[yordis]

• Kept the fork's release gate on the resolved relay URL and GitHub-hosted runners while adding upstream's new Release web tests job to the gate, so the fork keeps skipping release work it has no relay for and never schedules a Blacksmith runner it cannot use.
• Upstream moved the Windows arm64 desktop build onto a Blacksmith Linux runner with a separate arm64 verify step; the fork runs that build on GitHub-hosted Linux and keeps upstream's verify split.
• Resolved the lockfile from the fork side, so Dependabot's sharp and MCP SDK bumps and the fork's list-library patch survive, then reinstalled to pick up upstream's pele and esbuild additions.
• Upstream's own head still warms up mermaid in the timeline browser test after switching rendering to pele, which no longer resolves; the warmup now preloads pele's flowchart chunk for the same reason.
• Pinned upstream's shared dependency cache step and the Windows workflow to commits, because the org only allows commit-pinned actions and the unpinned step has been failing every fork CI job since the last sync.
• Local run: typecheck and lint green, server tests fully green. The remaining local failures are machine-specific (case-insensitive APFS for the Linux icon tests, the global git identity hook for mobile checkout tests) and one pre-existing command palette focus test that fails identically on main.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[cursor]

PR Summary

Medium Risk
Changes touch the desktop release pipeline (cross-compile, signing, verify artifacts) and new webhook dedupe persistence; mobile layout/composer behavior is user-visible but mostly UI-side.

Overview
This sync brings upstream main into the fork while keeping fork-specific release gating and GitHub-hosted runners where Blacksmith isn’t used.

Release & CI: Desktop release workflow is reworked so Windows arm64 can build on Linux (cargo-xwin, jsign, cross-target CLI SEA) and run smoke/verify on a separate verify_runner job; CLI archives are built and signed earlier, with bundled verify scripts uploaded when verification is split. Release testing now mirrors CI’s package split (dedicated web job with Playwright Chromium cache, general package tests, 8 server shards). Several Actions steps are commit-pinned (actions/cache, checkout, setup-vp).

Mobile: Thread composer stays one row until the draft would wrap (native content width/height events), then expands to a card; the model control can go icon-only with Reanimated toolbar transitions. On Android split view, soft keyboard use defers sidebar/rail, compact thread headers, and settled pane width drives feed layout without double reflow. Scheduled webhook tasks gain UI for filters, replay/coalesce templates, and validation aligned with shared client-runtime helpers. iOS collapsed split Back is fixed via appearance-driven router pops; header setOptions compares React elements safely.

Server & tooling: Adds webhook dedupe persistence (migration 067) and expands orchestrator MCP copy for filters/dedupe; integration and Claude steer tests are stabilized; mock agent publishes running-command PIDs before exit. Docs (AGENTS.md) update browser-test patterns; minor usage-limits UI and app-update AppState wiring.

^{Reviewed by Cursor Bugbot for commit fec67a8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	4.9 KiB	5.0 KiB	+30 B (+0.6%)	6.8 KiB	✅
Codex	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Codex	Live turn WebSocket wire	1.2 KiB	1.2 KiB	+30 B (+2.5%)	2.0 KiB	✅
Codex	Live turn WebSocket decoded	20.8 KiB	20.9 KiB	+41 B (+0.2%)	29.3 KiB	✅
Codex	Live turn messages	1	2	+1 (+100.0%)	8	✅
Claude	Total thread wire	5.0 KiB	5.0 KiB	+31 B (+0.6%)	6.8 KiB	✅
Claude	Thread snapshot wire	3.8 KiB	3.8 KiB	0 B (0.0%)	4.9 KiB	✅
Claude	Live turn WebSocket wire	1.2 KiB	1.2 KiB	+31 B (+2.6%)	2.0 KiB	✅
Claude	Live turn WebSocket decoded	21.2 KiB	21.2 KiB	+41 B (+0.2%)	29.3 KiB	✅
Claude	Live turn messages	1	2	+1 (+100.0%)	8	✅

Baseline: b300f8d · PR result: fec67a8 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fec67a8. Configure here.}

[cursor]

Stale composer overflow after draft changes

Medium Severity

draftOverflowsRow and draftSizeRef stay tied to the previous draft. They never reset when draftMessage or composerDraftKey changes, and overflow is not recomputed on those changes either. After a long card draft is sent or replaced, the next keystroke can open the card from the old size until a later native onContentSizeChange. Controlled native updates often skip those events, so the wrong layout can stick.

Additional Locations (1)

• apps/mobile/src/features/threads/ThreadComposer.tsx#L531-L532

 

^{Reviewed by Cursor Bugbot for commit fec67a8. Configure here.}