Add Droid SDK provider

[0xSero]

Intention

Add Droid as a first-class T3 Code provider using Factory's TypeScript SDK: https://github.com/Factory-AI/droid-sdk-typescript

This is still WIP while we validate more real Droid permission, file, MCP, auth, and long-running streaming flows.

What this adds

• Adds droid to the shared provider, model, settings, runtime source, and driver contracts.
• Registers a managed Droid provider driver plus inventory probe.
• Wraps createSession / resumeSession from @factory/droid-sdk in a T3 provider adapter.
• Supports Droid session start, resume, stop, interrupt, and in-session model / reasoning updates.
• Streams assistant text, reasoning text, tool progress/results, token usage, MCP/auth status, title updates, turn completion, and runtime errors into canonical T3 runtime events.
• Routes Droid permission callbacks through T3 approval requests.
• Routes Droid ask-user callbacks through the existing structured user-input flow.
• Sends supported image attachments (gif, jpeg, png, webp) as base64 SDK image sources resolved through the existing attachment store.
• Discovers SDK-reported Droid models from initResult.availableModels, including user/custom models, while preserving custom model ids so duplicate underlying models remain selectable.
• Adds Droid UI presence in Provider Settings and the model picker, including the provided icon.

Implementation shape

The Droid adapter has been split by responsibility instead of keeping one large file:

• DroidAdapter.ts: session lifecycle and adapter orchestration.
• provider/droid/DroidRuntimeEvents.ts: SDK message to T3 runtime event projection.
• provider/droid/DroidSdkMappings.ts: SDK model, access, reasoning, usage, approval, and user-input mappings.
• provider/droid/DroidAttachmentResolver.ts: attachment MIME validation and image loading.
• provider/droid/DroidAdapterTypes.ts: shared Droid adapter types.

Security / safety notes

• Droid remains disabled by default.
• No SDK secrets, pairing tokens, or provider auth payloads are intentionally logged.
• Permission requests are mediated through T3 approval events and default to cancellation on missing/stale sessions.
• Attachment paths are resolved through the existing attachment store helper; unsupported MIME types fail before SDK submission.
• The Droid binary path is configurable but defaults to droid; prompt content is sent through the SDK rather than shell interpolation.
• Model discovery uses a short-lived SDK session in a temp cwd and closes it immediately after reading init metadata.

Validation

• Real Droid CLI query: droid exec --model glm-5.1 --cwd /tmp ... returned droid-pong.
• Live SDK model discovery returned 67 models, including 38 user/custom models.
• Local T3 model picker showed custom Droid models such as HomeLab - GLM-5.1, HomeLab - Trinity-Large-Thinking, Direct - GPT-5.5-Fast-xHigh, and Direct - GPT-5.5-Low.
• Review comments addressed: missing-session reads now fail; Droid rollback now honors numTurns; streaming, thinking, access-mode mapping, and custom model discovery were updated.
• bun fmt passed.
• bun lint passed with existing unrelated web warnings.
• bun typecheck passed.
• Focused Droid tests passed: cd apps/server && bun run test src/provider/Layers/DroidAdapter.test.ts src/provider/Layers/DroidProvider.test.ts.
• Full bun run test previously passed; after rebasing, one full parallel run hit three unrelated web timeout failures, and rerunning those exact files in isolation passed.

Note

Add Droid SDK provider with full session, streaming, and runtime mode support

• Introduces the DroidDriver and makeDroidAdapter to integrate the @factory/droid-sdk as a first-class provider, supporting session lifecycle, turn streaming, permission/user-input mediation, and interrupts.
• Adds checkDroidProviderStatus for health checks including CLI version detection and timed model discovery; models are mapped to ServerProviderModel with reasoning capability descriptors.
• Adds a new 'medium-access' value to the RuntimeMode union, mapped to AutonomyLevel.Medium for Droid and treated as equivalent to auto-accept-edits in non-Droid contexts.
• Introduces runtimeModePresentation.ts with provider-aware runtime mode config/options and a normalizeRuntimeModeForProvider helper; ChatView and composer components now normalize and persist runtime mode based on the resolved provider.
• Fixes resolveProviderDriverKindForInstanceSelection to exclude disabled or unavailable provider instances.
• Risk: DroidDriver text generation operations (commit messages, PR content, branch names, thread titles) always fail with a TextGenerationError; rollback is explicitly unsupported.

