Add Droid SDK provider

[0xSero]

Intention

Add Droid as a first-class T3 Code provider using Factory's TypeScript SDK: https://github.com/Factory-AI/droid-sdk-typescript

This is still WIP while we validate more real Droid permission, file, MCP, auth, and long-running streaming flows.

What this adds

• Adds droid to the shared provider, model, settings, runtime source, and driver contracts.
• Registers a managed Droid provider driver plus inventory probe.
• Wraps createSession / resumeSession from @factory/droid-sdk in a T3 provider adapter.
• Supports Droid session start, resume, stop, interrupt, and in-session model / reasoning updates.
• Streams assistant text, reasoning text, tool progress/results, token usage, MCP/auth status, title updates, turn completion, and runtime errors into canonical T3 runtime events.
• Routes Droid permission callbacks through T3 approval requests.
• Routes Droid ask-user callbacks through the existing structured user-input flow.
• Sends supported image attachments (gif, jpeg, png, webp) as base64 SDK image sources resolved through the existing attachment store.
• Discovers SDK-reported Droid models from initResult.availableModels, including user/custom models, while preserving custom model ids so duplicate underlying models remain selectable.
• Adds Droid UI presence in Provider Settings and the model picker, including the provided icon.

Implementation shape

The Droid adapter has been split by responsibility instead of keeping one large file:

• DroidAdapter.ts: session lifecycle and adapter orchestration.
• provider/droid/DroidRuntimeEvents.ts: SDK message to T3 runtime event projection.
• provider/droid/DroidSdkMappings.ts: SDK model, access, reasoning, usage, approval, and user-input mappings.
• provider/droid/DroidAttachmentResolver.ts: attachment MIME validation and image loading.
• provider/droid/DroidAdapterTypes.ts: shared Droid adapter types.

Security / safety notes

• Droid remains disabled by default.
• No SDK secrets, pairing tokens, or provider auth payloads are intentionally logged.
• Permission requests are mediated through T3 approval events and default to cancellation on missing/stale sessions.
• Attachment paths are resolved through the existing attachment store helper; unsupported MIME types fail before SDK submission.
• The Droid binary path is configurable but defaults to droid; prompt content is sent through the SDK rather than shell interpolation.
• Model discovery uses a short-lived SDK session in a temp cwd and closes it immediately after reading init metadata.

Validation

• Real Droid CLI query: droid exec --model glm-5.1 --cwd /tmp ... returned droid-pong.
• Live SDK model discovery returned 67 models, including 38 user/custom models.
• Local T3 model picker showed custom Droid models such as HomeLab - GLM-5.1, HomeLab - Trinity-Large-Thinking, Direct - GPT-5.5-Fast-xHigh, and Direct - GPT-5.5-Low.
• Review comments addressed: missing-session reads now fail; Droid rollback now honors numTurns; streaming, thinking, access-mode mapping, and custom model discovery were updated.
• bun fmt passed.
• bun lint passed with existing unrelated web warnings.
• bun typecheck passed.
• Focused Droid tests passed: cd apps/server && bun run test src/provider/Layers/DroidAdapter.test.ts src/provider/Layers/DroidProvider.test.ts.
• Full bun run test previously passed; after rebasing, one full parallel run hit three unrelated web timeout failures, and rerunning those exact files in isolation passed.

Note

Add Droid SDK provider with full session, turn, and event streaming support

• Introduces the DroidDriver and makeDroidAdapter to integrate the @factory/droid-sdk (v0.2.0) as a first-class provider, registered in BUILT_IN_DRIVERS and the provider registry.
• Implements session lifecycle (create/resume), turn execution with image attachments, permission/user-input request flows, graceful interruption, and real-time event streaming via handleDroidMessage.
• Adds a medium-access runtime mode mapped to autonomy level Medium for Droid; the UI exposes this as an extra option in the access mode picker only when the Droid provider is active.
• Provider status checks run the Droid CLI (--version) and optionally discover available models via a short-lived SDK session, with timeouts and fallback defaults.
• Text generation (commit messages, PR content, branch names, thread titles) is explicitly unsupported and returns errors.
• Risk: The Droid provider is marked WIP (badgeLabel: 'WIP') and text generation fails by design; switching providers coerces unsupported runtime modes to auto-accept-edits.

