chore(rtvision): sync upstream and prepare 0.0.76

[kalvenschraut]

RTVision upstream sync for 0.0.76

The sync brings 74 upstream commits into rtvision and layers the remaining fork behavior over upstream's provider extraction, browser changes and client improvements.

Pinned fork dfe5bded8ce8e997b869a046e3ad398045631436; previous upstream ancestor 30cc788975500a8c00d32a50f348174d1ce578d1; incoming upstream main 43f8a8de17a7ac1baa7a3cf36d681856de2d8add. There are 1,088 upstream changed paths and 76 literal fork overlaps. The merge preserves upstream ancestry. This update is published as 0.0.76.

New upstream features and fixes

• Providers and models. Muse Code is a native provider with create/resume, model and reasoning selection, active steering/interruption, text/image input, approvals/questions, usage/todos/compaction, workflow children and owned native completion reports. It supports supervised/full-access modes; dedicated Plan, native rollback and native fork are unavailable. Catalog discovery does not treat cached models as proof of authentication. Temporary-workspace metadata generation validates structured output and rejects interaction. Provider core/testing and Pi, Muse, OpenCode, Cursor, ACP, Grok and ACP Registry move into dedicated packages; shared prompts, notifications, logging and adapter construction replace their old server locations. Pi gains owned continuation turns, optional tool discovery, workspace skills/commands, seeded editor answers, complete selected-skill loading and native rewind reconciliation. Muse workflow subagents handle hidden approvals. Model lists avoid incorrectly marking new models legacy and explain when a CLI update unlocks a model. Claude authentication recognizes logged-out state and removes its MCP token from process arguments.
• Chat, editing and terminal. Compact-before-send becomes a token-count chip with per-thread opt-out. Find searches messages and plans, including virtualized/folded history. Copy returns before Fork; search colors and timeline marker gutters improve readability. The collapsed composer reserves space for wider send actions, semantic branch hints follow settings, stack-merge confirmation closes promptly, PR linking works outside Git repositories, folder loading uses row feedback and sidebar drag cancellation drops stale context. Terminal scrollback/navigation, select-all and snapshots improve; JetBrains IDEs open remote projects over SSH.
• Usage and server performance. Provider filters and progressive Usage totals avoid waiting for slow sources. Antigravity skips unchanged database decoding; Cursor history uses ordered parallel fetches and caching. Shell snapshots decode outside their database transaction; ACP streamed chunks avoid repeated persistence; long message sync uses narrower database work. Threads settle promptly when their PR merge is observed, and agents can request self-settlement after their turn ends.
• Browser, preview and files. File previews support downloads, page anchors and repository paths without leaking internal hosts through favicons; draft threads preview media before their first message. Environment-hosted tabs improve navigation/ownership, agent history stays bounded, fallback is clearer and a timed-out drag cannot exit the server. Desktop browser tabs improve fullscreen, shortcuts, links, reload, hidden tabs and downloads, and display remote-environment tabs locally. Annotation captures use bounded retries and device-pixel-aware crops. Electron moves to 44.4.5; its User-Agent is valid and backend pipe reads cancel during shutdown.
• Connections and authentication. Session permissions are shown for the active route and session expiry/revocation terminates WebSocket access. Pairing uses integer SQLite boolean bindings. Authenticated GitHub Enterprise hosts are recognized with repository context. Relay updates select compatible managed cloudflared, retry brief Windows file locks, release locks on cancellation and bound downloads; cloudflared is 2026.10.0. Desktop CLI installation warns about an existing command that takes precedence.
• Mobile. Native screen order survives pops and swipe-back, chat image previews work in the v5 stack, working-thread emphasis/status labels match web, and Android HTML WebViews yield vertical edge scrolling to their parent. Provider settings/icons and route permissions follow the shared model.

Upstream replacements and retained RTVision behavior

Upstream's integer pairing binding replaces the identical fork fix. Provider and shared-module moves are authoritative; all fork consumers migrate instead of restoring deleted modules. Upstream's bounded screenshot retries replace the fork's old capture timeout. Upstream's per-thread compaction-chip state replaces the old single ref. Browser/terminal improvements coexist with retained Vim navigation, terminal Neovim/editor choice, annotation drafts and reload restoration.

