feat(providers): standardize ACP providers

[StiensWout]

Rebased onto v2 2b1139a6fd7d on September 10. Server, web, and mobile typechecks pass; focused tests and changed-file lint pass. Live provider/UI testing was not repeated. Both PRs still target v2 independently; Pi and ACP overlap in mobile model options and the add-provider wizard, so the second merge needs a follow-up rebase.

ACP Registry agents need a consistent path for installation, authentication, replay, MCP, and session management. This makes them first-class providers on orchestrator v2, rebased onto its latest published revision (2b1139a6fd7d).

• Uses the official Registry, exact-version package distributions, and checksum-aware managed binaries.
• Negotiates ACP v2 with v1 compatibility. Regenerated schema-v2.0.0-alpha.3 and schema-v1.21.0; both remain the newest official releases checked on September 8.
• Projects native history, plans, compaction, usage, diffs, terminals, models, and commands through the shared orchestration contracts. Adds URL authentication, logout, native session management, and MCP-over-ACP alongside stdio and HTTP.
• Preserves current native Grok/Antigravity model selection and legacy elicitation, runtime shutdown/cancellation, explicit provider refresh, live token usage, and the current settings and mobile layouts. Native slash commands remain intact when guidance is injected.
• Applies atomic provider mutations and secret rollback, client filesystem/terminal policy, and session replacement for checkpoint rollback.

Verification

Focused protocol, native-provider, ACP adapter, orchestration, Registry/MCP, CLI, settings, contracts, and client tests passed. The full ACP adapter suite passed. Server, web, mobile, contracts, client runtime, and effect-acp type checks passed. Changed-file lint and formatting passed; lint retains existing React warnings.

Schema generation completes from both official release assets and preserves shared definitions. Wire tests cover malformed known variants, future variants, v1 model selection, and legacy elicitation responses.

The captures below were made on the earlier PR revision. Browser and live authenticated-agent verification were not repeated for this rebase.

Live proof

Pi through generic ACP

Registry discovery, fresh global installation, provider and model selection, and a completed turn:

Google Antigravity through generic ACP

Registry discovery, managed binary installation, provider creation, live handshake, and the advertised Google authentication method:

Google credentials were deliberately removed from the isolated test host. The Antigravity proof ends at Log in with Google; it does not claim an authenticated model turn.

Full parity matrix, shipped P0/P1/P2 work, and remaining generic gaps

Limits

Mobile shows ACP identity and activity but does not yet expose the full installation/authentication/session-management flow. Provider-owned tools retain their own sandbox behavior, and checkpoint rollback replaces the native session because ACP has no portable conversation truncation operation.

Updated with GPT-6 through Codex in T3 Code. Earlier implementation and captures by GPT-5.6 Sol through Codex in T3 Code, with Claude Fable 5 review.

---

Note

High Risk
Touches provider install, authentication, MCP bridging, session lifecycle, and RPC authorization. Protocol and terminal API breaks can affect existing ACP adapters and secret handling.

Overview
Makes ACP Registry agents first-class providers on the generic orchestrator v2 path, instead of incomplete provider-specific ACP behavior.

Registry + install. Adds acpRegistry discovery, checksum-aware binary/cache install (npx/uvx), and WS RPCs for search, prepare, uninstall, auth, session import/delete, and upstream provider config. Discovery is read-scoped; provisioning is operate-scoped.

Protocol. Prefers ACP schema v2 with a v1 compat shim. Session config uses configId; prompts finish via state_update. Projects plans, structured diffs, compaction, terminals, usage, and native session delete. Checkpoint rollback restores the workspace and replaces the native ACP session.

MCP. Injects a fast-path t3 acp-mcp-bridge / acp-mcp-call so agents reach T3 tools over stdio without loading the full CLI, plus MCP-over-ACP and HTTP fallbacks.

Clients. Mobile/web show official Registry icons (CDN-allowlisted), provider identity, multi-file changes, and compaction status. Web/desktop get the Registry wizard and session/provider management; mobile install/auth still incomplete.

