merge: sync upstream through ba9c9ae81 (19 commits)

[omegent-app]

Adopts upstream through ba9c9ae81 — the 19 commits that landed after 48aa875c0, headlined by
pingdotgg#5768 (project settings become a real settings page), pingdotgg#5766 (worktree or current checkout,
per project), pingdotgg#5777 (unsent drafts in the sidebar) and pingdotgg#5774 (settle stops monitors and dev
servers).

Important

Merge with a merge commit, not squash. Squashing collapses the second parent and discards
upstream's commits as ancestors — the thing that keeps "commits behind upstream" honest.

Upstream commits entering the product

Commit
ba9c9ae81	fix(server): one greedy agent process no longer takes down the whole server (pingdotgg#5788)
076e9048d	feat(web): project icons can be chosen manually (pingdotgg#5775)
05eb05118	feat(web): keep unsent drafts one click away in the sidebar (pingdotgg#5777)
ddaa6afef	feat(server): vp run migrate-dev-db seeds worktree dev dbs with real data (pingdotgg#5773)
6f69b4407	fix(web): sidebar rows show the branch again, not a truncated plan step (pingdotgg#5776)
6dbffa022	feat: pick worktree or current checkout per project (pingdotgg#5766)
5bb8c0366	fix(server): settle no longer leaves monitors and dev servers running (pingdotgg#5774)
886195ec1	fix(web): usage totals no longer jump while devices report in (pingdotgg#5772)
288d8e345	feat(web): overhaul project settings into a real settings page (pingdotgg#5768)
5208bdeb0	fix(web): pinned reorder no longer reshuffles while writes land (pingdotgg#5767)
a6c9b41f9	feat(server): agents can now open the images you paste into chat (pingdotgg#5757)
70c423a5e	fix(web): usage page loses the cost quality panel, gains a back button (pingdotgg#5756)
89c320df0	fix(server): stop Codex threads with queued follow-ups (pingdotgg#5762)
e70cdb478	fix(server): stop Claude resume handshakes from completing turns that never ran (pingdotgg#5710)
be01b287b	fix(web): add missing cursor-pointer styling to dropdowns and buttons (pingdotgg#5716)
c2f8cb7ca	feat(web): show how many subagents are running at a glance (pingdotgg#5745)
89ee692bf	fix(web): persist diff view mode (pingdotgg#5731)
7b2cf4374 · 49964e38c	chore: vouch saphid / gfsaaser24 (the fork's .github/VOUCHED.td deletion stands)

Resolutions

15 conflicted files. What actually needed judgement:

Where	Situation	Resolution
ws.ts	upstream pingdotgg#5774 stops the provider session when a thread parks; the fork's identity claim gate and stampOrchestrationCommandSource sit on the same dispatch, and the fork owns thread.unarchive worktree restore	woven: claim gate → source stamp → pre-stop read → dispatch → parking stop. Parking covers archive and settle; settle is gated onlyIfSettled so a re-engaged thread is not killed
ProjectScriptsControl.tsx	upstream pingdotgg#5768 extracted the whole editor into projectScriptEditor.tsx; the fork had added two lifecycle hooks and a menu-label helper to the inline dialog	upstream's extraction adopted; the fork's runOnWorktreeRemove / runOnPrMerged rebuilt inside the extracted dialog (type, empty input, hydration, submit, two switches) and projectScriptMenuLabel restored on the menu row
AssetAccess.ts	fork's canonical-path + preview-type checks vs upstream's content-revisioned favicon filenames and 30-minute token bucketing	both — the auto-merge silently dropped upstream's revision block and bucketing; restored beside the fork's checks (5 upstream tests were failing on it)
Sidebar.tsx	upstream added a drafts block and settled-tail paging to the row builder the fork rewrote	unioned; the fork's appendRecencyRows grouping kept under upstream's draft-then-pinned ordering, and the duplicated SETTLED_TAIL_* consts collapsed onto the fork's Sidebar.logic exports
projector.ts	upstream's new defaultThreadEnvMode and faviconPath land on a read model the fork moved to HashMap	both fields rebuilt on the fork's updateProject helper
useHandleNewThread.ts	upstream extracted pickExplicitWorkspaceOptions and made the default-mode resolution async	fork's reuseBaseBranch folded into the helper and into the reset gate
ClaudeAdapter.ts	upstream pingdotgg#5757 grants the attachments dir; the fork passes a resolved cwd and a session environment	both, with the grant naming the resolved cwd (see below)
decider.projectThreadEnvMode.test.ts	upstream's new test indexes readModel.projects[0] — an array the fork replaced with a HashMap	adapted via a local projectFromModel accessor rather than weakening the assertion
migration ledgers	upstream added migrations 39/40, so five fork ledger tests asserted a stale tip	fixed-size tail windows slid (not grown), keeping the upstream/fork ledger-separation assertions intact
Codex collab fixture	upstream's new queued-stop test drives a second sendTurn, which in the fork goes through turn/steer — a method the mock peer did not speak	peer taught turn/steer (+ a rejectSteer switch and a turn-start sidecar). Upstream's test sets rejectSteer so it still exercises the turn/start path its fix is about; a second fork test covers the accepted-steer path and asserts no second provider turn opens

