[yordis]

• Upstream now merges Claude --settings launch args into the flag settings, so the fork's launch mark reads OTEL_RESOURCE_ATTRIBUTES from them first: they outrank every settings file, and marking a file value instead would replace the user's flag value.
• Kept both the fork's provider secret resolver and upstream's port scanner in the runtime core layers, since provider hydration needs each.
• The fork's folder-drop effects carry reasons for upstream's new state-sync lint rule, and the fork's boot-secret test provides the port scanner the Claude runner now requires.
• infra/task-cache Cleanup test fails identically on upstream, so it is left for upstream to fix.

[cursor]

PR Summary

Medium Risk
Touches crash telemetry, CI secrets for R2 uploads, desktop deep-link handling, and preview permission UX—substantial surface area but mostly additive with opt-in reporting and non-failing upload steps.

Overview
This sync brings mobile crash observability end to end: early expo-observe bootstrap, a compiled relay observe endpoint (or a no-op .invalid URL), opt-in Send crash reports in Diagnostics, and RenderErrorBoundary forwarding caught errors. EAS production now runs eas update --emit-metadata, keeps per-platform dist-* folders, and uploads stripped JS source maps (plus iOS dSYMs on store builds) to R2 so the relay can symbolicate stacks—upload failures are warnings only.

Mobile product work adds in-app ZIP attachment browsing (tree, filter, entry preview, add-to-chat), a Linked from … section on Connections for peer links, triage in the command palette when the server supports it, and pairingFormLinkAction so a t3code://pair link updates an open pairing form instead of stacking a second screen. Smaller UX fixes include favicon registration without extra render state, Android form-sheet header/grabber via RoutedFormSheetContext, and deriving home project scope in render instead of syncing with an effect.

Desktop registers open-url before Clerk configure, queues macOS launch URLs, and treats t3code://pair like other app links. Preview browser sessions stop auto-granting clipboard-read; pages get a once-per-origin Allow/Block prompt, and external-link dialogs default to Block so Enter in the page cannot accept them.

Housekeeping: AGENTS.md documents the t3code/no-unreasoned-state-sync lint (replacing the effect budget rule), triage playbook wording, relay deploy comment cleanup, enriched-markdown/screens tarball bumps, and updated agent context budget byte counts.

^{Reviewed by Cursor Bugbot for commit 90af684. Bugbot is set up for automated code reviews on this repo. Configure here.}