From 01b2c042fdc94f621aef04c19c05e8362cd04a37 Mon Sep 17 00:00:00 2001
From: jln <85513960+jln13x@users.noreply.github.com>
Date: Tue, 21 Jul 2026 17:06:26 +0300
Subject: [PATCH] fix: backport upstream reliability improvements

Integrate focused correctness, performance, recovery, diff rendering, Git workflow, and desktop hardening changes from upstream PRs #4136, #4009, #3903, #4187, #3830, #2338, #3885, #4213, #4205, #3520, and #4107.

Document local adaptations, exclusions, and verification expectations in the personal fork inventory.
---
 .../src/electron/ElectronProtocol.test.ts     |   3 +-
 apps/desktop/src/electron/ElectronProtocol.ts |   1 +
 apps/desktop/src/main.ts                      |   6 +
 .../src/provider/Layers/CodexAdapter.ts       |   8 +-
 .../Layers/CodexInterruptResolution.test.ts   | 207 ++++++++++++++++++
 .../Layers/CodexSessionRuntime.test.ts        |   3 +-
 .../provider/Layers/CodexSessionRuntime.ts    |  85 ++++++-
 .../SourceControlRepositoryService.test.ts    |   3 +-
 .../SourceControlRepositoryService.ts         |   3 +-
 .../web/src/components/ChatView.logic.test.ts | 169 +++++++++++---
 apps/web/src/components/ChatView.logic.ts     |  39 ++--
 apps/web/src/components/ChatView.tsx          |  18 +-
 .../components/CommandPalette.logic.test.ts   |   9 +
 .../src/components/CommandPalette.logic.ts    |  12 +-
 apps/web/src/components/CommandPalette.tsx    |   3 +-
 apps/web/src/components/DiffPanel.tsx         |  45 +++-
 .../src/components/DiffWorkerPoolProvider.tsx |   3 +
 .../components/chat/MessagesTimeline.test.tsx |  14 ++
 .../src/components/chat/MessagesTimeline.tsx  |   5 +-
 .../src/components/chat/ThreadErrorBanner.tsx |  12 +-
 .../components/diffs/AnnotatableCodeView.tsx  |   9 +-
 apps/web/src/lib/diffRendering.test.ts        |  27 ++-
 apps/web/src/lib/diffRendering.ts             |  11 +
 apps/web/src/routes/__root.tsx                |  27 +++
 docs/upstream-integrations.md                 |  56 ++++-
 packages/client-runtime/src/state/vcs.test.ts |  37 +++-
 packages/shared/package.json                  |   4 +
 packages/shared/src/Struct.edgeCases.test.ts  |  72 ++++++
 packages/shared/src/Struct.test.ts            |  61 ++++++
 packages/shared/src/Struct.ts                 |  21 +-
 packages/shared/src/providerError.test.ts     |  48 ++++
 packages/shared/src/providerError.ts          |  36 +++
 32 files changed, 957 insertions(+), 100 deletions(-)
 create mode 100644 apps/server/src/provider/Layers/CodexInterruptResolution.test.ts
 create mode 100644 packages/shared/src/Struct.edgeCases.test.ts
 create mode 100644 packages/shared/src/Struct.test.ts
 create mode 100644 packages/shared/src/providerError.test.ts
 create mode 100644 packages/shared/src/providerError.ts

diff --git a/apps/desktop/src/electron/ElectronProtocol.test.ts b/apps/desktop/src/electron/ElectronProtocol.test.ts
index 92e30000427..2db85dafc4d 100644
--- a/apps/desktop/src/electron/ElectronProtocol.test.ts
+++ b/apps/desktop/src/electron/ElectronProtocol.test.ts
@@ -57,7 +57,7 @@ describe("ElectronProtocol", () => {
           assert.equal(yield* Effect.promise(() => response.text()), "ok");
           assert.include(
             response.headers.get("content-security-policy") ?? "",
-            "script-src 'self' 'unsafe-inline' https://clerk.t3.codes https://challenges.cloudflare.com",
+            "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://clerk.t3.codes https://challenges.cloudflare.com",
           );
           assert.include(
             response.headers.get("content-security-policy") ?? "",
@@ -212,6 +212,7 @@ describe("ElectronProtocol", () => {
     assert.deepEqual(directives["script-src"], [
       "'self'",
       "'unsafe-inline'",
+      "'wasm-unsafe-eval'",
       "https://clerk.t3.codes",
       "https://challenges.cloudflare.com",
     ]);
diff --git a/apps/desktop/src/electron/ElectronProtocol.ts b/apps/desktop/src/electron/ElectronProtocol.ts
index 03c7ef64fd7..9d5a47806b3 100644
--- a/apps/desktop/src/electron/ElectronProtocol.ts
+++ b/apps/desktop/src/electron/ElectronProtocol.ts
@@ -71,6 +71,7 @@ export function makeDesktopContentSecurityPolicy(input: DesktopProtocolRegistrat
   const scriptSources = [
     "'self'",
     "'unsafe-inline'",
+    "'wasm-unsafe-eval'",
     ...(clerkOrigin ? [clerkOrigin] : []),
     "https://challenges.cloudflare.com",
   ];
diff --git a/apps/desktop/src/main.ts b/apps/desktop/src/main.ts
index ec2440579dd..55fbe3aebcd 100644
--- a/apps/desktop/src/main.ts
+++ b/apps/desktop/src/main.ts
@@ -1,3 +1,9 @@
+for (const stream of [process.stdout, process.stderr]) {
+  stream.on("error", (err: NodeJS.ErrnoException) => {
+    if (err.code !== "EPIPE") throw err;
+  });
+}
+
 import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
 import * as NodeRuntime from "@effect/platform-node/NodeRuntime";
 import * as NodeServices from "@effect/platform-node/NodeServices";
diff --git a/apps/server/src/provider/Layers/CodexAdapter.ts b/apps/server/src/provider/Layers/CodexAdapter.ts
index 38a5887cdc3..def4bfebab5 100644
--- a/apps/server/src/provider/Layers/CodexAdapter.ts
+++ b/apps/server/src/provider/Layers/CodexAdapter.ts
@@ -38,6 +38,7 @@ import * as CodexErrors from "effect-codex-app-server/errors";
 import * as EffectCodexSchema from "effect-codex-app-server/schema";
 
 import { getModelSelectionStringOptionValue } from "@t3tools/shared/model";
+import { extractProviderErrorMessage } from "@t3tools/shared/providerError";
 import { getCodexServiceTierOptionValue } from "../../codexModelOptions.ts";
 import * as McpProviderSession from "../../mcp/McpProviderSession.ts";
 
@@ -772,7 +773,8 @@ function mapToRuntimeEvents(
     if (!payload) {
       return [];
     }
-    const errorMessage = trimText(payload.turn.error?.message);
+    const rawErrorMessage = trimText(payload.turn.error?.message);
+    const errorMessage = rawErrorMessage ? extractProviderErrorMessage(rawErrorMessage) : undefined;
     return [
       {
         ...runtimeEventBase(event, canonicalThreadId),
@@ -1249,7 +1251,9 @@ function mapToRuntimeEvents(
 
