5916): add SVG_CONTENT_SECURITY_POLICY + assetResponseHeaders() beside DESKTOP_RENDERER_ORIGINS	Desktop renderer origins renamed to the marcode:// scheme	Both. Kept marcode://app + marcode-dev://app, took the whole security fix. The asset route's switch to assetResponseHeaders() auto-merged.
apps/web/src/routes/__root.tsx	Mount ConfirmDialogHost (themed confirmation dialogs, pingdotgg#5624)	Mount FloatingPillNav + FloatingCodePill	Both. Import-block collision only; all three mount points auto-merged. ConfirmDialogHost is now required — localApi.confirm() routes through the themed dialog instead of window.confirm.
apps/web/src/components/chat/DraftHeroHeadline.tsx	align-bottom → align-baseline so the project name sits on the headline baseline (pingdotgg#5864)	Dotted underline colored from the animated GIF headline text (border-current + headlineTextClassName) rather than a fixed border-foreground/60	Both. Kept Marcode's classes, applied upstream's alignment fix.
apps/web/src/components/AppSidebarLayout.tsx	Add ProjectProjectionRetention so settings swapping the thread sidebar out of the tree never flashes the zero-project state on return (pingdotgg#5923/pingdotgg#5930)	Render no sidebar at all on settings routes; FloatingPillNav owns brand, settings and sidebar controls	Both. Mounted ProjectProjectionRetention inside SidebarProvider and kept the !isOnSettings guard — Marcode unmounts the sidebar entirely, so it needs this fix more than upstream does. Upstream's in-sidebar settings chrome (SettingsSidebarNav, SidebarChromeHeader, useSidebarStageBackdropVariant) stays dropped, with a comment at the import seam.
apps/web/src/components/chat/ChatHeader.tsx	Refactor the header title area onto the new WorkspaceBreadcrumb primitive — project favicon segment, separator, inline rename, thread action menu (pingdotgg#5929)	File is split: ThreadActionsCluster is portaled into the pill nav, ChatHeader renders the title alone, thread actions live on the sidebar row's context menu	Marcode's structure kept. Upstream's refactor targets only surfaces Marcode does not render, so nothing of upstream's substance is dropped; the breadcrumb imports stay out.

Fork-boundary checks on the clean-merged remainder

Clean merges are the dangerous ones, so the merged tree was swept for upstream identity Marcode renames:

• Upstream moved project settings from /settings/projects/$projectKey to /projects/$projectKey and deleted both old route files. No Marcode surface referenced the old route; routeTree.gen.ts is consistent with apps/web/src/routes/.
• The ── Marcode fork seam ── in Sidebar.tsx and the unified workspace mount survived upstream's worktree-indicator and project-settings changes untouched.
• WORKTREE_BRANCH_PREFIX is still "marcode" and every call site and fixture reads the constant — no hardcoded t3code/<hex> branch fixtures came in.
• serviceLauncher still requires MARCODE_HOME and still rejects T3CODE_HOME (its test asserts the throw).
• Compatibility identifiers deliberately left upstream-shaped: T3_BOOT_SERVICE_UNIT (t3code.service), T3_SERVICE_LAUNCHER_CONTEXT, @t3tools/*, the t3 package/CLI name, and the t3code:* theme storage keys.
• authRedirect.test.ts fixtures use t3code:// URLs, but resolveClerkSignInProps is scheme-agnostic — they pin behavior, not identity, so they were left as upstream wrote them rather than adding conflict surface.
• Neither pnpm-workspace.yaml nor infra/relay/package.json moved, so no coupled vendored subtree sync (sync:repos) is required.

⚠️ One item for your review

Upstream added .github/workflows/mobile-eas-production.yml (pingdotgg#5609). On every push to main touching mobile paths it runs eas build --auto-submit, which submits to TestFlight and the Play internal track. It is inert today — every step is gated on secrets.EXPO_TOKEN and the job logs "skipping" without it — and it follows the same guard as the mobile-eas-preview.yml this fork already carries, so it was taken as upstream shipped it.

The catch: apps/mobile/app.config.ts still points at upstream's Expo project (owner: "pingdotgg", projectId: d763fcb8-…) while Marcode's bundle identifiers are com.t3tools.marcode*. If an EXPO_TOKEN is ever added to this repo, that workflow would attempt store submissions against upstream's Expo org. Worth deciding whether to point the EAS project at Marcode or drop the push trigger — a release-ownership call, so nothing was changed here.

