feat(auth): separate filesystem read and write permissions (#9788)

feat(auth): separate source control write permissions (#9787)

feat(auth): separate environment administration permissions (#9786)

fix(auth): preserve explicitly granted pairing scopes (#9785)

fix(pi): preserve provider identity in discovered models (#16661)

fix(web): preserve bare anchor placeholders in markdown (#16637)

fix(web): keep workspace options when expanding lineage (#16635)

fix(web): iPhone Duo fold controls follow the phone's orientation (#16630)

fix(server): recover a deleted tunnel when Cloudflare says "Tunnel not found" (#16648)

fix(relay): a host restarting onto a deleted tunnel gets a new one (#16649)

chore(deps): upgrade @pierre/diffs to 1.5.2 and @pierre/trees to beta.6 (#16644)

refactor(server): instrument WS RPCs in group middleware (#15548)

fix(web): show "No project" near the top of the new thread picker (#16628)

fix(server): provider sessions clean up when their start is interrupted (#15571)

feat(web): open right panel tab menu with Mod+T (#15686)

feat(web): add fast actions to linked pull requests (#16627)

feat(web): stop T3-owned subagents from Lineage (#15211)

feat(web): group keybindings settings by area with a page toolbar (#12822)

fix(vcs): passive sidebar rows stop retaining remote pollers (#15666)

fix(web): show attempted paths in file preview errors (#15628)

fix(web): open pull request row actions on right-click (#16612)

fix(contracts): a context record that cannot be encoded no longer fails the send (#16398)

fix(server): one failing RPC handler no longer ends the client's other requests (#15515)

fix(desktop): include Linux package license and app metadata (#16597)

chore(review): CodeRabbit gates outside contributors' pull requests (#16332)

chore(tsconfig): turn off the Schema-over-JSON diagnostic in test files (#16375)

feat(web): copy an environment's MCP URL for outside agents (#16337)

feat(server): outside agents sign in to the T3 MCP server with OAuth (#16336)

feat(server): every T3 MCP tool declares who may call it (#16335)

perf(web): diff panel no longer re-renders every file header each time a patch arrives (#16033)

feat(web): note anonymous usage data in onboarding and link the privacy policy (#16564)

docs(marketing): disclose product usage data in the privacy policy (#16562)

fix(desktop): honor the telemetry opt-out from the shell profile (#16563)

fix(web): diff panel keeps the chosen scope while a turn runs (#16571)

fix(server): Rebase stack moves each layer onto the rebased layer below it (#16551)

feat: choose the GitHub account per host, save a GitHub token, and fewer reads per PR action (#16322)

feat(server): source control, media and discovery use GitHub's API instead of gh (#16321)

feat(server): pull requests talk to GitHub's API instead of the gh CLI (#16320)

feat(server): GitHub API transport that uses gh only for the token (#16319)

fix(mobile): keep usage-limit notice opaque (#15602)

fix(desktop): build AppImage with the static runtime toolset (fixes libfuse2 launch failure) (#7765)

fix(web): stop wide ordered list markers from clipping (#16523)

feat(web): reopen closed tabs across the app (#15207)

fix(web): show subagent effort and speed in hover cards (#13056)

fix(web): Apple logo no longer dips below the device host label (#14825)

fix(orchestration-v2): show reported subagent models (#14108)

chore(deps): upgrade @effect/tsgo to 0.46.1 (#16360)

fix(mcp): preserve thread command rejection reasons (#15627)

fix(release): unblock nightly browser tests and cli builds (#16515)

fix(mcp): mark declared tool failures as errors (#15617)

fix: restore service references breaking ci (#16495)

feat(preview): run the browser on the environment server (#15328)

fix(server): OpenCode 2 threads get T3 Code's MCP tools (#16142)

fix(shared): find versioned JetBrains macOS app bundles (#16246)

fix(desktop): use the crypto service for screenshot IDs (#16415)

fix(server): reject invalid explicit Bitbucket repositories (#15876)

fix(web): queued messages no longer split the composer notice stack (#16400)

fix(server): end clone options before the repository URL (#14781)

fix(desktop): prevent browser screenshot filename collisions (#14784)

fix(web): type in front of bold that starts a composer line (#13217)

fix(release): resolve version-qualified catalog overrides (#16411)

fix(orchestration-v2): let Stop recover stalled runs (#15442)

fix(server): avoid scanning completed history for pending secrets (#16409)

fix(desktop): retry transient bearer bootstrap and degrade on session fetch failure (#12919)

fix(server): Pi thread titles use linked PR context (#16210)

fix(relay): export traces through one tracer, one request span each (#16382)

refactor: Effect code gets UUIDs and SHA-256 from Effect's Crypto (#16377)

fix(web): bring back the live shimmer on work log rows (#16372)

fix(relay): error and deadline responses carry CORS headers (#16253)

fix(observability): T3 Connect tracing stops at the relay boundary (#16314)

chore(lint): catch known tags with Effect.catchTags (#16361)

fix(server): main's settings, keybindings and session tests compile again (#16363)

fix(contracts): trimmed IDs round-trip (#16300)

refactor(web): import connection storage as a namespace in its test (#16315)

fix(server): metrics count interrupted work on the monotonic clock (#16207)

fix(shared): DrainableWorker keeps running after a failed item (#16223)

chore: keep one copy each of undici 8 and ws 8 (#16211)

fix(server): the PR cache sweep only removes real entry files (#16285)

fix(server): one-shot initializers no longer race (#16260)

fix(server): caches and ids are written atomically (#16242)

Add esthor to the list of GitHub users

fix(server): Claude limits load again for users with large transcript histories (#16358)

fix(server): project favicons stop being rescanned every minute (#16206)

fix(server): main's startup auto-pull test compiles again (#16357)

perf(shared): scan PATH once per command before spawning, not on every spawn (#12600)

fix(server): status polling no longer locks the git index (#14718)

fix(observability): a failing trace disk no longer stalls the server (#13758)

fix(server): probe project favicon candidates concurrently (#12543)

fix(server): return partial workspace index on timeout (#11500)

fix(web): avoid blocking image preparation conversions (#13342)

fix(server): stop the startup project sync from delaying the app window (#14912)

fix(server): forks no longer merge into their upstream repo's project group (#16353)

refactor(server): replay guards stay in CloudLink (#16349)

refactor(server): CloudLink fails with its own errors; the connect routes map them to HTTP (#16341)

refactor(server): CloudLink keeps only the link lifecycle; pure checks live beside it (#16340)

chore(review): turn off CodeRabbit's docstring coverage check (#16328)

chore(review): point CodeRabbit at the web UI conventions (#16324)

docs(relay): add the legacy tunnel cleanup rollout runbook (#13568)

feat(connect): tell users when an idle tunnel was removed (#13567)

perf(relay): delete expired tunnels four at a time within a time budget (#13566)