[bogorman]

Problem

Tools that track work for a thread (task trackers, CI, review bots) have no way to show it on the thread. The sidebar
row has room beside the pull request badge, but only T3 Code's own pull request state uses it, and an outside tool
can't say "this thread needs you".

Change

MCP tools: t3_thread_badge_set and t3_thread_badge_clear, for outside agents with write access, or a thread's
own agent.

A badge has:

• a key
• a label or count
• an icon (fixed set) and a tone
• a tooltip
• a link (http(s) or t3code:// only)
• an optional needsYou reason
• an optional expiresAt

Display: beside the pull request badge on the sidebar row, in both row layouts.

• The tooltip names the agent that set it.
• Clicking opens the link the way pull request links open.
• needsYou turns it to the warning colour and the tooltip says why. Settled threads drop the mark.

Rules:

• one badge per key, at most 3 per thread
• a count of 0 or a passed expiresAt hides it
• only the agent that set a badge can change or clear it
• archiving clears badges

Storage: the badges ride on the thread payload, so there's no migration.

• It uses a server-only thread.badge.set command, so app clients can't forge a badge's source, and a
  thread.badges-updated event.
• The sidebar shell and the client model carry badges.

Read back: t3_thread_read and t3_thread_list return them.

Docs: a "Badges on threads" section in outside-agents.md.

Not in this PR (may follow, or be cut)

• an Annotate access level (badges currently need Supervised or more)
• needs-you sorting and notifications (it's a colour and tooltip today, not a sidebar state)
• a badge in the thread header
• mobile display
• finding a thread by provider session id

Testing

• threadBadge.test.ts: visibility (zero count, expiry), the needs-you reason, link and key validation.
• OrchestratorMcpToolkit.integration.test.ts covers:
  • setting a badge with needsYou (stored with its source)
  • reading it back
  • another agent's clear being refused
  • a javascript: link being rejected
  • the 3-badge cap
  • clearing
• Type checks are clean in contracts, shared, client-runtime, server, web, mobile and desktop. Format is clean.
• Test suites:
  • contracts: 647 pass
  • shared: 1,462 pass
  • client-runtime: 1,977 pass
  • web: 6,599 pass
  • server: everything passes except 8 tests that also fail on unchanged main on this machine
• Manual check in the app is still to do.

🤖 Generated with Claude Code

Closes #6

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for c26146b.

This comment will update automatically after the next completed run.