Adversarial review

Both reviewers ran over the git show --cc resolution surface with the merged worktree available.
Between them they found four real welds and one nit. All are fixed in 885b287f2.

grok-4.5 — 2 HIGH, 2 MEDIUM, 2 LOW:

Finding	Disposition
HIGH — mobile ProjectFavicon kept the fork's older loaded-URL set, orphaning upstream's projectFaviconCache module (request identity, memory-disk cache policy, recycling key). Its tests stayed green while nothing imported it — passing for the wrong reason	Fixed. Upstream's component is a strict superset now that it carries faviconPath, so it is adopted wholesale
HIGH — upstream's new settings page enforces single-owner for runOnWorktreeCreate only; the fork has three lifecycle hooks. Two scripts could both claim runOnWorktreeRemove, and only the first would ever run	Fixed. Both write paths now use the fork's clearConflictingLifecycleFlags, matching the chat header
MEDIUM — empty-draft reset lost reuseBaseBranch: false, so a stale reuse flag survived a reset that clears branch, worktree, env mode and origin policy	Fixed (found independently by gpt-5.6-sol)
MEDIUM — ClaudeAdapter granted the raw input.cwd while the query runs in the resolved cwd, so the tool allowlist and the process cwd could disagree	Fixed. The grant names the resolved cwd
LOW — the script editor kept a delete confirm open across a request swap, naming the previous script	Fixed
LOW — migration ledger tests only bumped tip expectations	Not a defect; verified the slid windows still assert ledger separation

gpt-5.6-sol — 1 HIGH, 1 MEDIUM:

Finding	Disposition
HIGH — mobile can submit on a provisional workspace mode: buildPendingTask reads workspaceSelection?.mode ?? workspaceMode with no settle gate, so submitting before t3.json loads freezes local over a project that requires worktree	Inherited from upstream, not fixed here. The line is byte-identical to HEAD^2 (pingdotgg#5766); the fork's resolution kept upstream's gate exactly where upstream put it. Worth a follow-up PR against the behaviour itself rather than a divergence smuggled into a sync
MEDIUM — reuseBaseBranch: false dropped from the empty-draft reset	Fixed as above

Both independently confirmed the intentional keep/drop surface is coherent: ws.ts keeps the fork's
claim gate reachable while upstream's parking stop runs, the favicon path hint stays advisory
(server-side projection is authoritative), the extracted script editor carries all three fork
lifecycle hooks through hydration/import/submit, and no assertion was renamed or relaxed into
passing for an unrelated reason.

Verification

• Recursive typecheck clean across all 17 packages.
• 2,345 tests pass; the only failure is the pre-existing CodexTextGeneration launch-args one,
  which reproduces on unmerged fork/dev (this merge touches nothing under textGeneration/).
• forkSurfaceExistence (the anti-stack-drop net) green at 17/17.
• pnpm-lock.yaml regenerated rather than hand-merged.

Co-authored by @patroza

opened by Patrick Roza in chat thread Discord · Discord · T3