   if (event.method === "error") {
     const payload = readPayload(EffectCodexSchema.V2ErrorNotification, event.payload);
-    const message = payload?.error.message ?? event.message ?? "Provider runtime error";
+    const message = extractProviderErrorMessage(
+      payload?.error.message ?? event.message ?? "Provider runtime error",
+    );
     const willRetry = payload?.willRetry === true;
     return [
       {
diff --git a/apps/server/src/provider/Layers/CodexInterruptResolution.test.ts b/apps/server/src/provider/Layers/CodexInterruptResolution.test.ts
new file mode 100644
index 00000000000..96a45a3558d
--- /dev/null
+++ b/apps/server/src/provider/Layers/CodexInterruptResolution.test.ts
@@ -0,0 +1,207 @@
+import * as NodeAssert from "node:assert/strict";
+
+import * as Deferred from "effect/Deferred";
+import * as Effect from "effect/Effect";
+import * as Fiber from "effect/Fiber";
+import * as TestClock from "effect/testing/TestClock";
+import { describe, it } from "@effect/vitest";
+import { TurnId } from "@t3tools/contracts";
+import type * as CodexRpc from "effect-codex-app-server/rpc";
+import type * as EffectCodexSchema from "effect-codex-app-server/schema";
+
+import {
+  findActiveCodexTurnId,
+  resolveCodexInterruptTurnId,
+  shouldReplaceActiveCodexTurnCandidate,
+} from "./CodexSessionRuntime.ts";
+
+function makeThreadReadResponse(
+  turns: EffectCodexSchema.V2ThreadReadResponse["thread"]["turns"],
+): EffectCodexSchema.V2ThreadReadResponse {
+  return {
+    thread: {
+      cliVersion: "0.0.0-test",
+      createdAt: 1,
+      cwd: "/tmp/project",
+      ephemeral: false,
+      id: "provider-thread-1",
+      modelProvider: "openai",
+      preview: "test thread",
+      sessionId: "session-1",
+      source: "appServer",
+      status: { type: "active", activeFlags: [] },
+      turns,
+      updatedAt: 2,
+    },
+  };
+}
+
+describe("findActiveCodexTurnId", () => {
+  it("selects the most recently started in-progress turn", () => {
+    const snapshot = makeThreadReadResponse([
+      { id: "turn-active-new", status: "inProgress", startedAt: 30, items: [] },
+      { id: "turn-completed", status: "completed", startedAt: 20, items: [] },
+      { id: "turn-active-old", status: "inProgress", startedAt: 10, items: [] },
+    ]);
+
+    NodeAssert.equal(findActiveCodexTurnId(snapshot), "turn-active-new");
+  });
+
+  it("selects a later in-progress turn without a start timestamp", () => {
+    const snapshot = makeThreadReadResponse([
+      { id: "turn-active-old", status: "inProgress", startedAt: 10, items: [] },
+      { id: "turn-active-new", status: "inProgress", items: [] },
+    ]);
+
+    NodeAssert.equal(findActiveCodexTurnId(snapshot), "turn-active-new");
+  });
+
+  it("selects a later timestamped turn after one without a timestamp", () => {
+    const snapshot = makeThreadReadResponse([
+      { id: "turn-active-old", status: "inProgress", items: [] },
+      { id: "turn-active-new", status: "inProgress", startedAt: 10, items: [] },
+    ]);
+
+    NodeAssert.equal(findActiveCodexTurnId(snapshot), "turn-active-new");
+  });
+
+  it("returns undefined when no turn is active", () => {
+    const response = makeThreadReadResponse([]);
+    NodeAssert.equal(findActiveCodexTurnId(response), undefined);
+  });
+});
+
+describe("resolveCodexInterruptTurnId", () => {
+  it.effect("requests turns when resolving an interrupt without a projected turn id", () => {
+    let requestedParams: CodexRpc.ClientRequestParamsByMethod["thread/read"] | undefined;
+    let readThreadCallCount = 0;
+
+    return Effect.gen(function* () {
+      const turnId = yield* resolveCodexInterruptTurnId({
+        providerThreadId: "provider-thread-1",
+        requestedTurnId: undefined,
+        readSessionActiveTurnId: Effect.succeed(undefined),
+        readThread: (params) => {
+          readThreadCallCount += 1;
+          requestedParams = params;
+          return Effect.succeed(
+            makeThreadReadResponse([
+              { id: "turn-active", status: "inProgress", startedAt: 10, items: [] },
+            ]),
+          );
+        },
+      });
+
+      NodeAssert.deepStrictEqual(requestedParams, {
+        threadId: "provider-thread-1",
+        includeTurns: true,
+      });
+      NodeAssert.equal(readThreadCallCount, 1);
+      NodeAssert.equal(turnId, "turn-active");
+    });
+  });
+
+  it.effect("does not revive a stale projected turn after a successful empty read", () =>
+    Effect.gen(function* () {
+      const turnId = yield* resolveCodexInterruptTurnId({
+        providerThreadId: "provider-thread-1",
+        requestedTurnId: undefined,
+        readSessionActiveTurnId: Effect.succeed(TurnId.make("turn-stale")),
+        readThread: () => Effect.succeed(makeThreadReadResponse([])),
+      });
+
+      NodeAssert.equal(turnId, undefined);
+    }),
+  );
+
+  it.effect("falls back to the projected turn when the live lookup fails", () =>
+    Effect.gen(function* () {
+      const projectedTurnId = TurnId.make("turn-projected");
+      const turnId = yield* resolveCodexInterruptTurnId({
+        providerThreadId: "provider-thread-1",
+        requestedTurnId: undefined,
+        readSessionActiveTurnId: Effect.succeed(projectedTurnId),
+        readThread: () => Effect.fail("lookup failed"),
+      });
+
+      NodeAssert.equal(turnId, projectedTurnId);
+    }),
+  );
+
+  it.effect("bounds the live lookup and falls back to the projected turn on timeout", () =>
+    Effect.gen(function* () {
+      const projectedTurnId = TurnId.make("turn-projected");
+      const lookupStarted = yield* Deferred.make<void>();
+      const resolution = yield* resolveCodexInterruptTurnId({
+        providerThreadId: "provider-thread-1",
+        requestedTurnId: undefined,
+        readSessionActiveTurnId: Effect.succeed(projectedTurnId),
+        readThread: () =>
+          Effect.gen(function* () {
+            yield* Deferred.succeed(lookupStarted, undefined);
+            return yield* Effect.never;
+          }),
+      }).pipe(Effect.forkScoped);
+
+      yield* Deferred.await(lookupStarted);
+      yield* TestClock.adjust("2 seconds");
+      NodeAssert.equal(yield* Fiber.join(resolution), projectedTurnId);
+    }),
+  );
+
+  it.effect("reads the projected fallback after a live lookup times out", () =>
+    Effect.gen(function* () {
+      let projectedTurnId = TurnId.make("turn-old");
+      const lookupStarted = yield* Deferred.make<void>();
+      const resolution = yield* resolveCodexInterruptTurnId({
+        providerThreadId: "provider-thread-1",
+        requestedTurnId: undefined,
+        readSessionActiveTurnId: Effect.sync(() => projectedTurnId),
+        readThread: () =>
+          Effect.gen(function* () {
+            yield* Deferred.succeed(lookupStarted, undefined);
+            return yield* Effect.never;
+          }),
+      }).pipe(Effect.forkScoped);
+
+      yield* Deferred.await(lookupStarted);
+      // Mutate after the live lookup starts to verify that the fallback is
+      // evaluated lazily after the timeout instead of captured up front.
+      projectedTurnId = TurnId.make("turn-current");
+      yield* TestClock.adjust("2 seconds");
+      NodeAssert.equal(yield* Fiber.join(resolution), projectedTurnId);
+    }),
+  );
+});
+
+describe("shouldReplaceActiveCodexTurnCandidate", () => {
+  it("selects the first candidate", () => {
+    NodeAssert.equal(shouldReplaceActiveCodexTurnCandidate({ startedAt: 10 }, undefined), true);
+  });
+
+  it("orders timestamped turns by start time and lets a later equal entry win", () => {
+    NodeAssert.equal(
+      shouldReplaceActiveCodexTurnCandidate({ startedAt: 20 }, { startedAt: 10 }),
+      true,
+    );
+    NodeAssert.equal(
+      shouldReplaceActiveCodexTurnCandidate({ startedAt: 10 }, { startedAt: 20 }),
+      false,
+    );
+    NodeAssert.equal(
+      shouldReplaceActiveCodexTurnCandidate({ startedAt: 10 }, { startedAt: 10 }),
+      true,
+    );
+  });
+
+  it("lets the later provider entry win when either timestamp is absent", () => {
+    for (const [candidate, selected] of [
+      [{}, { startedAt: 10 }],
+      [{ startedAt: null }, { startedAt: 10 }],
+      [{ startedAt: 10 }, {}],
+      [{ startedAt: 10 }, { startedAt: null }],
+    ] as const) {
+      NodeAssert.equal(shouldReplaceActiveCodexTurnCandidate(candidate, selected), true);
+    }
+  });
+});
diff --git a/apps/server/src/provider/Layers/CodexSessionRuntime.test.ts b/apps/server/src/provider/Layers/CodexSessionRuntime.test.ts
index 119fa36303a..e0a71d3cbd4 100644
--- a/apps/server/src/provider/Layers/CodexSessionRuntime.test.ts
+++ b/apps/server/src/provider/Layers/CodexSessionRuntime.test.ts
@@ -1,9 +1,8 @@
 import * as NodeAssert from "node:assert/strict";
 
-import { it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Schema from "effect/Schema";
-import { describe } from "vite-plus/test";
+import { describe, it } from "@effect/vitest";
 import { DEFAULT_MODEL, ThreadId } from "@t3tools/contracts";
 import * as CodexErrors from "effect-codex-app-server/errors";
 import * as CodexRpc from "effect-codex-app-server/rpc";
diff --git a/apps/server/src/provider/Layers/CodexSessionRuntime.ts b/apps/server/src/provider/Layers/CodexSessionRuntime.ts
index 5a81e915e34..d5ab470d8fa 100644
--- a/apps/server/src/provider/Layers/CodexSessionRuntime.ts
+++ b/apps/server/src/provider/Layers/CodexSessionRuntime.ts
@@ -18,6 +18,7 @@ import {
 } from "@t3tools/contracts";
 import { resolveSpawnCommand } from "@t3tools/shared/shell";
 import { normalizeModelSlug } from "@t3tools/shared/model";
+import { extractProviderErrorMessage } from "@t3tools/shared/providerError";
 import * as Crypto from "effect/Crypto";
 import * as DateTime from "effect/DateTime";
 import * as Deferred from "effect/Deferred";
@@ -52,6 +53,7 @@ const BENIGN_ERROR_LOG_SNIPPETS = [
   "state db record_discrepancy: find_thread_path_by_id_str_in_subdir, falling_back",
 ];
 const CODEX_APP_SERVER_FORCE_KILL_AFTER = "2 seconds" as const;
+const CODEX_INTERRUPT_THREAD_READ_TIMEOUT = "2 seconds" as const;
 const RECOVERABLE_THREAD_RESUME_ERROR_SNIPPETS = [
   "not found",
   "missing thread",
@@ -692,6 +694,75 @@ function parseThreadSnapshot(
   };
 }
 