^{Macroscope summarized 87453f2.}

---

Note

Medium Risk
Adds a new first-class provider plus a new RuntimeMode value, touching provider registry, runtime event mapping, and chat composer behavior; regressions could affect session lifecycle and access-mode handling across providers.

Overview
Introduces Droid as a new managed provider backed by @factory/droid-sdk, including a DroidDriver, provider health/model discovery, and an adapter that starts/resumes sessions, streams SDK messages into canonical runtime events, mediates permission + ask-user callbacks, supports image attachments, and handles interrupts/stop-all.

Extends shared contracts and defaults to include DroidSettings, droid runtime raw sources, and a new RuntimeMode (medium-access) with provider-specific mappings (also wired into Codex runtime sandbox mapping).

Updates the web UI to surface Droid (settings + icons + provider picker) and to make runtime-mode selection provider-aware: runtime mode options/labels vary per provider, unsupported modes are normalized when switching providers, and instance selection resolution now ignores disabled/unavailable instances.

^{Reviewed by Cursor Bugbot for commit 87453f2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: bcf3c706-18dd-4a0a-abf5-5a58870660dc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[0xSero]

Latest Droid follow-up fixes pushed in c72f19b:

• Fixed streaming by reconciling SDK assistant_text_delta block IDs with final create_message content, so final messages fill missing text without duplicating streamed text.
• Added final create_message fallback handling for assistant text and thinking blocks when deltas are absent.
• Passed custom model IDs and reasoning effort into Droid spec mode via enterSpecMode({ specModeModelId, specModeReasoningEffort }) and updateSettings(...), which fixes thinking/spec mode for custom models.
• Matched Droid access levels to SDK autonomy levels: Off, Low, Medium, High, while keeping Medium visible only for Droid UI.
• Verified the live app model picker shows user/custom Droid models including Direct - GPT-5.5-Fast-xHigh, and the Droid access menu shows Off/Low/Medium/High.
• Direct SDK smoke query with custom xHigh model returned droid-smoke-ok.

Validation: bun fmt, focused Droid adapter/provider tests, bun typecheck, bun lint, and full bun run test all pass.

[0xSero]

Addressed the unresolved Droid cleanup review thread in b1dabf8. stopSession now treats droid.close() as best-effort cleanup, matching the scoped finalizer behavior, so stopAll() can continue shutting down the remaining sessions even if one SDK close throws.

Added a regression test covering two resumed Droid sessions where one close() fails and verified both sessions are still removed.

Validation:

• bun fmt
• bun lint (passes with existing unrelated warnings)
• bun typecheck
• cd apps/server && bun run test src/provider/Layers/DroidAdapter.test.ts src/provider/Layers/DroidProvider.test.ts
• bun run test full suite

Note: the first full-suite run hit a timeout in @t3tools/oxlint-plugin-t3code; that package passed in isolation, then the full suite passed on rerun.

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a complete new provider integration (Droid SDK) with new runtime capabilities, settings, and UI changes. New features adding external integrations and user-facing workflows require human review.

^{You can customize Macroscope's approvability policy. Learn more.}

[0xSero]

Split the Droid adapter by responsibility in af7ffb0:

• DroidAdapter.ts is now 433 lines and only owns session lifecycle / adapter orchestration.
• provider/droid/DroidRuntimeEvents.ts handles Droid SDK message to runtime event projection.
• provider/droid/DroidSdkMappings.ts handles SDK enum, model, access, user-input, and usage mappings.
• provider/droid/DroidAttachmentResolver.ts handles attachment image validation/loading.
• provider/droid/DroidAdapterTypes.ts holds shared adapter types.

The Droid implementation is now 989 lines total across focused modules instead of one nearly 900-line adapter file.