Why

Daily upstream sync. Marcode is a maintained fork, so upstream correctness, security, and operational fixes have to land even when they touch customized files — hotspots in .github/upstream-sync.yml are mandatory-review paths, not automatic keep-Marcode paths. The SVG sandboxing fix in http.ts is the clearest example: it landed inside a hotspot line Marcode had renamed, and dropping it would have silently reverted a security fix.

Resolves the upstream-sync-blocked tracking issue #20.

UI Changes

No Marcode-authored UI change. The user-visible deltas are upstream's, unverified in a live client from this container (no display; test-t3-app was not run):

• themed confirmation dialogs replacing window.confirm
• settings/usage breadcrumbs and the settings → /projects/$projectKey route move
• project name baseline alignment on the draft hero headline
• worktree icon on sidebar thread rows
• --update-foreground token now --color-blue-400

Worth a pass over settings, usage, and the draft hero at 390px and 820px before this comes out of draft.

Checklist

• This PR is small and focused — one upstream merge, no unrelated work
• I explained what changed and why — every conflict decision is recorded above
• I included before/after screenshots for any UI changes — upstream UI changes not driven live from this container
• I included a video for animation/interaction changes — not applicable

Verification

Focused only, per AGENTS.md — no full workspace suite.

• vp test run over 19 files covering every touched area — 304 tests passed: http.test.ts, authRedirect.test.ts, confirmDialog.test.ts, localApi.test.ts, shell.test.ts, composerInlineTokens.test.ts, projectGrouping.test.ts, ProjectFaviconResolver.test.ts, usageTranscripts.test.ts, settingsSearch.test.ts, Sidebar.logic.test.ts, rightPanelStore.test.ts, DesktopShellEnvironment.test.ts, DesktopApplicationMenu.test.ts, ElectronDialog.test.ts, git.test.ts, serviceLauncher.test.ts, wideMarkdownBlocks.test.ts, upstream-sync-workflow.test.ts
• vp run --filter typecheck for @t3tools/web, t3, @t3tools/shared, @t3tools/contracts, @t3tools/client-runtime, @t3tools/desktop — all clean (only pre-existing Effect suggestion diagnostics in files this merge did not touch)
• vp fmt --check on the five resolved files — clean
• vp lint apps/server/src apps/web/src/components apps/web/src/routes — exit 0, only pre-existing warnings

Not verified here: the four required CI checks (Check, Test, Mobile Native Static Analysis, Release Smoke) and live client verification. Leaving as draft for those.

---

Generated by Claude Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	11.3 KiB	11.3 KiB	−18 B (−0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	5.5 KiB	5.5 KiB	−1 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−17 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	49.7 KiB	49.7 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	16	16	0 (0.0%)	21	✅
Claude	Total thread wire	11.3 KiB	11.3 KiB	+1 B (+0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	5.5 KiB	5.5 KiB	+12 B (+0.2%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	5.9 KiB	5.9 KiB	−11 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	50.6 KiB	50.6 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	16	16	0 (0.0%)	21	✅

Baseline: 8a6745f · PR result: e7c3fdd · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 94.6 KiB
• Claude decoded thread snapshot: 95.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[maarco]

CI terminal on e7c3fdd — all four required checks green (run 31404424271):

Check	Result
Check	✅ success
Test	✅ success
Mobile Native Static Analysis	✅ success
Release Smoke	✅ success

Thread transfer impact stayed within every ceiling. EAS Preview skipped — no EXPO_TOKEN in this repo, which confirms the mobile-eas-production.yml note in the description is inert today.

One non-required job, upstream's new advisory Native fingerprint diff, has been queued without starting since 15:35 UTC — likely runner availability rather than anything in this diff. It's advisory by design (always passes; the 📱 Native Change label is the signal) and is not in requiredPullRequestChecks, so it doesn't gate anything.

Staying draft: still needs live client verification of upstream's UI changes (settings/usage breadcrumbs, themed confirm dialogs, sidebar worktree icon, draft hero baseline) at 390px and 820px, plus a decision on the EAS production workflow's project ownership.

---

Generated by Claude Code