+type CodexTurnOrderingCandidate = Pick<
+  EffectCodexSchema.V2ThreadReadResponse["thread"]["turns"][number],
+  "startedAt"
+>;
+
+export function shouldReplaceActiveCodexTurnCandidate(
+  candidate: CodexTurnOrderingCandidate,
+  selected: CodexTurnOrderingCandidate | undefined,
+): boolean {
+  if (selected === undefined) {
+    return true;
+  }
+
+  // When either timestamp is absent, provider response order is authoritative.
+  // The caller scans in response order, so the later candidate replaces the selection.
+  if (candidate.startedAt == null || selected.startedAt == null) {
+    return true;
+  }
+
+  return candidate.startedAt >= selected.startedAt;
+}
+
+export function findActiveCodexTurnId(
+  response: EffectCodexSchema.V2ThreadReadResponse,
+): TurnId | undefined {
+  let activeTurn: EffectCodexSchema.V2ThreadReadResponse["thread"]["turns"][number] | undefined;
+  for (const turn of response.thread.turns) {
+    if (turn.status !== "inProgress") {
+      continue;
+    }
+    if (shouldReplaceActiveCodexTurnCandidate(turn, activeTurn)) {
+      activeTurn = turn;
+    }
+  }
+  return activeTurn === undefined ? undefined : TurnId.make(activeTurn.id);
+}
+
+export function resolveCodexInterruptTurnId<E>(input: {
+  readonly providerThreadId: string;
+  readonly requestedTurnId: TurnId | undefined;
+  readonly readSessionActiveTurnId: Effect.Effect<TurnId | undefined>;
+  readonly readThread: (
+    params: CodexRpc.ClientRequestParamsByMethod["thread/read"],
+  ) => Effect.Effect<CodexRpc.ClientRequestResponsesByMethod["thread/read"], E>;
+}): Effect.Effect<TurnId | undefined> {
+  if (input.requestedTurnId !== undefined) {
+    return Effect.succeed(input.requestedTurnId);
+  }
+
+  return input
+    .readThread({
+      threadId: input.providerThreadId,
+      includeTurns: true,
+    })
+    .pipe(
+      Effect.timeout(CODEX_INTERRUPT_THREAD_READ_TIMEOUT),
+      Effect.map(findActiveCodexTurnId),
+      Effect.tapError((cause) =>
+        Effect.logWarning("Failed to resolve active Codex turn before interrupt.", {
+          providerThreadId: input.providerThreadId,
+          cause,
+        }),
+      ),
+      // A failed lookup can still use the locally projected id. A successful
+      // lookup with no active turn must not revive a stale local id.
+      Effect.catch(() => input.readSessionActiveTurnId),
+    );
+}
+
 export const makeCodexSessionRuntime = (
   options: CodexSessionRuntimeOptions,
 ): Effect.Effect<
@@ -921,7 +992,7 @@ export const makeCodexSessionRuntime = (
           }
           const lastError =
             payload.turn.status === "failed" && "error" in payload.turn && payload.turn.error
-              ? payload.turn.error.message
+              ? extractProviderErrorMessage(payload.turn.error.message)
               : undefined;
           return updateSession(sessionRef, {
             status: payload.turn.status === "failed" ? "error" : "ready",
@@ -939,7 +1010,7 @@ export const makeCodexSessionRuntime = (
           if (providerThreadId && payloadThreadId && payloadThreadId !== providerThreadId) {
             return Effect.void;
           }
-          const errorMessage = payload.error.message;
+          const errorMessage = extractProviderErrorMessage(payload.error.message);
           const willRetry = payload.willRetry;
           return updateSession(sessionRef, {
             status: willRetry ? "running" : "error",
@@ -1315,8 +1386,14 @@ export const makeCodexSessionRuntime = (
       interruptTurn: (turnId) =>
         Effect.gen(function* () {
           const providerThreadId = yield* readProviderThreadId;
-          const session = yield* Ref.get(sessionRef);
-          const effectiveTurnId = turnId ?? session.activeTurnId;
+          const effectiveTurnId = yield* resolveCodexInterruptTurnId({
+            providerThreadId,
+            requestedTurnId: turnId,
+            readSessionActiveTurnId: Ref.get(sessionRef).pipe(
+              Effect.map((session) => session.activeTurnId),
+            ),
+            readThread: (params) => client.request("thread/read", params),
+          });
           if (!effectiveTurnId) {
             return;
           }
diff --git a/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts b/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts
index 861da9a10e0..c109088016c 100644
--- a/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts
+++ b/apps/server/src/sourceControl/SourceControlRepositoryService.test.ts
@@ -150,7 +150,7 @@ it.effect("preserves provider failures without deriving the repository message f
   }).pipe(Effect.provide(makeLayer({ provider })));
 });
 
-it.effect("clones a looked-up repository into the requested destination", () =>
+it.effect("clones a looked-up repository over HTTPS by default", () =>
   Effect.gen(function* () {
     const fs = yield* FileSystem.FileSystem;
     const parent = yield* fs.makeTempDirectoryScoped({
@@ -165,7 +165,6 @@ it.effect("clones a looked-up repository into the requested destination", () =>
         provider: "github",
         repository: "octocat/t3code",
         destinationPath,
-        protocol: "https",
       });
 
       assert.deepStrictEqual(result, {
diff --git a/apps/server/src/sourceControl/SourceControlRepositoryService.ts b/apps/server/src/sourceControl/SourceControlRepositoryService.ts
index 1b46369e25c..fc577f3321d 100644
--- a/apps/server/src/sourceControl/SourceControlRepositoryService.ts
+++ b/apps/server/src/sourceControl/SourceControlRepositoryService.ts
@@ -71,8 +71,9 @@ function selectRemoteUrl(
   switch (protocol ?? "auto") {
     case "https":
       return urls.url;
-    case "ssh":
     case "auto":
+      return urls.url;
+    case "ssh":
       return urls.sshUrl;
   }
 }
diff --git a/apps/web/src/components/ChatView.logic.test.ts b/apps/web/src/components/ChatView.logic.test.ts
index f3056842f0a..3746b014679 100644
--- a/apps/web/src/components/ChatView.logic.test.ts
+++ b/apps/web/src/components/ChatView.logic.test.ts
@@ -389,8 +389,8 @@ describe("hasServerAcknowledgedLocalDispatch", () => {
         localDispatch,
         phase: "ready",
         latestTurn: completedTurn,
-        latestUserMessageId: localDispatch.latestUserMessageId,
         session: readySession,
+        projectedMessages: [],
         hasPendingApproval: false,
         hasPendingUserInput: false,
         threadError: null,
@@ -415,8 +415,8 @@ describe("hasServerAcknowledgedLocalDispatch", () => {
         localDispatch,
         phase: "ready",
         latestTurn: newerTurn,
-        latestUserMessageId: localDispatch.latestUserMessageId,
         session: { ...readySession, updatedAt: newerTurn.completedAt },
+        projectedMessages: [],
         hasPendingApproval: false,
         hasPendingUserInput: false,
         threadError: null,
@@ -442,12 +442,12 @@ describe("hasServerAcknowledgedLocalDispatch", () => {
         localDispatch,
         phase: "running",
         latestTurn: runningTurn,
-        latestUserMessageId: localDispatch.latestUserMessageId,
         session: {
           ...readySession,
           status: "running",
           activeTurnId: TurnId.make("turn-other"),
         },
+        projectedMessages: [],
         hasPendingApproval: false,
         hasPendingUserInput: false,
         threadError: null,
@@ -458,12 +458,12 @@ describe("hasServerAcknowledgedLocalDispatch", () => {
         localDispatch,
         phase: "running",
         latestTurn: runningTurn,
-        latestUserMessageId: localDispatch.latestUserMessageId,
         session: {
           ...readySession,
           status: "running",
           activeTurnId: runningTurn.turnId,
         },
+        projectedMessages: [],
         hasPendingApproval: false,
         hasPendingUserInput: false,
         threadError: null,
@@ -471,7 +471,27 @@ describe("hasServerAcknowledgedLocalDispatch", () => {
     ).toBe(true);
   });
 
-  it("acknowledges a steering message projected onto the current running turn", () => {
+  it("acknowledges pending user interaction and errors immediately", () => {
+    const localDispatch = createLocalDispatchSnapshot(makeThread());
+    const common = {
+      localDispatch,
+      phase: "ready" as const,
+      latestTurn: null,
+      session: null,
+      projectedMessages: [],
+      hasPendingApproval: false,
+      hasPendingUserInput: false,
+      threadError: null,
+    };
+
+    expect(hasServerAcknowledgedLocalDispatch({ ...common, hasPendingApproval: true })).toBe(true);
+    expect(hasServerAcknowledgedLocalDispatch({ ...common, hasPendingUserInput: true })).toBe(true);
+    expect(hasServerAcknowledgedLocalDispatch({ ...common, threadError: "failed" })).toBe(true);
+  });
+
+  it("acknowledges a steer when its user message is projected onto the running thread", () => {
+    const initialMessageId = MessageId.make("message-initial");
+    const steerMessageId = MessageId.make("message-steer");
     const runningTurn = {
       ...completedTurn,
       state: "running" as const,
@@ -484,20 +504,21 @@ describe("hasServerAcknowledgedLocalDispatch", () => {
     };
     const localDispatch = createLocalDispatchSnapshot(
       makeThread({
-        latestTurn: runningTurn,
-        session: runningSession,
         messages: [
           {
-            id: MessageId.make("message-before-steer"),
+            id: initialMessageId,
             role: "user",
-            text: "Initial prompt",
+            text: "start",
             turnId: runningTurn.turnId,
-            createdAt: runningTurn.requestedAt,
-            updatedAt: runningTurn.requestedAt,
             streaming: false,
+            createdAt: now,
+            updatedAt: now,
           },
         ],
+        latestTurn: runningTurn,
+        session: runningSession,
       }),
+      { expectedUserMessageId: steerMessageId },
     );
 
     expect(
@@ -505,8 +526,53 @@ describe("hasServerAcknowledgedLocalDispatch", () => {
         localDispatch,
         phase: "running",
         latestTurn: runningTurn,
-        latestUserMessageId: MessageId.make("message-steer"),
         session: runningSession,
+        projectedMessages: [
+          {
+            id: initialMessageId,
+            role: "user",
+          },
+        ],
+        hasPendingApproval: false,
+        hasPendingUserInput: false,
+        threadError: null,
+      }),
+    ).toBe(false);
+
+    expect(
+      hasServerAcknowledgedLocalDispatch({
+        localDispatch,
+        phase: "running",
+        latestTurn: runningTurn,
+        session: runningSession,
+        projectedMessages: [
+          {
+            id: steerMessageId,
+            role: "user",
+          },
+        ],
+        hasPendingApproval: false,
+        hasPendingUserInput: false,
+        threadError: null,
+      }),
+    ).toBe(true);
+
+    expect(
+      hasServerAcknowledgedLocalDispatch({
+        localDispatch,
+        phase: "running",
+        latestTurn: runningTurn,
+        session: runningSession,
+        projectedMessages: [
+          {
+            id: steerMessageId,
+            role: "user",
+          },
+          {
+            id: MessageId.make("message-other-client"),
+            role: "user",
+          },
+        ],
         hasPendingApproval: false,
         hasPendingUserInput: false,
         threadError: null,
@@ -514,21 +580,72 @@ describe("hasServerAcknowledgedLocalDispatch", () => {
     ).toBe(true);
   });
 
-  it("acknowledges pending user interaction and errors immediately", () => {
-    const localDispatch = createLocalDispatchSnapshot(makeThread());
-    const common = {
-      localDispatch,
-      phase: "ready" as const,
-      latestTurn: null,
-      latestUserMessageId: localDispatch.latestUserMessageId,
-      session: null,
-      hasPendingApproval: false,
-      hasPendingUserInput: false,
-      threadError: null,
+  it("requires the next steer id after the previous steer was projected", () => {
+    const previousSteerMessageId = MessageId.make("message-steer");
+    const nextSteerMessageId = MessageId.make("message-next-steer");
+    const runningTurn = {
+      ...completedTurn,
+      state: "running" as const,
+      completedAt: null,
+    };
+    const runningSession = {
+      ...readySession,
+      status: "running" as const,
+      activeTurnId: runningTurn.turnId,
     };
+    const localDispatch = createLocalDispatchSnapshot(
+      makeThread({
+        messages: [
+          {
+            id: previousSteerMessageId,
+            role: "user",
+            text: "steer",
+            turnId: runningTurn.turnId,
+            streaming: false,
+            createdAt: now,
+            updatedAt: now,
+          },
+        ],
+        latestTurn: runningTurn,
+        session: runningSession,
+      }),
+      { expectedUserMessageId: nextSteerMessageId },
+    );
 