^{Macroscope summarized 450fa08.}

---

Note

Medium Risk
Adds a new first-class provider with session lifecycle, permission mediation, and streaming event mapping; correctness issues could affect runtime state, approvals, and token-usage accounting. Droid is disabled by default, reducing blast radius, but it touches core provider/contract surfaces and UI runtime-mode selection.

Overview
Adds Droid as a new provider backed by @factory/droid-sdk, including a managed server driver that probes the droid CLI, discovers available models, and exposes a provider snapshot with update/advisory metadata.

Implements a Droid adapter that starts/resumes/stops sessions, streams SDK messages into canonical runtime events (content/tool lifecycle, token usage, MCP/auth/status, errors), routes SDK permission and ask-user callbacks through T3 approvals/user-input, and supports image attachments by loading/validating files and sending base64 sources.

Extends shared contracts/settings to include DroidSettings, new runtime raw sources, provider/model defaults, and introduces a new RuntimeMode value medium-access (treated as workspace-write for Codex, and surfaced in the web UI only for Droid with provider-specific labels and normalization when switching providers).

^{Reviewed by Cursor Bugbot for commit 450fa08. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 941ac3f0-98fc-4c0e-9f13-c614c8f592fa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[0xSero]

Latest Droid follow-up fixes pushed in c72f19b:

• Fixed streaming by reconciling SDK assistant_text_delta block IDs with final create_message content, so final messages fill missing text without duplicating streamed text.
• Added final create_message fallback handling for assistant text and thinking blocks when deltas are absent.
• Passed custom model IDs and reasoning effort into Droid spec mode via enterSpecMode({ specModeModelId, specModeReasoningEffort }) and updateSettings(...), which fixes thinking/spec mode for custom models.
• Matched Droid access levels to SDK autonomy levels: Off, Low, Medium, High, while keeping Medium visible only for Droid UI.
• Verified the live app model picker shows user/custom Droid models including Direct - GPT-5.5-Fast-xHigh, and the Droid access menu shows Off/Low/Medium/High.
• Direct SDK smoke query with custom xHigh model returned droid-smoke-ok.

Validation: bun fmt, focused Droid adapter/provider tests, bun typecheck, bun lint, and full bun run test all pass.

[0xSero]

Addressed the unresolved Droid cleanup review thread in b1dabf8. stopSession now treats droid.close() as best-effort cleanup, matching the scoped finalizer behavior, so stopAll() can continue shutting down the remaining sessions even if one SDK close throws.

Added a regression test covering two resumed Droid sessions where one close() fails and verified both sessions are still removed.

Validation:

• bun fmt
• bun lint (passes with existing unrelated warnings)
• bun typecheck
• cd apps/server && bun run test src/provider/Layers/DroidAdapter.test.ts src/provider/Layers/DroidProvider.test.ts
• bun run test full suite

Note: the first full-suite run hit a timeout in @t3tools/oxlint-plugin-t3code; that package passed in isolation, then the full suite passed on rerun.

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a complete new Droid SDK provider integration with extensive new logic across driver, adapter, settings, runtime modes, and UI components. The scope represents a significant new feature, and there are unresolved review comments identifying potential bugs in runtime mode handling and concurrent turn state management.

^{You can customize Macroscope's approvability policy. Learn more.}

[0xSero]

Split the Droid adapter by responsibility in af7ffb0:

• DroidAdapter.ts is now 433 lines and only owns session lifecycle / adapter orchestration.
• provider/droid/DroidRuntimeEvents.ts handles Droid SDK message to runtime event projection.
• provider/droid/DroidSdkMappings.ts handles SDK enum, model, access, user-input, and usage mappings.
• provider/droid/DroidAttachmentResolver.ts handles attachment image validation/loading.
• provider/droid/DroidAdapterTypes.ts holds shared adapter types.

