[yordis]

• Claude home env: kept the fork's t3code.launched settings handling and took upstream's rule that a Claude launched from another Claude session drops that session's variables. Both tests stay.
• Relay tracing: kept the fork's service version and release attributes, and took upstream's gate that turns relay traces off when a managed policy sets telemetry: false.
• Settings load: legacy secret settings are migrated first, then upstream's managed-policy defaults are applied before decoding.
• Orchestrator: kept the fork's command ack metric and took upstream's runtime-mode ceiling for resuming queued runs.
• Provider event ingestor: took upstream's turn analytics service and dropped the fork's old AnalyticsService import, which nothing used any more.
• Provider hydration: kept the fork's provideMerge on the secret resolver and took upstream's host environment layer.
• Provider instance card: took upstream's managed-environment locks and kept the fork's environmentId on the environment section.
• One new upstream instanceEnvironment test now expects t3code.launched=true, because the fork marks every merged provider environment as launched (ledger 0031).

Not verified: infra/task-cache Cleanup.test.ts fails the same way on plain upstream/main. Some apps/server, apps/mobile, apps/desktop, packages/shared and source-control tests failed locally on git commits, a missing Electron install and a timezone string, and I did not compare them against a clean checkout. apps/web tests did not report a result locally. Typecheck passes across all packages.

[cursor]

PR Summary

Medium Risk
Broad desktop changes touch network binding, auth token timing, managed-policy fail-closed behavior, and new main-process media IPC, though heavily covered by new tests.

Overview
This sync brings upstream enterprise managed policy into the desktop: a cached DesktopManagedPolicy read drives local-only server exposure when remote clients are disallowed, update feed/channel restrictions, relay telemetry resolved at IPC install time (fail-closed on unreadable policy), and browser cookie import gates. DesktopUpdatePolicy wires those limits into the updater.

Shell environment no longer blocks startup on a full login-shell probe. Cached PATH/mise/Java/CA values apply immediately, background refresh streams patches over telemetry fd4, and the backend gets T3CODE_DESKTOP_SHELL_DISCOVERY_PENDING until discovery finishes. BackendManager moves instance state to SubscriptionRef and waitForReady waits on state changes instead of polling; local bearer token exchange waits for readiness too.

Startup and windows: bootstrap can ensureMain after WSL endpoint fallback; startup recovery stays available when a visible boot shell exists but the backend never reached Ready; DesktopWindow coordinates reveal with renderer paint vs backend readiness. Relaunch strips deep-link args so network-access relaunches do not replay app links. Web links activation goes through DesktopWindow.activate; new readMedia IPC fetches http(s) from the main session with a 256 MiB cap.

Preview/CDP: download behavior maps through Page.setDownloadBehavior and optional event forwarding; pointerLock is allowed; GuestInput fixes focus when overlapping pointer presses run on sibling webviews. Linux URL registration adds timeouts/force-kill for stuck xdg-mime/update-desktop-database.

CI/release: thread-transfer baseline lookup uses targeted workflow-run pages; pr-vouch skips non-/recheck-vouch comments; preview releases use .env.example instead of the production GitHub environment. Compile cache can use a prepared server cache under Electron-as-Node.

^{Reviewed by Cursor Bugbot for commit 3c1acee. Bugbot is set up for automated code reviews on this repo. Configure here.}