-    expect(hasServerAcknowledgedLocalDispatch({ ...common, hasPendingApproval: true })).toBe(true);
-    expect(hasServerAcknowledgedLocalDispatch({ ...common, hasPendingUserInput: true })).toBe(true);
-    expect(hasServerAcknowledgedLocalDispatch({ ...common, threadError: "failed" })).toBe(true);
+    expect(
+      hasServerAcknowledgedLocalDispatch({
+        localDispatch,
+        phase: "running",
+        latestTurn: runningTurn,
+        session: runningSession,
+        projectedMessages: [
+          {
+            id: previousSteerMessageId,
+            role: "user",
+          },
+        ],
+        hasPendingApproval: false,
+        hasPendingUserInput: false,
+        threadError: null,
+      }),
+    ).toBe(false);
+
+    expect(
+      hasServerAcknowledgedLocalDispatch({
+        localDispatch,
+        phase: "running",
+        latestTurn: runningTurn,
+        session: runningSession,
+        projectedMessages: [
+          {
+            id: nextSteerMessageId,
+            role: "user",
+          },
+        ],
+        hasPendingApproval: false,
+        hasPendingUserInput: false,
+        threadError: null,
+      }),
+    ).toBe(true);
   });
 });
diff --git a/apps/web/src/components/ChatView.logic.ts b/apps/web/src/components/ChatView.logic.ts
index 99583f9143e..d1f01e3c6e9 100644
--- a/apps/web/src/components/ChatView.logic.ts
+++ b/apps/web/src/components/ChatView.logic.ts
@@ -1,6 +1,7 @@
 import {
   type EnvironmentId,
   isProviderDriverKind,
+  type MessageId,
   ProjectId,
   type ModelSelection,
   type ProviderDriverKind,
@@ -397,8 +398,8 @@ export async function waitForStartedServerThread(
 export interface LocalDispatchSnapshot {
   startedAt: string;
   preparingWorktree: boolean;
-  latestUserMessageId: ChatMessage["id"] | null;
-  latestTurnTurnId: TurnId | null;
+  expectedUserMessageId: MessageId | null;
+  latestTurnId: TurnId | null;
   latestTurnRequestedAt: string | null;
   latestTurnStartedAt: string | null;
   latestTurnCompletedAt: string | null;
@@ -408,16 +409,15 @@ export interface LocalDispatchSnapshot {
 
 export function createLocalDispatchSnapshot(
   activeThread: Thread | undefined,
-  options?: { preparingWorktree?: boolean },
+  options?: { preparingWorktree?: boolean; expectedUserMessageId?: MessageId },
 ): LocalDispatchSnapshot {
   const latestTurn = activeThread?.latestTurn ?? null;
   const session = activeThread?.session ?? null;
-  const latestUserMessage = activeThread?.messages.findLast((message) => message.role === "user");
   return {
     startedAt: new Date().toISOString(),
     preparingWorktree: Boolean(options?.preparingWorktree),
-    latestUserMessageId: latestUserMessage?.id ?? null,
-    latestTurnTurnId: latestTurn?.turnId ?? null,
+    expectedUserMessageId: options?.expectedUserMessageId ?? null,
+    latestTurnId: latestTurn?.turnId ?? null,
     latestTurnRequestedAt: latestTurn?.requestedAt ?? null,
     latestTurnStartedAt: latestTurn?.startedAt ?? null,
     latestTurnCompletedAt: latestTurn?.completedAt ?? null,
@@ -430,8 +430,8 @@ export function hasServerAcknowledgedLocalDispatch(input: {
   localDispatch: LocalDispatchSnapshot | null;
   phase: SessionPhase;
   latestTurn: Thread["latestTurn"] | null;
-  latestUserMessageId: ChatMessage["id"] | null;
   session: Thread["session"] | null;
+  projectedMessages: ReadonlyArray<Pick<ChatMessage, "id" | "role">>;
   hasPendingApproval: boolean;
   hasPendingUserInput: boolean;
   threadError: string | null | undefined;
@@ -443,24 +443,29 @@ export function hasServerAcknowledgedLocalDispatch(input: {
     return true;
   }
 
+  // A prompt sent while a turn is already running is a steer. Providers can
+  // apply that prompt to the existing turn without opening a new one, so the
+  // latest turn/session fields may remain unchanged until the agent finishes.
+  // The projected user message is the server acknowledgement in that case.
+  const expectedUserMessageId = input.localDispatch.expectedUserMessageId;
+  if (input.localDispatch.sessionStatus === "running" && expectedUserMessageId !== null) {
+    for (let index = input.projectedMessages.length - 1; index >= 0; index -= 1) {
+      const message = input.projectedMessages[index];
+      if (message?.role === "user" && message.id === expectedUserMessageId) {
+        return true;
+      }
+    }
+  }
+
   const latestTurn = input.latestTurn ?? null;
   const session = input.session ?? null;
-  const latestUserMessageChanged =
-    input.localDispatch.latestUserMessageId !== input.latestUserMessageId;
   const latestTurnChanged =
-    input.localDispatch.latestTurnTurnId !== (latestTurn?.turnId ?? null) ||
+    input.localDispatch.latestTurnId !== (latestTurn?.turnId ?? null) ||
     input.localDispatch.latestTurnRequestedAt !== (latestTurn?.requestedAt ?? null) ||
     input.localDispatch.latestTurnStartedAt !== (latestTurn?.startedAt ?? null) ||
     input.localDispatch.latestTurnCompletedAt !== (latestTurn?.completedAt ?? null);
 
   if (input.phase === "running") {
-    // Steering adds a user message to the current running turn without
-    // necessarily changing any of the turn timestamps. Treat that projected
-    // message as the server acknowledgment so the composer does not remain
-    // stuck in its local "Sending" state until the turn settles.
-    if (latestUserMessageChanged) {
-      return true;
-    }
     if (!latestTurnChanged) {
       return false;
     }
diff --git a/apps/web/src/components/ChatView.tsx b/apps/web/src/components/ChatView.tsx
index 57af7216a54..7f8161f357f 100644
--- a/apps/web/src/components/ChatView.tsx
+++ b/apps/web/src/components/ChatView.tsx
@@ -460,8 +460,6 @@ function useLocalDispatchState(input: {
   threadError: string | null | undefined;
 }) {
   const [localDispatch, setLocalDispatch] = useState<LocalDispatchSnapshot | null>(null);
-  const latestUserMessageId =
-    input.activeThread?.messages.findLast((message) => message.role === "user")?.id ?? null;
 
   const resetLocalDispatch = useCallback(() => {
     setLocalDispatch(null);
@@ -473,8 +471,8 @@ function useLocalDispatchState(input: {
         localDispatch,
         phase: input.phase,
         latestTurn: input.activeLatestTurn,
-        latestUserMessageId,
         session: input.activeThread?.session ?? null,
+        projectedMessages: input.activeThread?.messages ?? [],
         hasPendingApproval: input.activePendingApproval !== null,
         hasPendingUserInput: input.activePendingUserInput !== null,
         threadError: input.threadError,
@@ -483,16 +481,16 @@ function useLocalDispatchState(input: {
       input.activeLatestTurn,
       input.activePendingApproval,
       input.activePendingUserInput,
+      input.activeThread?.messages,
       input.activeThread?.session,
       input.phase,
       input.threadError,
-      latestUserMessageId,
       localDispatch,
     ],
   );
   const activeLocalDispatch = serverAcknowledgedLocalDispatch ? null : localDispatch;
   const beginLocalDispatch = useCallback(
-    (options?: { preparingWorktree?: boolean }) => {
+    (options?: { preparingWorktree?: boolean; expectedUserMessageId?: MessageId }) => {
       const preparingWorktree = Boolean(options?.preparingWorktree);
       setLocalDispatch((current) => {
         const active = serverAcknowledgedLocalDispatch ? null : current;
@@ -4345,8 +4343,6 @@ function ChatViewContent(props: ChatViewProps) {
       void dockTransition.catch(() => resolveDockStarted?.());
       await dockStarted;
     }
-    beginLocalDispatch({ preparingWorktree: Boolean(baseBranchForWorktree) });
-
     const composerImagesSnapshot = [...composerImages];
     const composerTerminalContextsSnapshot = [...sendableComposerTerminalContexts];
     const composerElementContextsSnapshot = [...composerElementContexts];
@@ -4365,6 +4361,10 @@ function ChatViewContent(props: ChatViewProps) {
       composerReviewCommentsSnapshot,
     );
     const messageIdForSend = newMessageId();
+    beginLocalDispatch({
+      preparingWorktree: Boolean(baseBranchForWorktree),
+      expectedUserMessageId: messageIdForSend,
+    });
     const messageCreatedAt = new Date().toISOString();
     const outgoingMessageText = formatOutgoingPrompt({
       provider: ctxSelectedProvider,
@@ -4527,7 +4527,7 @@ function ChatViewContent(props: ChatViewProps) {
                 : {}),
             }
           : undefined;
-      beginLocalDispatch({ preparingWorktree: false });
+      beginLocalDispatch({ preparingWorktree: false, expectedUserMessageId: messageIdForSend });
       const startResult = await startThreadTurn({
         environmentId,
         input: {
@@ -4830,7 +4830,7 @@ function ChatViewContent(props: ChatViewProps) {
       });
 
       sendInFlightRef.current = true;
-      beginLocalDispatch({ preparingWorktree: false });
+      beginLocalDispatch({ preparingWorktree: false, expectedUserMessageId: messageIdForSend });
       setThreadError(threadIdForSend, null);
 