^{Reviewed by Cursor Bugbot for commit 7a346408dbaad9870ea37fcda434205e9099a62f. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add acpRegistry provider type and upgrade ACP protocol to v2 with v1 compat

• Introduces a full ACP Registry provider: a AcpRegistryCatalog service (search, prepare, inspect, resolve, uninstall managed binaries with checksum verification), a AcpRegistryRuntimeCoordinator for foreground/background probe coordination and URL auth, a new AcpRegistryDriver, and end-to-end web/mobile UI for adding, configuring, and managing registry agent instances
• Upgrades effect-acp to ACP protocol v2 while maintaining v1 backward compatibility via a new compat module and CompatAgentRpcs/CompatClientRpcs; renames auth to auth_login/auth_logout, replaces session/load with session/resume, adds MCP-over-ACP and provider management RPCs, and passes AcpRequestContext to all handlers
• Reworks AcpAdapterV2 to provision a per-session stdio MCP bridge, enforce client-boundary policy for fs/terminal operations, project richer content (plans, compaction, structured file changes, MCP tool calls, user/thought streams), support thread rollback with snapshot, and remove speculative idle-settle logic in favor of explicit finalization
• Standardizes existing ACP providers (Claude, Codex, Cursor, Grok, OpenCode) by declaring runtimePolicy.enforcement: "native", removing client-side model selection for Grok, and always reporting fallback models for Grok status
• Adds atomic provider-instance mutations (updateProviderInstance, withSettingsSnapshot) to ServerSettingsService with transactional secret writes and rollback; wires all new ACP Registry RPCs into the websocket layer with auth scopes
• Risk: AcpTerminal interface in packages/effect-acp/src/terminal.ts is replaced with a passive state model — effectful control methods are removed; any out-of-tree consumers of the old terminal API will break. session/set_model is removed from AcpSessionRuntime.Service and AcpClient. Grok text generation no longer attempts client-side model switching and uses the agent default model. The session/load protocol method is replaced by session/resume across the codebase.

^{Macroscope summarized 7a34640.}

Rebased onto v2 after Pi landed in #7211. The final rebase is content-equivalent to the combined head that passed CI. The audit fixed propagation of saved ACP item-identity versions during eager session activation adapted Pi to the runtime-policy capability contract, and connected MCP-over-ACP fetches to interruption signals. The mobile inspector expectation now includes the file operation label. The combined changed suites passed 1,203 tests, with the one rebase-related test failure corrected and passing in a focused 81-test rerun. Server, web, and mobile typechecks pass; CI passed on the final head. Macroscope could not complete its latest review because of the workspace cost limit; the code audit and all existing review threads were completed.

The maintainer explicitly waived browser verification for this merge. No new browser evidence was collected.

Follow-up preparation: GPT-6 via Codex.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 57784106-3b5c-4cf4-bd27-f360284722ad

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Reviewed the new/changed Effect services in this PR (AcpRegistryCatalog, AcpRegistryRuntimeCoordinator, the ACP Registry driver/probe, and their call sites). Four convention issues, all in ACP Registry code introduced here.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Two Effect service convention issues in the new ACP service code. Everything else (inline Context.Service interfaces, AcpRegistryCatalog["Service"] / AcpRegistryRuntimeCoordinator["Service"] references, removal of the makeAcpRegistryResolver alias, environment-acquired catalog/coordinator in the driver) matches the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Effect service conventions: two findings in the new ACP code. The earlier review round's items (standalone *Shape interfaces, the makeAcpRegistryResolver compatibility alias, and the detail-copies-cause.message wrapper in ws.ts) are resolved on this head.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR introduces a full ACP Registry integration and ACP v2 compatibility layer with new installation, authentication, session, MCP, terminal, filesystem, RPC, and rollback behavior, while also changing existing ACP defaults. Auth-sensitive files and new static-analysis suppressions are included, so the breadth and risk require human review.

Not approved because:

• Per-review cost limit exceeded (workspace setting). Approvability relies on correctness review in order to determine eligibility

^{Review your spending limits in Billing settings, or comment @macroscope-app review this PR to bypass the limit and review now. You can add or adjust custom eligibility rules. Learn more.}

[macroscopeapp]

Reviewed the ACP service/error changes against the Effect service conventions.

One new finding this round (duplicated private schema predicate in ws.ts). Two previously flagged violations are still present and unchanged, so I have not re-commented on them:

• apps/server/src/orchestration-v2/Adapters/AcpAdapterV2.ts:4667-4676 — single known tagged failure recovered with Effect.catch + manual _tag check and Effect.fail(error) re-raise; convention is Effect.catchTags({ AcpRequestError: ... }).
• apps/server/src/provider/Drivers/AcpRegistryDriver.ts:537 — wrapper detail is built from cause.message while cause is already preserved; use the stable phrase form used by the sibling drivers.

^{Posted via Macroscope — Effect Service Conventions}