[pmwoz]

Pins the T3 contract from 09a54f0 to c6ca605. Three upstream commits:

• fix: secret cards show the agent's sign-in link as a button pingdotgg/t3code#33157: request_secret takes an optional url, a sign-in or setup page shown as a button on the secret card.
• fix(server): delegated Claude tasks report the model that ran pingdotgg/t3code#27753: delegate_task results and thread runs carry an optional executedModel, the model the provider reported running. It can differ from the requested model.
• fix(provider-core): agents ask for a sudo password through the private secret card pingdotgg/t3code#27748: the injected orchestration instructions now route a sudo password through request_secret with delivery: "file" and sudo -S -p '' <cmd> < "$file".

Three contract files changed: orchestrator/tools.ts, orchestratorMcp.ts, orchestrationInstructions.ts. The plugin is unchanged, so no version bump.

Breaks a mapping

None.

• No tool was renamed or removed. url and executedModel are optional additions.
• The Secrets item in skills/poteto-mode/references/t3-adapter.md already passes delivery: "file" and reads the path inside the command, which matches the new sudo instruction.
• Model check step 2 in the adapter compares the returned model with the target. model keeps its meaning, so the check still works.

Opportunities

• request_secret url: the Secrets and Automations items in skills/poteto-mode/references/t3-adapter.md could pass the page where the user gets the value, such as the GitHub webhook settings page or the Slack app page for benny's bot token, instead of putting the link in reason.
• executedModel: model check step 2 in skills/poteto-mode/references/t3-adapter.md could compare executedModel with the target model when it is not null, so a provider-side substitution shows in the reply.

Both are adopted in #73.

Irrelevant to the skills

1 change. The new sudo instruction applies only to make-bot-ui, which the adapter marks as having no counterpart under T3.

Checks

bun run check, bun test tools (39 pass), and bun run typecheck pass.