[yordis]

• Upstream merged its own secret provider design (feat(settings): point provider environment variables at a secret provider pingdotgg/t3code#27115), which covers what ledger 0016 carried, so the fork takes upstream's design and drops 0016 instead of keeping two competing secret shapes.
• OpenBao and AWS Secrets Manager move onto upstream's driver architecture as their own secret-provider-* packages, so the fork keeps those stores without diverging from how upstream registers providers.
• Edit in place, the reference check button, setup-field secrets, and the always-on Secrets page are reapplied on upstream's secret UI, so fork users do not lose features they already rely on; ledger 0033 now describes only these additions.
• Settings saved by earlier fork builds are converted when they load, so existing secret variables and providers keep resolving without anyone re-entering them.
• EAS, source control, and usage-limit secrets now read through upstream's resolver, so there is one place that resolves secret references.
• mcpToolListJsonBytes is raised because the merged MCP tool list grew past the previous budget.

[cursor]

PR Summary

High Risk
Changes span security-sensitive auth/MCP pairing semantics, privileged systemd/sudo service protection, and fork preview CI that runs untrusted PR code with Expo credentials under controlled checkout pinning.

Overview
Mobile EAS CI splits preview deploys: same-repo PRs keep continuous preview on push while labeled; fork PRs get a new pull_request_target workflow that consumes the deployment label, checks out the labeled commit (not the branch tip), and uses EXPO_PREVIEW_TOKEN / EXPO_PRODUCTION_TOKEN instead of a single EXPO_TOKEN.

Server auth & ops: MCP pairing codes rejected for insufficient scope are no longer consumed, with requiredScopes enforced at grant consume time; RPC adds forceStopThread and reviewGetBranchCommits scopes; settings-update middleware decodes against the typed schema; pairing --base-url must be http(s). t3 service protect (Linux/systemd) adds memory/OOM drop-ins via sudo, surfaces protection in t3 service status, and the boot unit gains CPU/IO weight and memory/OOM defaults. Project CLI waits up to 10s for a live server; device hub proxy allows read-scope Android WebRTC signaling; device secrets resolve through SecretResolver.

Desktop: CLI install treats the app’s own launcher on PATH correctly via runsOurLauncher; Linux URL registration force-kills stuck update-desktop-database; trackpad gestureScrollBegin is forwarded to the renderer.

Mobile: large file-tree flatten avoids argument limits; PR list project choices dedupe by environment capability; review guide pauses refresh when the guide tab is hidden; threads show stop / force stop when a run ignores Stop; image-only user messages drop the bubble chrome; git branch sheet uses cwd for “this thread’s checkout”; queued-run edits recover into the composer if the run starts; MCP apps render for failed deferred tools; iOS workspace uses floating tab bar when liquid glass applies; assorted permission copy and provider refresh with reloadSecrets: true.

^{Reviewed by Cursor Bugbot for commit fc513c3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit fc513c3. Configure here.}

[cursor]

Unpinned actions in fork deploy

High Severity

The new pull_request_target fork workflow runs with EXPO_PREVIEW_TOKEN and pull-requests: write, but it pulls continuous-deploy-fingerprint@main plus floating checkout@v6, setup-vp@v1, and expo-github-action@v8. The same-repo preview workflow pins those actions to SHAs, including a pin that avoids an eas-cli JSON break. An unpinned @main action can change under this job and read those secrets, and it can also drift from the eas-cli 21.8.0 workaround the sibling workflow documents.

Additional Locations (2)

• .github/workflows/mobile-eas-preview-fork.yml#L85-L86
• .github/workflows/mobile-eas-preview-fork.yml#L103-L104

 

^{Reviewed by Cursor Bugbot for commit fc513c3. Configure here.}