       // Position this sent row once LegendList has measured the anchored tail.
diff --git a/apps/web/src/components/CommandPalette.logic.test.ts b/apps/web/src/components/CommandPalette.logic.test.ts
index ef45195ffd3..e575353ea05 100644
--- a/apps/web/src/components/CommandPalette.logic.test.ts
+++ b/apps/web/src/components/CommandPalette.logic.test.ts
@@ -4,6 +4,7 @@ import type { Thread } from "../types";
 import {
   buildThreadActionItems,
   filterCommandPaletteGroups,
+  getDefaultCloneRemoteUrl,
   reduceCommandPaletteUiState,
   type CommandPaletteGroup,
 } from "./CommandPalette.logic";
@@ -11,6 +12,14 @@ import {
 const LOCAL_ENVIRONMENT_ID = EnvironmentId.make("environment-local");
 const PROJECT_ID = ProjectId.make("project-1");
 
+it("uses HTTPS for automatic repository clones", () => {
+  expect(
+    getDefaultCloneRemoteUrl({
+      url: "https://github.com/octocat/t3code",
+    }),
+  ).toBe("https://github.com/octocat/t3code");
+});
+
 describe("reduceCommandPaletteUiState", () => {
   const closedState = { open: false, mode: "command", openIntent: null } as const;
 
diff --git a/apps/web/src/components/CommandPalette.logic.ts b/apps/web/src/components/CommandPalette.logic.ts
index e80e3580327..a755e62aed3 100644
--- a/apps/web/src/components/CommandPalette.logic.ts
+++ b/apps/web/src/components/CommandPalette.logic.ts
@@ -1,4 +1,8 @@
-import { type KeybindingCommand, type FilesystemBrowseEntry } from "@t3tools/contracts";
+import {
+  type FilesystemBrowseEntry,
+  type KeybindingCommand,
+  type SourceControlRepositoryInfo,
+} from "@t3tools/contracts";
 import type { SidebarThreadSortOrder } from "@t3tools/contracts/settings";
 import * as Arr from "effect/Array";
 import * as Result from "effect/Result";
@@ -97,6 +101,12 @@ export interface CommandPaletteView {
 
 export type CommandPaletteMode = "root" | "root-browse" | "submenu" | "submenu-browse";
 
+export function getDefaultCloneRemoteUrl(
+  repository: Pick<SourceControlRepositoryInfo, "url">,
+): string {
+  return repository.url;
+}
+
 export function filterBrowseEntries(input: {
   browseEntries: ReadonlyArray<FilesystemBrowseEntry>;
   browseFilterQuery: string;
diff --git a/apps/web/src/components/CommandPalette.tsx b/apps/web/src/components/CommandPalette.tsx
index 72d955e65c6..98dd14fb68b 100644
--- a/apps/web/src/components/CommandPalette.tsx
+++ b/apps/web/src/components/CommandPalette.tsx
@@ -106,6 +106,7 @@ import {
   filterBrowseEntries,
   filterCommandPaletteGroups,
   getCommandPaletteInputPlaceholder,
+  getDefaultCloneRemoteUrl,
   getCommandPaletteMode,
   ITEM_ICON_CLASS,
   RECENT_THREAD_LIMIT,
@@ -1298,7 +1299,7 @@ function OpenCommandPaletteDialog(props: {
         source: addProjectCloneFlow.source,
         repositoryInput: rawRepository,
         repository,
-        remoteUrl: repository.sshUrl,
+        remoteUrl: getDefaultCloneRemoteUrl(repository),
       });
       setHighlightedItemValue(null);
       setQuery(destinationPath);
diff --git a/apps/web/src/components/DiffPanel.tsx b/apps/web/src/components/DiffPanel.tsx
index 6b0ea387cbb..1fe5473f89f 100644
--- a/apps/web/src/components/DiffPanel.tsx
+++ b/apps/web/src/components/DiffPanel.tsx
@@ -27,6 +27,7 @@ import { selectThreadDiffPanelSelection, useDiffPanelStore } from "../diffPanelS
 import { useTheme } from "../hooks/useTheme";
 import {
   buildFileDiffRenderKey,
+  canRenderFileDiff,
   getDiffCollapseIconClassName,
   getRenderablePatch,
   resolveDiffThemeName,
@@ -433,22 +434,33 @@ export default function DiffPanel({
     if (!renderablePatch || renderablePatch.kind !== "files") {
       return [];
     }
-    return renderablePatch.files.toSorted((left, right) =>
-      resolveFileDiffPath(left).localeCompare(resolveFileDiffPath(right), undefined, {
-        numeric: true,
-        sensitivity: "base",
-      }),
-    );
+    return renderablePatch.files
+      .map((fileDiff) => ({
+        canRender: canRenderFileDiff(fileDiff),
+        fileDiff,
+        filePath: resolveFileDiffPath(fileDiff),
+      }))
+      .toSorted((left, right) => {
+        const renderOrder = Number(!left.canRender) - Number(!right.canRender);
+        return (
+          renderOrder ||
+          left.filePath.localeCompare(right.filePath, undefined, {
+            numeric: true,
+            sensitivity: "base",
+          })
+        );
+      });
   }, [renderablePatch]);
   const codeViewFiles = useMemo(
     () =>
-      renderableFiles.map((fileDiff) => {
+      renderableFiles.map(({ canRender, fileDiff, filePath }) => {
         const fileKey = buildFileDiffRenderKey(fileDiff);
         return {
+          canRender,
           fileDiff,
-          filePath: resolveFileDiffPath(fileDiff),
+          filePath,
           fileKey,
-          collapsed: collapsedDiffFileKeys.has(fileKey),
+          collapsed: !canRender || collapsedDiffFileKeys.has(fileKey),
         };
       }),
     [collapsedDiffFileKeys, renderableFiles],
@@ -829,7 +841,7 @@ export default function DiffPanel({
                   sectionId={reviewSectionId}
                   sectionTitle={reviewSectionTitle}
                   composerDraftTarget={composerDraftTarget}
-                  renderHeaderPrefix={(fileDiff, fileKey, collapsed) => {
+                  renderHeaderPrefix={(fileDiff, fileKey, collapsed, canRender) => {
                     const filePath = resolveFileDiffPath(fileDiff);
                     return (
                       <Tooltip>
@@ -838,13 +850,18 @@ export default function DiffPanel({
                             <button
                               type="button"
                               className={cn(
-                                "inline-flex size-5 shrink-0 cursor-pointer items-center justify-center rounded-sm border-0 bg-transparent p-0 transition-colors hover:bg-foreground/10 focus-visible:outline-hidden",
+                                "inline-flex size-5 shrink-0 items-center justify-center rounded-sm border-0 bg-transparent p-0 transition-colors focus-visible:outline-hidden",
+                                canRender
+                                  ? "cursor-pointer hover:bg-foreground/10"
+                                  : "cursor-not-allowed opacity-60",
                                 getDiffCollapseIconClassName(fileDiff),
                               )}
                               aria-label={collapsed ? `Expand ${filePath}` : `Collapse ${filePath}`}
                               aria-expanded={!collapsed}
+                              disabled={!canRender}
                               onClick={(event) => {
                                 event.stopPropagation();
+                                if (!canRender) return;
                                 toggleDiffFileCollapsed(fileKey);
                               }}
                             />
@@ -857,7 +874,11 @@ export default function DiffPanel({
                           )}
                         </TooltipTrigger>
                         <TooltipPopup side="top">
-                          {collapsed ? "Expand diff" : "Collapse diff"}
+                          {!canRender
+                            ? "This file is too large to display. Open it in your editor instead."
+                            : collapsed
+                              ? "Expand diff"
+                              : "Collapse diff"}
                         </TooltipPopup>
                       </Tooltip>
                     );
diff --git a/apps/web/src/components/DiffWorkerPoolProvider.tsx b/apps/web/src/components/DiffWorkerPoolProvider.tsx
index 3ec748c6bcb..ac0d93c9009 100644
--- a/apps/web/src/components/DiffWorkerPoolProvider.tsx
+++ b/apps/web/src/components/DiffWorkerPoolProvider.tsx
@@ -72,6 +72,9 @@ export function DiffWorkerPoolProvider({ children }: { children?: ReactNode }) {
         totalASTLRUCacheSize: 240,
       }}
       highlighterOptions={{
+        // Oniguruma avoids the runaway backtracking possible when TextMate grammars
+        // are translated to native JavaScript regular expressions.
+        preferredHighlighter: "shiki-wasm",
         theme: diffThemeName,
         tokenizeMaxLineLength: 1_000,
         useTokenTransformer: true,
diff --git a/apps/web/src/components/chat/MessagesTimeline.test.tsx b/apps/web/src/components/chat/MessagesTimeline.test.tsx
index c9668d49941..066b43e3a5a 100644
--- a/apps/web/src/components/chat/MessagesTimeline.test.tsx
+++ b/apps/web/src/components/chat/MessagesTimeline.test.tsx
@@ -434,6 +434,20 @@ describe("MessagesTimeline", () => {
     expect(markup).toContain('data-user-message-footer="true"');
   });
 