Validation:

• bun fmt
• bun lint (passes with existing unrelated web warnings)
• bun typecheck
• focused Droid tests: cd apps/server && bun run test src/provider/Layers/DroidAdapter.test.ts src/provider/Layers/DroidProvider.test.ts
• full bun run test was rerun after rebase and hit three unrelated web timeout failures under parallel load; rerunning those exact three files in isolation passed: cd apps/web && bun run test src/environments/runtime/service.addSavedEnvironment.test.ts src/environments/runtime/service.threadSubscriptions.test.ts src/components/chat/MessagesTimeline.test.tsx

[0xSero]

Addressed the two remaining Cursor Bugbot review threads in 8939e57:

• Removed the redundant Droid pending-provider status ternary. The probe stays warning, while buildServerProvider correctly exposes top-level status: "disabled" whenever Droid settings are disabled. Added a regression test for the disabled Droid provider snapshot.
• Normalized Droid-only medium-access when the selected provider is no longer Droid, falling back to auto-accept-edits and persisting that normalized draft value so the runtime-mode select cannot show a value outside its option list. Added runtime-mode presentation tests.

Validation:

• bun fmt
• bun lint (passes with existing unrelated web warnings)
• bun typecheck
• focused tests for DroidProvider and runtimeModePresentation
• full bun run test passed: 125 files passed, 1 skipped; 1032 tests passed, 4 skipped.

[0xSero]

Addressed the remaining token-usage review thread in 742ab64:

• Droid now stores activeTokenUsage as T3 Code’s canonical ThreadTokenUsageSnapshot instead of the raw SDK TokenUsageUpdate.
• thread.token-usage.updated and turn.completed now use the same canonical usage shape.
• Extended DroidAdapter.test.ts to assert both event payloads match the expected canonical token accounting.

Validation after this fix:

• bun fmt
• bun lint (passes with existing unrelated web warnings)
• bun typecheck
• cd apps/server && bun run test src/provider/Layers/DroidAdapter.test.ts src/provider/Layers/DroidProvider.test.ts

Earlier in this pass, full bun run test also passed before the final token-usage-only patch: 125 files passed, 1 skipped; 1032 tests passed, 4 skipped.

[0xSero]

Resolved the latest Cursor Bugbot comments in 23191e94.

• stopSession now treats session.exited emission as best-effort so stopAll cleanup is not interrupted by queue shutdown/emission failures
• Droid intra-turn token usage updates now accumulate from the active usage snapshot instead of always restarting from the turn baseline
• added Droid adapter coverage for multiple TokenUsageUpdate messages in a single turn

Validation:

• bun run --cwd apps/server test src/provider/Layers/DroidAdapter.test.ts
• bun fmt
• bun lint (existing 9 warnings, 0 errors)
• bun typecheck
• bun run test

[0xSero]

Resolved the latest Macroscope/Cursor comments in b17efc0d.

• Droid startSession now publishes the replacement context before awaiting previous-context close, so concurrent replacements cannot orphan the losing SDK session
• composer access-mode controls now use a dedicated runtime-mode provider, preserving Droid access options when the selected Droid instance is disabled/unavailable without changing send routing
• added Droid adapter coverage for concurrent replacement starts

Validation:

• bun run --cwd apps/server test src/provider/Layers/DroidAdapter.test.ts
• bun run --cwd apps/web test src/components/ChatView.logic.test.ts src/components/chat/runtimeModePresentation.test.ts
• bun fmt
• bun lint (existing 9 warnings, 0 errors)
• bun typecheck
• bun run test

[0xSero]

Resolved the latest Cursor Bugbot review in da7cc1de.

• Removed the unused providers parameter from provider instance driver resolution and updated callers/tests.
• Fixed fallback runtime-mode presentation so disabled/unavailable Droid selections no longer show Droid-specific access labels while the effective provider is Codex.
• Kept the existing non-persistence behavior for unstable/disabled explicit selections, but normalize the effective composer mode against the provider actually being used.

Validation:

• bun run --cwd apps/web test src/providerInstances.test.ts src/components/ChatView.logic.test.ts src/components/chat/runtimeModePresentation.test.ts
• bun fmt
• bun lint (existing 9 warnings, 0 errors)
• bun typecheck
• bun run test

[0xSero]

Resolved the latest Cursor Bugbot comments in c1ad5f0.

