merge: sync upstream main through f22331240e

[BreakTheBeta]

Our fork was 59 commits behind pingdotgg/t3code. This merges upstream main through f22331240e into a merge commit on top of ours, so every Fold feature survives and the next sync is a normal git merge rather than a rescue operation.

36 files conflicted. Resolution rule: where the fork's orchestration-v2 rewrite owns the code, the fork's structure stays and upstream's behavior is ported onto it; where upstream refactored something the fork had only restyled, upstream wins so the next sync is quieter.

What today's pull brings in

Provider sign-in can be shared between instances (pingdotgg#12983) — the big one. New ProviderAuthFlow, credential bindings in the credential store, typed sign-in interactions (providerAuthRespond), and shared sign-in methods. Ported onto V2: one credential change at a time across instances that share a binding, sessions on every affected instance stop together, and a peer that moves to different credentials mid-drain is left alone. The session-admission guard (don't start a session while a sign-in it depends on is changing) moved from the deleted V1 adapter registry to the V2 one.

Worktree submodule control (pingdotgg#12953, pingdotgg#12954, pingdotgg#12955) — worktreeSubmodules in t3.json, project settings and environment settings: initialize recursively, top level only, or skip entirely for a setup script to handle. Resolved in ThreadLaunchService, where the fork actually creates worktrees. Exposed in web project defaults and in mobile's "New threads" page.

Explicit provider refresh bypasses T3-owned caches (pingdotgg#13109) — refreshing a provider now force-refreshes the model manifest, drops per-instance discovery caches, and clears the version cache, instead of waiting out the timers. Also restores the usage-limit refresh and per-instance refreshModels the fork had lost.

Settings scope reads as a sentence (pingdotgg#13139, pingdotgg#13165) — the scope a setting writes to is stated at the top of the page; the fork's scope-picker breadcrumb is retired in favor of it.

Opus 5.5 (pingdotgg#13094) plus a model-manifest refresh.

Smaller fixes: attachment uploads retry after reconnect (pingdotgg#10338); composer transitions respect the panel-motion setting (pingdotgg#11064, pingdotgg#13098); menus close when you click into the browser tab (pingdotgg#11148); thread undo moved to a sidebar notice (pingdotgg#12972); comment and review buttons merged into one composer (pingdotgg#12945); PR row actions answer in place (pingdotgg#12843); snooze calendar starts the week where your locale does (pingdotgg#12745); old message-sent events without a turnId no longer block server start (pingdotgg#12763); text selection works while renaming threads (pingdotgg#12935); iOS autocorrect stops rewriting search queries (pingdotgg#12949); PR diffs generate from branch changes (pingdotgg#13170); mobile module-cycle and favicon-cache cleanups (pingdotgg#13151, pingdotgg#13160).

Design system pass (pingdotgg#13020–pingdotgg#13043) — ~24 commits giving Button, Badge, Input, ScrollArea, Skeleton, Empty, Spinner, tooltips, menus and popovers real variants instead of className overrides, plus a shadcn/no-restyle lint rule. Adopted as-is; the fork's extracted BranchPicker and mobile settings sections carry the same changes so they don't drift.

Fork-side notes

• RESTYLE_CEILING raised 628 → 679. The fork carries surfaces upstream doesn't (work board, splatter themes) that trip the new rule; the gate still blocks growth.
• Mobile stays on 1.2.0 with the fork's OTA manifest; upstream's bump to 1.3.0 is not ours to take.
• The V1 files upstream touched stay deleted: ProviderCommandReactor, the V1 ProviderAdapterRegistry, server.test.ts, HostedBrowserWebview, and the ACP-based Cursor model discovery.
• @t3tools/shared/threadEnvMode is gone upstream, folded into resolveProjectSettings; the fork's last caller already went through the resolver.
• Known gap: the worktree recovery path in ProviderTurnStartService doesn't read the submodules setting, so it falls back to the checkout's own t3.json — the same fallback upstream uses when a settings read fails.

Verification

• vp run -r typecheck — all 15 workspaces clean
• vp lint — passes; vp run lint:restyle-ceiling at the ceiling
• vp run knip:check — clean
• Tests: provider + vcs + git (1471), orchestration-v2 (1198), web components + mobile (3660), ws + client-runtime (1774), contracts + shared (270). All passing.

No UI screenshots: the visible changes here are upstream's own, already reviewed in their PRs.

Model: Claude Opus 5 (1M context), harness: Claude Code in T3 Code.

🤖 Generated with Claude Code