Fix the Fable review findings for the 32ecd71726 sync

apps/web/src/components/settings/ProviderInstanceCard.tsx

@@ -419,7 +419,11 @@ export function ProviderInstanceCard({
     compatibility.status !== "supported" &&
     compatibility.status !== "unknown";
   const VersionAdvisoryIcon = hasCompatibilityWarning ? AlertTriangleIcon : ArrowUpCircleIcon;
-  const onRunVersionAction = versionAdvisory?.targetVersion ? onInstallRecommended : onRunUpdate;
+  const onRunVersionAction = readOnly
+    ? undefined
+    : versionAdvisory?.targetVersion
+      ? onInstallRecommended
+      : onRunUpdate;
   const displayName =
     instance.displayName?.trim() || driverOption?.label || String(instance.driver);
   const accentColor = normalizeProviderAccentColor(instance.accentColor);

docs/internals/coder-only.md

@@ -599,8 +599,9 @@ listed here is drift to remove rather than fork behavior to keep.
     `ProviderInstanceRegistry.ts`, its test, `ProviderInstanceRegistryHydration.ts` (which
     also needs no `Crypto`), and `serverSettings.ts` import the stand-in; `ws.ts` does not
     advertise `secretReferences`. Web `settings/SecretSourceInput.tsx` and its browser test are
-    cut; `ProviderInstanceCard.tsx`'s environment field rows keep the plain value and
-    `SecretInput`, showing a stored secret reference as no value.
+    cut, and `ProviderSettingsPanel.tsx` reads no secret sources for `AddProviderInstanceDialog`;
+    `ProviderInstanceCard.tsx`'s environment field rows keep the plain value and `SecretInput`,
+    showing a stored secret reference as no value.
   - The thread dev-servers panel (#22542) is not carried: it lists and stops servers that
     upstream's preview `PortScanner` discovers, and the browser preview is not carried.
     `ClaudeAdapterV2.ts`'s query runner gives the CLI's jobs no agent-thread variable and counts
@@ -1210,7 +1211,7 @@ listed here is drift to remove rather than fork behavior to keep.
     `canonicalizeGitCafePullRequestUrl` is an identity function, since GitCafe is not carried. Diff output is capped
     (`DIFF_MAX_OUTPUT_BYTES`) to fit the gateway's `MAX_RPC_MESSAGE_BYTES` ceiling.
   - GitLab fixes for bugs still in upstream's `GitLabCli` (checked against upstream `main`
-    67661cfbb5):
+    32ecd71726):
     merge requests between projects post to the source project with a numeric
     `target_project_id` instead of sending the repository text as `source_project_id`; merge
     request URLs reach `glab` as `--repo <url> ... -- <iid>` because older versions read URLs as
@@ -1374,6 +1375,9 @@ listed here is drift to remove rather than fork behavior to keep.
     desktop-only `resolveDesktopTheme`; `localApiTypes.ts` keeps
     its context-menu and confirm-dialog types (web modules that import `ContextMenuItem` from
     `contracts` upstream import it from there), and `localApi.ts` opens only HTTP(S) links.
+    Since the fork's `Window` type has no `desktopBridge`, `ChatHeader.tsx`'s merge request
+    button tests `"desktopBridge" in window` and opens the browser at once, as upstream's web
+    build does.
     `ThreadNotificationCoordinator.tsx` focuses the tab on a notification click without
     upstream's desktop window reveal.
   - client-runtime `errors/diagnostics.ts` is the `[t3-error]` DevTools reporting described in

docs/internals/sync.md

@@ -186,6 +186,12 @@ mobile's `microphonePriority.ts` into `packages/shared`) arrives as an added fil
   `hooks/useStartTriage.ts`, `lib/triageTarget.ts`, `docs/user/triage.md`).
 - Relay (`apps/server/src/relay`, `infra`, `packages/ssh`, `packages/tailscale`); telemetry
   (`apps/server/src/{telemetry,resourceTelemetry,usage,diagnostics}`, web `components/usage`).
+- Secret providers (web `settings/SecretsSettings.tsx`, `SecretProviderDialog*`,
+  `SecretSourceInput*`, the server's `secrets/SecretResolver.ts` and `secretProviderDefinitions*`,
+  `packages/secret-provider-*`).
+- Local editors and provider setup (`process/externalLauncher*`, shared `editor.ts`, web
+  `CodexSetupSection.tsx`), and upstream tests for cut surfaces (`mcp/toolkits/core.test.ts`,
+  `apps/web/test/appScenarios.renders.tsx`, two settings browser tests).
 - Upstream repository tooling (`.github`, `.repos`, `oxlint-plugin-t3code`, `docs/operations`,
   `apps/server/integration`, `evals`, `.coderabbit.config.ts`) and upstream's CI-only checks
   (`AgentContextBudget.test.ts`, `verify-built-boot.ts`).
@@ -439,8 +445,13 @@ foreground command limit, so run it in the background and read its log. Known re
   alone:
   `pnpm exec vp test run --config vite.coder.config.ts apps/server/src/serverSettings.test.ts`.
 - On macOS, upstream's `ClaudeSkills.test.ts` "merges plugin enablement and selects installs in
-  native registry order" fails because `TMPDIR` sits under the `/var` symlink (758d773f57, #235). It
-  passes with a real-path temp directory: `TMPDIR=/private/tmp/<dir>`.
+  native registry order" fails because `TMPDIR` sits under the `/var` symlink (758d773f57, #235),
+  as does `GitVcsDriverCore.test.ts`'s "keeps generated worktree folders short without changing
+  long branch names" (32ecd71726). Both pass with a real-path temp directory:
+  `TMPDIR=/private/tmp/<dir>`.
+- Read the suite's own exit status from its log. A background run like
+  `pnpm test:coder > log; echo "exit=$?" >> log` reports success to the agent harness even when the
+  suite failed (32ecd71726's stage 2 did).
 - In a fresh worktree, the first web runs can fail in browser test files that load no tests
   ("There was an error when mocking a module") or time out, because Vite re-optimizes
   dependencies mid-run and reloads ("optimized dependencies changed. reloading"). Rerun

docs/user/source-control.md

@@ -47,9 +47,8 @@ list shows the newest 100 commits in the branch comparison. A merge commit shows
 its first parent.
 
 A commit link from GitLab opens in the Diff pane when the thread's repository has that commit
-locally, on any branch. Otherwise a merge request commit link opens the merge request. Other commit
-links follow your **Open links in** setting; when that opens a new tab, T3 Coder first shows an
-**Open link** button. Command/Ctrl+Click always opens the link in your browser. Commit links follow
+locally, on any branch. Otherwise T3 Coder shows an **Open link** button that opens the commit in
+your browser. Command/Ctrl+Click always opens the link in your browser. Commit links follow
 the **Open merge requests in T3 Coder** setting in **Settings → Diffs**.
 
 ## Automatic project pull

packages/client-runtime/package.json

@@ -246,6 +246,10 @@
       "types": "./src/t3ToolSummary.ts",
       "default": "./src/t3ToolSummary.ts"
     },
+    "./state/thread-history-merge": {
+      "types": "./src/state/threadHistoryMerge.ts",
+      "default": "./src/state/threadHistoryMerge.ts"
+    },
     "./state/orchestration-v2-projection": {
       "types": "./src/state/orchestrationV2Projection.ts",
       "default": "./src/state/orchestrationV2Projection.ts"