+  it("keeps completed assistant message actions visible without hover", async () => {
+    const { MessagesTimeline } = await import("./MessagesTimeline");
+    const markup = renderToStaticMarkup(
+      <MessagesTimeline
+        {...buildProps()}
+        timelineEntries={[buildAssistantTimelineEntry("A completed response ready to copy.")]}
+      />,
+    );
+
+    expect(markup).toContain('aria-label="Copy link"');
+    expect(markup).toContain('data-assistant-message-footer="persistent"');
+    expect(markup).not.toMatch(/data-assistant-message-footer="persistent"[^>]*opacity-0/);
+  });
+
   it("does not render collapse controls for short user messages", async () => {
     const { MessagesTimeline } = await import("./MessagesTimeline");
     const markup = renderToStaticMarkup(
diff --git a/apps/web/src/components/chat/MessagesTimeline.tsx b/apps/web/src/components/chat/MessagesTimeline.tsx
index 21ac4a3ab0c..cf9018df9d1 100644
--- a/apps/web/src/components/chat/MessagesTimeline.tsx
+++ b/apps/web/src/components/chat/MessagesTimeline.tsx
@@ -1115,7 +1115,10 @@ function AssistantTimelineRow({ row }: { row: Extract<TimelineRow, { kind: "mess
           onOpenTurnDiff={ctx.onOpenTurnDiff}
         />
         {row.showAssistantMeta ? (
-          <div className="mt-1.5 flex items-center gap-2 text-xs tabular-nums opacity-0 transition-opacity duration-200 focus-within:opacity-100 group-hover/assistant:opacity-100">
+          <div
+            className="mt-1.5 flex items-center gap-2 text-xs tabular-nums"
+            data-assistant-message-footer="persistent"
+          >
             <AssistantCopyButton row={row} />
             {!row.message.streaming && (
               <Tooltip>
diff --git a/apps/web/src/components/chat/ThreadErrorBanner.tsx b/apps/web/src/components/chat/ThreadErrorBanner.tsx
index 51bfb62667d..4583e34c2d0 100644
--- a/apps/web/src/components/chat/ThreadErrorBanner.tsx
+++ b/apps/web/src/components/chat/ThreadErrorBanner.tsx
@@ -1,4 +1,5 @@
 import { memo } from "react";
+import { extractProviderErrorMessage } from "@t3tools/shared/providerError";
 import { Alert, AlertAction, AlertDescription } from "../ui/alert";
 import { Button } from "../ui/button";
 import { CircleAlertIcon, XIcon } from "lucide-react";
@@ -12,15 +13,20 @@ export const ThreadErrorBanner = memo(function ThreadErrorBanner({
   onDismiss?: () => void;
 }) {
   if (!error) return null;
+  // Errors persisted before the server started unwrapping provider payloads
+  // can still contain the raw JSON response body.
+  const message = extractProviderErrorMessage(error);
   return (
     <div className="mx-auto w-fit max-w-[min(48rem,calc(100%-2rem))] pt-3">
       <Alert variant="error">
         <CircleAlertIcon />
         <AlertDescription>
           <Tooltip>
-            <TooltipTrigger render={<div className="line-clamp-3" />}>{error}</TooltipTrigger>
-            <TooltipPopup side="top" className="max-w-96 whitespace-pre-wrap">
-              {error}
+            <TooltipTrigger render={<div className="line-clamp-3 break-words" />}>
+              {message}
+            </TooltipTrigger>
+            <TooltipPopup side="top" className="max-w-96 whitespace-pre-wrap break-words">
+              {message}
             </TooltipPopup>
           </Tooltip>
         </AlertDescription>
diff --git a/apps/web/src/components/diffs/AnnotatableCodeView.tsx b/apps/web/src/components/diffs/AnnotatableCodeView.tsx
index 6cea64fb570..c2dbd49263d 100644
--- a/apps/web/src/components/diffs/AnnotatableCodeView.tsx
+++ b/apps/web/src/components/diffs/AnnotatableCodeView.tsx
@@ -76,6 +76,7 @@ interface AnnotatableCodeViewProps {
     filePath: string;
     fileKey: string;
     collapsed: boolean;
+    canRender: boolean;
   }>;
   sectionId: string;
   sectionTitle: string;
@@ -87,6 +88,7 @@ interface AnnotatableCodeViewProps {
     fileDiff: FileDiffMetadata,
     fileKey: string,
     collapsed: boolean,
+    canRender: boolean,
   ) => ReactNode;
 }
 
@@ -245,7 +247,12 @@ export function AnnotatableCodeView({
       }}
       renderHeaderPrefix={(item) =>
         item.type === "diff"
-          ? renderHeaderPrefix(item.fileDiff, item.id, item.collapsed === true)
+          ? renderHeaderPrefix(
+              item.fileDiff,
+              item.id,
+              item.collapsed === true,
+              filesByKey.get(item.id)?.canRender !== false,
+            )
           : null
       }
       renderAnnotation={(annotation) => (
diff --git a/apps/web/src/lib/diffRendering.test.ts b/apps/web/src/lib/diffRendering.test.ts
index e75a893d6b3..ef931406ce4 100644
--- a/apps/web/src/lib/diffRendering.test.ts
+++ b/apps/web/src/lib/diffRendering.test.ts
@@ -1,5 +1,10 @@
 import { describe, expect, it } from "vite-plus/test";
-import { buildPatchCacheKey, getRenderablePatch } from "./diffRendering";
+import {
+  buildPatchCacheKey,
+  canRenderFileDiff,
+  getRenderablePatch,
+  MAX_RENDERABLE_DIFF_LINE_LENGTH,
+} from "./diffRendering";
 
 describe("buildPatchCacheKey", () => {
   it("returns a stable cache key for identical content", () => {
@@ -82,3 +87,23 @@ describe("getRenderablePatch", () => {
     expect(parsed.files[0]?.hunks[0]?.unifiedLineStart).toBe(47);
   });
 });
+
+describe("diff render line limits", () => {
+  it("rejects file diffs with pathological line lengths", () => {
+    expect(
+      canRenderFileDiff({
+        additionLines: ["small"],
+        deletionLines: ["x".repeat(MAX_RENDERABLE_DIFF_LINE_LENGTH + 1)],
+      }),
+    ).toBe(false);
+  });
+
+  it("allows file diffs within the line length limit", () => {
+    expect(
+      canRenderFileDiff({
+        additionLines: ["x".repeat(MAX_RENDERABLE_DIFF_LINE_LENGTH)],
+        deletionLines: ["small"],
+      }),
+    ).toBe(true);
+  });
+});
diff --git a/apps/web/src/lib/diffRendering.ts b/apps/web/src/lib/diffRendering.ts
index cb8318b3d2d..2556c729ff7 100644
--- a/apps/web/src/lib/diffRendering.ts
+++ b/apps/web/src/lib/diffRendering.ts
@@ -8,6 +8,8 @@ export const DIFF_THEME_NAMES = {
 
 export type DiffThemeName = (typeof DIFF_THEME_NAMES)[keyof typeof DIFF_THEME_NAMES];
 
+export const MAX_RENDERABLE_DIFF_LINE_LENGTH = 500_000;
+
 export function resolveDiffThemeName(theme: "light" | "dark"): DiffThemeName {
   return theme === "dark" ? DIFF_THEME_NAMES.dark : DIFF_THEME_NAMES.light;
 }
@@ -150,3 +152,12 @@ export function getDiffCollapseIconClassName(fileDiff: FileDiffMetadata): string
       return "text-muted-foreground/80";
   }
 }
+
+export function canRenderFileDiff(
+  fileDiff: Pick<FileDiffMetadata, "additionLines" | "deletionLines">,
+): boolean {
+  return (
+    fileDiff.additionLines.every((line) => line.length <= MAX_RENDERABLE_DIFF_LINE_LENGTH) &&
+    fileDiff.deletionLines.every((line) => line.length <= MAX_RENDERABLE_DIFF_LINE_LENGTH)
+  );
+}
diff --git a/apps/web/src/routes/__root.tsx b/apps/web/src/routes/__root.tsx
index c7eba628638..305b29d0b17 100644
--- a/apps/web/src/routes/__root.tsx
+++ b/apps/web/src/routes/__root.tsx
@@ -7,6 +7,7 @@ import {
   type ErrorComponentProps,
   useLocation,
   useNavigate,
+  useRouter,
 } from "@tanstack/react-router";
 import { useEffect, useEffectEvent, useRef, useState } from "react";
 import { play } from "cuelume";
@@ -273,6 +274,32 @@ function HostedStaticEnvironmentBootstrap() {
 function RootRouteErrorView({ error, reset }: ErrorComponentProps) {
   const message = errorMessage(error);
   const details = errorDetails(error);
+  const router = useRouter();
+  const retryingRef = useRef(false);
+
+  // A failed root beforeLoad probe leaves this boundary mounted even after the
+  // backend recovers. Retry only on recovery signals while this view is active.
+  useEffect(() => {
+    const retry = () => {
+      if (retryingRef.current) return;
+      retryingRef.current = true;
+      void router.invalidate().finally(() => {
+        retryingRef.current = false;
+      });
+    };
+    const retryIfVisible = () => {
+      if (document.visibilityState === "visible") retry();
+    };
+
+    document.addEventListener("visibilitychange", retryIfVisible);
+    window.addEventListener("focus", retry);
+    window.addEventListener("online", retry);
+    return () => {
+      document.removeEventListener("visibilitychange", retryIfVisible);
+      window.removeEventListener("focus", retry);
+      window.removeEventListener("online", retry);
+    };
+  }, [router]);
 