Gitea/Forgejo provisioning, private signed images, CI/viewed/dependency/reaction support and destination grants remain. The fork keeps exhaustive historical PR lookup and safe checkout host/port/base matching. Codex clean-exit recovery and idle-timer identity guards remain. Registry/update routing, Node/npm/OpenRC service entry points, Alpine native Chromium and node-pty compatibility, SSH/WSL account routing and release packaging remain fork-specific.

Verified integration repairs omit private bundled workspaces from npm publication metadata, migrate PTY/editor imports, remove the stale compaction ref, retain GitHub API ports, require destination preview permission for profile reports and prevent same-name desktop downloads overwriting each other. A focused existing process-containment test also verified a missing-target exit-code defect; explicit command lookup preserves the wrapper's failure status on non-interactive shells.

Validation

CI is green on 4ec20d6690, including lint, typecheck, build, all server shards, web tests, Rust and Release Smoke. Focused regressions passed for retained Usage totals, Find history/Mermaid/dismissal, closed browser runtime, preview bridge/profile identity, CLI collision handling, Muse completion and connection permissions. No browser or live installed-service testing has occurred.

Review and release

The primary and independent GPT-6 Astra approved a high-level integration review of exact candidate 4ec20d669036b037257976eb5a37c9c2501b7ef4. CodeRabbit skipped the large diff, so the maintainer-authorized primary/Astra fallback applied. CI passed on both the candidate and merged head.

Merged as 854146131c9a2cbc8babe3ed5209281a07fd45e1. Release 0.0.76 is public. All 11 expected artifacts passed SHA256 verification. A clean supported Alpine/musl Node installation passed native PTY execution, FFF search, service preflight and HTTP startup. The exact npm tarball is published to RTVision's registry, with version, integrity and latest tag verified. No live service deployment or restart occurred.

Model and harness: GPT-6.1 Sol with GPT-6 Astra independent review, through the Codex harness in T3 Code.

[kalvenschraut]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review skipped: 904 files exceed the limit of 100.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	4.9 KiB	5.0 KiB	+23 B (+0.5%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	+23 B (+1.9%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.8 KiB	20.9 KiB	+41 B (+0.2%)	29.3 KiB	✅
Codex	Live turn messages	1	2	+1 (+100.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	−31 B (−0.6%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	−31 B (−2.5%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	−41 B (−0.2%)	29.3 KiB	✅
Claude	Live turn messages	2	1	−1 (−50.0%)	8	✅

Baseline: dfe5bde · PR result: 4ec20d6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[kalvenschraut]

Pushed signed repair 58570d3197b654aa5c782c3c9704f635c907f46f for verified Astra finding CRF1-R14-F1. Thread Find indexed Mermaid source but counted loading/error controls in the DOM, selecting the wrong occurrence and failing to reveal the source. The collector now ignores those controls.

The two integrated loading/error regressions failed before the source repair. All 83 ChatMarkdown tests pass after it. Scoped lint has no errors and six warnings on unchanged parent lines; ordinary web TypeScript, formatting, whitespace and trusted SSH signature checks pass. This Alpine host cannot apply the packaged Effect/Oxlint diagnostic patch, so configured validation remains with CI.

Three fresh GPT-6 Astra reviews are running on this exact candidate for rendering/Find, timeline logic and composer. Prior source approvals and CI are historical; aggregate primary/Astra GO is still pending. CodeRabbit's recorded 904-file versus 100-file skip remains the coverage limitation for the authorized fallback. PR merge and release 0.0.76 remain gated on complete current source approval, required CI, then artifact, isolated Node/service/Alpine/PTy/FFF and registry validation. No merge or publication has occurred.

Repair and validation: GPT-6.1 Sol, Codex harness. Independent review: GPT-6 Astra, Codex through T3 delegated tasks.