• Restored Droid-specific runtime-mode presentation from the explicitly selected provider instance, even when that instance is currently disabled/unavailable
• Emitted thread.token-usage.updated when Droid only reports usage in TurnComplete
• Added Droid adapter coverage for final-only token usage emission

Validation:

• bun run --cwd apps/server test src/provider/Layers/DroidAdapter.test.ts
• bun run --cwd apps/web test src/providerInstances.test.ts src/components/ChatView.logic.test.ts src/components/chat/runtimeModePresentation.test.ts
• bun fmt
• bun lint (existing 9 warnings, 0 errors)
• bun typecheck
• bun run test

[0xSero]

Resolved the newest Cursor Bugbot comments in 0e5d6af.

• Kept streamed Droid TokenUsageUpdate as authoritative when TurnComplete.tokenUsage is also present, avoiding duplicate/overwritten turn usage
• Added coverage for streamed-plus-final Droid usage reporting
• Serialized Droid session map replacement and previous-context closing with a semaphore so concurrent starts cannot orphan a replaced context

Validation:

• bun run --cwd apps/server test src/provider/Layers/DroidAdapter.test.ts
• bun fmt
• bun lint (existing 9 warnings, 0 errors)
• bun typecheck
• bun run test

[0xSero]

Resolved the latest Cursor Bugbot comments in 7bc4e12.

• Fixed Droid model discovery failure messages to unwrap Effect causes when present while still handling direct discovery errors
• Made Droid token usage last* fields represent the aggregate current turn usage across multiple streamed TokenUsageUpdate messages
• Added focused Droid provider coverage for cause unwrapping and kept adapter coverage aligned with cross-turn vs intra-turn usage semantics

Validation:

• bun run --cwd apps/server test src/provider/Layers/DroidAdapter.test.ts src/provider/Layers/DroidProvider.test.ts
• bun fmt
• bun lint (existing 9 warnings, 0 errors)
• bun typecheck
• bun run test

[0xSero]

Resolved the latest Cursor Bugbot comment in d7b895e.

• Added a fallback Droid model provider label so newly-added SDK providers stay displayable instead of producing undefined
• Added regression coverage through Droid SDK model discovery mapping

Validation:

• bun run --cwd apps/server test src/provider/Layers/DroidProvider.test.ts
• bun fmt
• bun lint (existing 9 warnings, 0 errors)
• bun typecheck
• bun run test

[0xSero]

Resolved the latest Cursor Bugbot comments in e6e7338.

• Aligned ChatComposer provider routing with ChatView so disabled/unavailable explicit Droid selections do not silently dispatch as Codex while showing Droid UI
• Moved Droid model discovery timeout into the SDK session creation path, aborting the SDK signal and closing any late-created session

Validation:

• bun typecheck
• bun run --cwd apps/server test src/provider/Layers/DroidProvider.test.ts
• bun run --cwd apps/web test src/providerInstances.test.ts src/components/chat/composerProviderState.test.tsx
• bun fmt
• bun lint (existing 9 warnings, 0 errors)
• bun run test

[0xSero]

Resolved the latest duplicate abort-signal comments in d5a6bf3.

• Droid model discovery now checks already-aborted Effect signals immediately after attaching the listener, so SDK session startup cancellation does not wait for the discovery timeout.

Validation:

• bun run --cwd apps/server test src/provider/Layers/DroidProvider.test.ts
• bun fmt
• bun lint (existing 9 warnings, 0 errors)
• bun typecheck
• bun run test

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d5a6bf3. Configure here.}

[0xSero]

Resolved the latest Droid environment compaction comment in 87453f2.

• Extracted shared compactDroidEnvironment helper for Droid SDK env filtering
• Updated both Droid provider discovery and Droid adapter session startup to use it

Validation:

• bun run --cwd apps/server test src/provider/Layers/DroidAdapter.test.ts src/provider/Layers/DroidProvider.test.ts
• bun fmt
• bun lint (existing 9 warnings, 0 errors)
• bun typecheck
• bun run test