   return (
     <div className="relative flex min-h-screen items-center justify-center overflow-hidden bg-background px-4 py-10 text-foreground sm:px-6">
diff --git a/docs/upstream-integrations.md b/docs/upstream-integrations.md
index 11f1e7368b9..22a175f9a42 100644
--- a/docs/upstream-integrations.md
+++ b/docs/upstream-integrations.md
@@ -1,14 +1,48 @@
-# Upstream PRs
+# Upstream PR Integrations
+
+This inventory tracks open-upstream changes carried by the personal fork ahead of
+`upstream/main`. Correctness fixes, performance work, recovery behavior, security hardening, and
+narrow quality-of-life improvements are intentionally not feature-flagged. When an upstream PR
+merges, compare its final implementation during the next sync and remove the entry once no
+fork-only delta remains.
+
+## Reliability and quality batch
+
+| Upstream PR                                            | Area                          | Behavior carried by the fork                                                                                                                                                                                                                      | Integration notes                                                                                                                                                |
+| ------------------------------------------------------ | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [#4136](https://github.com/pingdotgg/t3code/pull/4136) | Shared settings correctness   | `deepMerge` recurses only through plain objects, preserving `Date`, `Map`, arrays, functions, and class instances as whole values. Invalid primitive top-level patches fail explicitly.                                                           | Includes upstream normal and edge-case regression suites.                                                                                                        |
+| [#4009](https://github.com/pingdotgg/t3code/pull/4009) | Streaming performance         | Streaming assistant deltas update messages and thread timestamps without rescanning full thread activity to rebuild shell summaries on every token batch.                                                                                         | Already landed through fork PR #15. Final non-streaming events retain the normal shell-summary refresh path.                                                     |
+| [#3903](https://github.com/pingdotgg/t3code/pull/3903) | Codex steering and stop       | Consecutive in-turn steering is acknowledged by the exact projected user-message ID. Root Stop resolves the live Codex turn with a bounded `thread/read` before falling back to projected state.                                                  | Selective code/test backport. `BRANCH_DETAILS.md`, workspace configuration, and lockfile changes were excluded. Explicit child-turn interruption remains direct. |
+| [#4187](https://github.com/pingdotgg/t3code/pull/4187) | Idle Git/preview performance  | Git ref polling revalidates the first page less frequently, cursor pages are generation-scoped, inactive atoms expire sooner, ref menus refresh on interaction, and preview port discovery uses serialized snapshot replay with adaptive polling. | Already landed through fork PR #15; this batch adds explicit cursor-page regression coverage. `BRANCH_DETAILS.md` was excluded.                                  |
+| [#3830](https://github.com/pingdotgg/t3code/pull/3830) | Codex error quality           | JSON and double-encoded provider error bodies are reduced to their readable message for runtime and session display while raw payload detail remains available for diagnostics.                                                                   | The web banner also normalizes previously persisted errors and wraps long tokens.                                                                                |
+| [#2338](https://github.com/pingdotgg/t3code/pull/2338) | Diff renderer safety          | Files containing a diff line over 500,000 characters are sorted after renderable files and forced closed so pathological generated or minified content cannot lock the UI.                                                                        | Adapted to the current `AnnotatableCodeView`: the collapse control is disabled with an explanation, while the file header can still open the file in the editor. |
+| [#3885](https://github.com/pingdotgg/t3code/pull/3885) | Diff highlighting performance | Web and desktop diff workers use Shiki's Oniguruma WASM engine instead of the JavaScript-regex engine, avoiding pathological backtracking.                                                                                                        | Electron's renderer CSP allows only the narrow `wasm-unsafe-eval` capability required for WebAssembly compilation.                                               |
+| [#4213](https://github.com/pingdotgg/t3code/pull/4213) | Desktop reliability           | Closed stdout or stderr pipes no longer trigger Electron crash dialogs.                                                                                                                                                                           | Only `EPIPE` is swallowed; all other stream errors continue to surface.                                                                                          |
+| [#4205](https://github.com/pingdotgg/t3code/pull/4205) | Repository cloning            | Automatic Create & Clone flows prefer HTTPS, allowing GitHub CLI credential-helper authentication without requiring an SSH key.                                                                                                                   | Explicitly requested SSH clones remain unchanged.                                                                                                                |
+| [#3520](https://github.com/pingdotgg/t3code/pull/3520) | Startup recovery              | A root startup error automatically retries when the app becomes visible, focused, or online, allowing a recovered backend to unstick the UI without a reload.                                                                                     | Retry state is transient and guards against concurrent invalidations; listeners exist only while the error view is mounted.                                      |
+| [#4107](https://github.com/pingdotgg/t3code/pull/4107) | Message actions               | Completed assistant-message copy and link actions remain visible without requiring hover.                                                                                                                                                         | Streaming assistant actions retain their existing hover treatment.                                                                                               |
+
+## Earlier integrations
 
 - [#4018](https://github.com/pingdotgg/t3code/pull/4018) — Loads older conversation history on
-  demand. This reduces memory use and reconnect payloads for long-running remote threads.
-- [#4176](https://github.com/pingdotgg/t3code/pull/4176) — Caps orchestration state. It also cleans
-  up browser, preview, VCS, and UI state when threads are deleted.
-- [#4187](https://github.com/pingdotgg/t3code/pull/4187) — Reduces idle Git and port-scanning work.
-  Relevant user actions and terminal changes still refresh immediately.
+  demand, reducing memory use and reconnect payloads for long-running remote threads.
+- [#4176](https://github.com/pingdotgg/t3code/pull/4176) — Caps orchestration state and cleans up
+  browser, preview, VCS, and UI state when threads are deleted.
 - [#4199](https://github.com/pingdotgg/t3code/pull/4199) — Keeps Codex sessions alive while
-  background agents are still producing events. This prevents active remote work from being reaped.
-- [#4009](https://github.com/pingdotgg/t3code/pull/4009) — Avoids rebuilding thread summaries for
-  every streaming delta. This reduces server work during long Codex responses.
-- [#3166](https://github.com/pingdotgg/t3code/pull/3166) — Caches successful Git top-level lookups.
-  Reconnect event replay no longer spawns the same Git process for every event.
+  background agents are still producing events, preventing active remote work from being reaped.
+- [#3166](https://github.com/pingdotgg/t3code/pull/3166) — Caches successful Git top-level lookups
+  so reconnect event replay does not spawn the same Git process for every event.
+
+## Verification expectations
+
+- Run each PR's focused regression tests after conflict resolution or upstream synchronization.
+- Run `vp check`, `vp run typecheck`, and the complete `vp test` suite for a combined backport batch.
+- Verify Codex steering and Stop, branch and diff refresh, oversized-diff fallback, readable
+  provider errors, automatic HTTPS clone selection, and persistent completed-message actions in
+  the web app.
+- Keep fork-aware PR and ref behavior covered with `enableForkPullRequests` both on and off.
+- Verify the WASM diff worker and `EPIPE` handling in a packaged-desktop-capable environment when
+  desktop bootstrap, Electron protocol policy, or packaging dependencies change.
+- During upstream merges, compare the final upstream implementation instead of blindly retaining
+  the fork patch; preserve local adaptations only where the fork's newer architecture requires
+  them.
diff --git a/packages/client-runtime/src/state/vcs.test.ts b/packages/client-runtime/src/state/vcs.test.ts
index 60a128a5a75..b7dc9741305 100644
--- a/packages/client-runtime/src/state/vcs.test.ts
+++ b/packages/client-runtime/src/state/vcs.test.ts
@@ -155,13 +155,13 @@ describe("cached VCS refs", () => {
         }
         expect(yield* Ref.get(calls)).toBe(1);
 
-        yield* TestClock.adjust("5 seconds");
+        yield* TestClock.adjust("20 seconds");
         expect(Option.getOrThrow(yield* Fiber.join(fiber))).toEqual(LIVE_REFS);
       }).pipe(Effect.provide(TestClock.layer())),
     ),
   );
 
-  it.effect("revalidates connected refs every five seconds", () =>
+  it.effect("revalidates connected first-page refs every twenty seconds", () =>
     Effect.scoped(
       Effect.gen(function* () {
         const calls = yield* Ref.make(0);
@@ -193,12 +193,43 @@ describe("cached VCS refs", () => {
         }
         expect(yield* Ref.get(calls)).toBe(1);
 
-        yield* TestClock.adjust("5 seconds");
+        yield* TestClock.adjust("20 seconds");
         expect(Array.from(yield* Fiber.join(fiber))).toEqual([CACHED_REFS, LIVE_REFS]);
       }).pipe(Effect.provide(TestClock.layer())),
     ),
   );
 
