sync: upstream a3a8cbd605..94401d01b9 (12 commits)

[Bl4ckBl1zZ]

Manual port of the 12 upstream commits between a3a8cbd605 and 94401d01b9. Every change was read and applied against the fork's architecture rather than merged; PATCH.md is updated in the same commit.

Ported as-is

• Codex 0.150 protocol refresh (f925d63942, 94401d01b9) — multi-agent event values (CollabAgentTool, CollabAgentToolCallStatus, SubAgentActivityKind) and the widened PlanType enum, plus CodexProvider's new subscription labels. packages/effect-codex-app-server has no fork divergence.
• Anonymous macOS preview downloads (33b650a5b3) — the split build/publish/cleanup jobs and the rolling desktop-preview release, on the fork's runners (macos-15, halifax-...) instead of Blacksmith.
• Grok usage transcripts (ead4ce52a1's usage half) — UsageService, usageTranscripts, usageScanCache, usageMerge, contracts/usage, and the web/mobile usage providers. No fork divergence in any of them.
• Android adaptive launcher foreground (348367dcc6) and the v0.0.35 version bump (d3c24a14b9).
• Test pruning (73f8cfc023, f6f2be32d8, 64ca3b650e) — 16 low-signal test files removed and the three symbols that were only exported for them un-exported.

Ported onto orchestration V2

Grok skills, plans, usage, and turn reliability (ead4ce52a1). Everything living in shared modules is carried: Grok skill discovery (provider/Drivers/GrokSkills.ts, wired through checkGrokProviderStatus, which now takes the server cwd), the reasoning-effort model descriptors in GrokProvider.ts, per-permission-mode spawn arguments (grokAcpSpawnArgs), the _meta-carrying session/set_model path, the plan-mode helpers, and rate-limit/error prompt settlement in XAiAcpExtension.ts.

Two V2 seams were added so those are actually reachable:

• AcpAdapterV2RuntimeInput now carries runtimeMode, so Grok spawns with the thread's permission mode (--permission-mode default|acceptEdits|auto, agent --always-approve). This is what makes the updated docs/user/permission-modes.md true on this fork.
• The ACP flavor gained applySessionModel and modelOptionIdsHandledBySessionModel. Grok's reasoningEffort rides session/set_model _meta, not session/set_config_option — without this, carrying the GrokProvider descriptor half alone would have made configureSession reject an option the Grok session never advertises, failing the session outright.

Projection bootstrap replay (a6797b3b97). The fork's V1 ProjectionPipeline survives for the project aggregate and had the same truncated-replay bug. The fix is carried; because the fork deleted ProjectionPipeline.test.ts with the V1 thread projectors, the backlog test is rehomed to ProjectionPipelineBootstrap.test.ts over project.created events alone. It fails without the fix.

Dropped (with reasons)

• The V1 GrokAdapter rewrite (the bulk of ead4ce52a1) — a turn/active-tool inactivity watchdog, the enter_plan_mode/exit_plan_mode proposed-plan gate, and selectGrokPermissionOptionId's allow_once fallback for "Always allow this session". All written against the retired V1 adapter's session-context and Queue liveness machinery; the fork's GrokAdapterV2 is a thin flavor over AcpAdapterV2. The plan and rate-limit helpers those needed are present in XAiAcpExtension.ts, and upstream's mock-agent hooks (T3_ACP_EMIT_*_THEN_HANG) are carried, so a later port has its harness. Flagged for human review — see below.
• Stale Codex approval callbacks (230c5d4a5c) — widens the V1 ProviderCommandReactor's error matcher. That reactor is on the fork's forbidden-import list; V2 answers approvals through RuntimeRequestService against CodexAdapterV2's in-process deferred map, so the stale-callback shape has no counterpart to match.
• Provider settings list/editor split (e2d4d12a81) — a master-detail redesign of ProviderSettingsPanel.tsx (which the fork retired in favour of inline EnvironmentProviderSettings) plus a mode: "list" | "editor" rewrite of ProviderInstanceCard. Two self-contained pieces are carried: the neutral disabled status dot (amber read as a warning on a provider the user turned off) and ProviderEnvironmentSection's draft re-sync.

For human review

The Grok plan-mode gate is the one user-visible gap. XAiAcpExtension.ts now exports XAiExitPlanModeRequest, extractXAiExitPlanMarkdown, makeXAiExitPlanModeCapturedResponse, isGrokPlanMarkdownPath, and extractGrokPlanMarkdownFromToolCallData, but GrokAdapterV2 registers no x.ai/exit_plan_mode handler, so Grok plan mode still surfaces as ordinary tool calls rather than a proposed-plan card. Wiring it needs a decision about how V2 models a plan-approval gate; that is a feature port, not a sync.

Verification

• vp run --filter t3 test — 336 files passed, 4 skipped; 3475 tests passed, 13 skipped. No failures, including the 4 the sync brief lists as baseline.
• apps/web, packages/shared, packages/client-runtime, packages/contracts test suites all pass.
• vp run -r typecheck clean across all 15 packages.
• vp lint --report-unused-disable-directives exits 0 (warnings only, none new).
• orchestration-v2/V1ImportBoundary.test.ts passes.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9540d2fa-cb6a-4004-b17a-9aba607ca7f2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}