+  it.effect("loads cursor pages once per connected generation", () =>
+    Effect.scoped(
+      Effect.gen(function* () {
+        const calls = yield* Ref.make(0);
+        const client = {
+          [WS_METHODS.vcsListRefs]: () =>
+            Ref.update(calls, (count) => count + 1).pipe(Effect.as(LIVE_REFS)),
+        } as unknown as WsRpcProtocolClient;
+        const supervisor = EnvironmentSupervisor.EnvironmentSupervisor.of({
+          target: TARGET,
+          state: yield* SubscriptionRef.make(CONNECTED_CONNECTION_STATE),
+          session: yield* SubscriptionRef.make(Option.some(session(client))),
+          prepared: yield* SubscriptionRef.make(Option.none<PreparedConnection>()),
+          connect: Effect.void,
+          disconnect: Effect.void,
+          retryNow: Effect.void,
+        } satisfies EnvironmentSupervisor.EnvironmentSupervisor["Service"]);
+
+        const refs = yield* Stream.unwrap(
+          makeCachedVcsRefsChanges({ cwd: "/repo", cursor: 100, limit: 100 }).pipe(
+            Effect.provideService(EnvironmentSupervisor.EnvironmentSupervisor, supervisor),
+            Effect.provideService(Persistence.EnvironmentCacheStore, cacheWithRefs(Option.none())),
+          ),
+        ).pipe(Stream.runHead);
+
+        expect(Option.getOrThrow(refs)).toEqual(LIVE_REFS);
+        expect(yield* Ref.get(calls)).toBe(1);
+      }),
+    ),
+  );
+
   it.effect("does not emit persisted refs before a live refresh", () =>
     Effect.scoped(
       Effect.gen(function* () {
diff --git a/packages/shared/package.json b/packages/shared/package.json
index 28fdc5668b0..bda58735df8 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -194,6 +194,10 @@
     "./httpReadiness": {
       "types": "./src/httpReadiness.ts",
       "import": "./src/httpReadiness.ts"
+    },
+    "./providerError": {
+      "types": "./src/providerError.ts",
+      "import": "./src/providerError.ts"
     }
   },
   "scripts": {
diff --git a/packages/shared/src/Struct.edgeCases.test.ts b/packages/shared/src/Struct.edgeCases.test.ts
new file mode 100644
index 00000000000..047f3628450
--- /dev/null
+++ b/packages/shared/src/Struct.edgeCases.test.ts
@@ -0,0 +1,72 @@
+import { describe, expect, it } from "vite-plus/test";
+
+import type { DeepPartial } from "./Struct.ts";
+import { deepMerge } from "./Struct.ts";
+
+// This suite pins the SURPRISING / LOSSY runtime contract of `deepMerge`.
+// It complements Struct.test.ts and must never assert behavior the function
+// does not have — only what it ACTUALLY does today, so regressions are caught.
+//
+// Key detail: `deepMerge` recurses only when BOTH sides are plain objects.
+// In effect v4 (the installed version), `Predicate.isObject` is
+// `typeof v === "object" && v !== null && !Array.isArray(v)`, so it returns
+// `true` for plain objects, `Date`, `Map`, and class instances, but `false`
+// for arrays, functions, `null`, `undefined`, and primitives.
+describe("deepMerge edge cases", () => {
+  it("overwrites arrays instead of concatenating them", () => {
+    // Intentional quirk documentation: arrays are NOT plain objects, so the
+    // recursion branch is skipped and the patch array is assigned directly
+    // (whole-value overwrite).
+    const base = { tags: ["a", "b"] };
+    const patch = { tags: ["c"] };
+    const result = deepMerge(base, patch);
+    expect(result).toEqual({ tags: ["c"] });
+    expect(Array.isArray(result.tags)).toBe(true);
+    expect(result.tags).toEqual(["c"]);
+  });
+
+  // KNOWN LIMITATION: deepMerge only skips `undefined` (value === undefined).
+  // JSON/null-able sources can silently overwrite with null. Consider changing
+  // the guard to value == null if skip-null is desired.
+  it("[LIMITATION] null is not skipped (only undefined is)", () => {
+    const base = { a: 1 };
+    const patch = { a: null } as unknown as DeepPartial<{ a: number }>;
+    const result = deepMerge(base, patch);
+    expect(result).toEqual({ a: null });
+    expect(result.a).toBe(null);
+  });
+
+  it("overwrites Date values whole, preserving the prototype (regression: deepMerge-date-prototype-loss)", () => {
+    // @effect-diagnostics-next-line globalDate:off
+    const base = { d: new Date(0) };
+    // @effect-diagnostics-next-line globalDate:off
+    const patch = { d: new Date(1000) };
+    const result = deepMerge(base, patch);
+    expect(result.d).toBeInstanceOf(Date);
+    expect((result.d as Date).getTime()).toBe(1000);
+  });
+
+  it("overwrites function values with the patch function", () => {
+    const base = { fn: () => 1 };
+    const second = () => 2;
+    const patch = { fn: second } as unknown as DeepPartial<{ fn: () => number }>;
+    const result = deepMerge(base, patch);
+    expect(result.fn).toBe(second);
+    expect(result.fn()).toBe(2);
+  });
+
+  it("skips nested undefined patch keys (recurses)", () => {
+    type Shape = { a: number; nested: { x: number; y: number } };
+    const base: Shape = { a: 1, nested: { x: 1, y: 2 } };
+    const withNestedUndefined = { y: undefined } as unknown as DeepPartial<Shape["nested"]>;
+    const patch = { nested: withNestedUndefined } as unknown as DeepPartial<Shape>;
+    const result = deepMerge(base, patch);
+    expect(result).toEqual({ a: 1, nested: { x: 1, y: 2 } });
+  });
+
+  it("throws on a primitive patch instead of discarding the base (regression: deepMerge-primitive-discards-base)", () => {
+    const base = { a: 1, b: 2 };
+    const patch = 5 as unknown as DeepPartial<{ a: number; b: number }>;
+    expect(() => deepMerge(base, patch)).toThrow();
+  });
+});
diff --git a/packages/shared/src/Struct.test.ts b/packages/shared/src/Struct.test.ts
new file mode 100644
index 00000000000..5cb4df58155
--- /dev/null
+++ b/packages/shared/src/Struct.test.ts
@@ -0,0 +1,61 @@
+import { describe, expect, it } from "vite-plus/test";
+
+import { deepMerge, type DeepPartial } from "./Struct.ts";
+
+describe("deepMerge", () => {
+  it("performs a shallow merge of two flat objects", () => {
+    const base = { a: 1, b: 2 };
+    const patch = { b: 3, c: 4 };
+    expect(deepMerge(base, patch)).toEqual({ a: 1, b: 3, c: 4 });
+  });
+
+  it("does not mutate the base object", () => {
+    const base = { a: 1, b: 2 };
+    const snapshot = { ...base };
+    deepMerge(base, { b: 9 });
+    expect(base).toEqual(snapshot);
+  });
+
+  it("recursively merges nested objects", () => {
+    const base = { user: { name: "alice", age: 30 }, active: true };
+    const patch = { user: { age: 31 } };
+    expect(deepMerge(base, patch)).toEqual({
+      user: { name: "alice", age: 31 },
+      active: true,
+    });
+    expect(base.user).toEqual({ name: "alice", age: 30 });
+  });
+
+  it("merges multiple patch objects in sequence", () => {
+    const base = { a: 1, nested: { x: 1, y: 2 } };
+    const merged = deepMerge(deepMerge(base, { a: 2 }), { nested: { y: 9 } });
+    expect(merged).toEqual({ a: 2, nested: { x: 1, y: 9 } });
+    expect(base.nested).toEqual({ x: 1, y: 2 });
+  });
+
+  it("skips keys with undefined values in the patch", () => {
+    const base = { a: 1, b: 2 };
+    const undefinedA: unknown = undefined;
+    const patch = { a: undefinedA, b: 5 } as DeepPartial<typeof base>;
+    expect(deepMerge(base, patch)).toEqual({ a: 1, b: 5 });
+  });
+
+  it("returns a shallow copy of the base (nested refs shared — known limitation)", () => {
+    const base = { a: 1, b: { c: 2 } };
+    const merged = deepMerge(base, {});
+    expect(merged).toEqual({ a: 1, b: { c: 2 } });
+    // DOCUMENTED LIMITATION (not ideal): deepMerge only shallow-copies the top
+    // level. Nested objects NOT touched by the patch keep the SAME reference as
+    // base, so mutating `merged.b` would mutate `base.b`. A future fix should
+    // deep-clone untouched nested objects. Do not "fix" this test by changing
+    // the assertion to `not.toBe` until that fix lands.
+    expect(merged).not.toBe(base);
+    expect(merged.b).toBe(base.b);
+  });
+
+  it("handles an empty base with a populated patch", () => {
+    const base = {} as Record<string, unknown>;
+    const patch = { a: 1, nested: { b: 2 } };
+    expect(deepMerge(base, patch)).toEqual({ a: 1, nested: { b: 2 } });
+  });
+});
diff --git a/packages/shared/src/Struct.ts b/packages/shared/src/Struct.ts
index f703bcabfaa..23057b8e0f2 100644
--- a/packages/shared/src/Struct.ts
+++ b/packages/shared/src/Struct.ts
@@ -6,8 +6,24 @@ export type DeepPartial<T> = T extends readonly (infer U)[]
     ? { [K in keyof T]?: DeepPartial<T[K]> }
     : T;
 
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return (
+    value !== null &&
+    typeof value === "object" &&
+    !Array.isArray(value) &&
+    Object.getPrototypeOf(value) === Object.prototype
+  );
+}
+
 export function deepMerge<T extends Record<string, unknown>>(current: T, patch: DeepPartial<T>): T {
-  if (!P.isObject(current) || !P.isObject(patch)) {
+  if (!P.isObject(current)) {
+    return patch as T;
+  }
+
+  if (!P.isObject(patch)) {
+    if (patch !== null) {
+      throw new Error(`deepMerge: patch must be a plain object, received ${typeof patch}`);
+    }
     return patch as T;
   }
 
@@ -16,7 +32,8 @@ export function deepMerge<T extends Record<string, unknown>>(current: T, patch:
     if (value === undefined) continue;
 
     const existing = next[key];
-    next[key] = P.isObject(existing) && P.isObject(value) ? deepMerge(existing, value) : value;
+    next[key] =
+      isPlainObject(existing) && isPlainObject(value) ? deepMerge(existing, value) : value;
   }
 
   return next as T;
diff --git a/packages/shared/src/providerError.test.ts b/packages/shared/src/providerError.test.ts
new file mode 100644
index 00000000000..24d258f0b65
--- /dev/null
+++ b/packages/shared/src/providerError.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vite-plus/test";
+
+import { extractProviderErrorMessage } from "./providerError.ts";
+
+describe("extractProviderErrorMessage", () => {
+  it("returns plain messages unchanged", () => {
+    expect(extractProviderErrorMessage("Something went wrong")).toBe("Something went wrong");
+  });
+
+  it("extracts the nested message from a codex/upstream error body", () => {
+    const raw =
+      '{"type":"error","status":400,"error":{"type":"invalid_request_error","message":"The \'gpt-5.3-codex\' model is not supported when using Codex with a ChatGPT account."}}';
+    expect(extractProviderErrorMessage(raw)).toBe(
+      "The 'gpt-5.3-codex' model is not supported when using Codex with a ChatGPT account.",
+    );
+  });
+
+  it("extracts a top-level message field", () => {
+    expect(extractProviderErrorMessage('{"message":"rate limited","code":429}')).toBe(
+      "rate limited",
+    );
+  });
+
+  it("unwraps double-encoded payloads", () => {
+    const inner = '{"error":{"message":"quota exceeded"}}';
+    const outer = JSON.stringify({ message: inner });
+    expect(extractProviderErrorMessage(outer)).toBe("quota exceeded");
+  });
+
+  it("returns invalid JSON unchanged", () => {
+    expect(extractProviderErrorMessage('{"type":"error", broken')).toBe('{"type":"error", broken');
+  });
+
+  it("returns JSON without a usable message unchanged", () => {
+    expect(extractProviderErrorMessage('{"status":500}')).toBe('{"status":500}');
+  });
+
+  it("ignores empty or whitespace-only message fields", () => {
+    expect(extractProviderErrorMessage('{"message":"  ","error":{"message":"real cause"}}')).toBe(
+      "real cause",
+    );
+  });
+
+  it("does not touch non-object JSON", () => {
+    expect(extractProviderErrorMessage('"just a string"')).toBe('"just a string"');
+    expect(extractProviderErrorMessage("[1,2,3]")).toBe("[1,2,3]");
+  });
+});
diff --git a/packages/shared/src/providerError.ts b/packages/shared/src/providerError.ts
new file mode 100644
index 00000000000..2bde4375149
--- /dev/null
+++ b/packages/shared/src/providerError.ts
@@ -0,0 +1,36 @@
+function readMessage(value: unknown): string | undefined {
+  if (typeof value !== "object" || value === null) {
+    return undefined;
+  }
+  const record = value as Record<string, unknown>;
+  if (typeof record.message === "string" && record.message.trim().length > 0) {
+    return record.message.trim();
+  }
+  // upstream errors often nest the useful part, e.g. {"type":"error","status":400,"error":{"message":...}}
+  return readMessage(record.error);
+}
+
+/**
+ * Providers sometimes surface the raw upstream error body as the error
+ * message string (e.g. `{"type":"error","status":400,"error":{"type":
+ * "invalid_request_error","message":"..."}}`). Pull out the human readable
+ * message when that happens; otherwise return the input unchanged.
+ */
+export function extractProviderErrorMessage(message: string): string {
+  const trimmed = message.trim();
+  if (!trimmed.startsWith("{") || !trimmed.endsWith("}")) {
+    return message;
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return message;
+  }
+  const extracted = readMessage(parsed);
+  if (extracted === undefined || extracted === trimmed) {
+    return message;
+  }
+  // handles double-encoded payloads; the inequality check above guarantees progress
+  return extractProviderErrorMessage(extracted);
+}