The Droid implementation is now 989 lines total across focused modules instead of one nearly 900-line adapter file.

Validation:

• bun fmt
• bun lint (passes with existing unrelated web warnings)
• bun typecheck
• focused Droid tests: cd apps/server && bun run test src/provider/Layers/DroidAdapter.test.ts src/provider/Layers/DroidProvider.test.ts
• full bun run test was rerun after rebase and hit three unrelated web timeout failures under parallel load; rerunning those exact three files in isolation passed: cd apps/web && bun run test src/environments/runtime/service.addSavedEnvironment.test.ts src/environments/runtime/service.threadSubscriptions.test.ts src/components/chat/MessagesTimeline.test.tsx

[0xSero]

Addressed the two remaining Cursor Bugbot review threads in 8939e57:

• Removed the redundant Droid pending-provider status ternary. The probe stays warning, while buildServerProvider correctly exposes top-level status: "disabled" whenever Droid settings are disabled. Added a regression test for the disabled Droid provider snapshot.
• Normalized Droid-only medium-access when the selected provider is no longer Droid, falling back to auto-accept-edits and persisting that normalized draft value so the runtime-mode select cannot show a value outside its option list. Added runtime-mode presentation tests.

Validation:

• bun fmt
• bun lint (passes with existing unrelated web warnings)
• bun typecheck
• focused tests for DroidProvider and runtimeModePresentation
• full bun run test passed: 125 files passed, 1 skipped; 1032 tests passed, 4 skipped.

[0xSero]

Addressed the remaining token-usage review thread in 742ab64:

• Droid now stores activeTokenUsage as T3 Code’s canonical ThreadTokenUsageSnapshot instead of the raw SDK TokenUsageUpdate.
• thread.token-usage.updated and turn.completed now use the same canonical usage shape.
• Extended DroidAdapter.test.ts to assert both event payloads match the expected canonical token accounting.

Validation after this fix:

• bun fmt
• bun lint (passes with existing unrelated web warnings)
• bun typecheck
• cd apps/server && bun run test src/provider/Layers/DroidAdapter.test.ts src/provider/Layers/DroidProvider.test.ts

Earlier in this pass, full bun run test also passed before the final token-usage-only patch: 125 files passed, 1 skipped; 1032 tests passed, 4 skipped.

[0xSero]

Follow-up fixes for the latest automated review threads:

• Prevented Droid thinking text from being emitted twice when streamed ThinkingTextDelta events are followed by a final CreateMessage thinking block.
• Hardened Droid interrupt handling so SDK/IPC interrupt failures are ignored after aborting the active turn instead of surfacing as fiber defects.

Validation:

• bun fmt
• bun lint (passes with existing unrelated warnings)
• bun typecheck
• bun run test

[0xSero]

Follow-up for the latest Cursor Bugbot token usage thread:

• Droid token usage now preserves cumulative totals across turns while keeping last* fields scoped to the current turn.
• Added a regression test that runs two Droid turns and verifies cumulative usedTokens/inputTokens/outputTokens plus per-turn last* values.

Validation after this change:

• bun fmt
• bun lint (passes with existing unrelated warnings)
• bun typecheck
• bun run test

[0xSero]

Fixed the latest Cursor Bugbot thread:

• CreateMessage now uses the same ${messageId}-${index} key as streamed Droid deltas, so final blocks with SDK id fields do not bypass deduplication.
• Updated the assistant text and thinking dedup regression tests to include final content block ids.

Validation:

• bun fmt
• bun lint (passes with existing unrelated warnings)
• bun typecheck
• bun run test

[0xSero]

Addressed the latest Droid review batch in 450fa08c.

• Resumed Droid sessions now immediately apply the requested autonomy/access level plus current model/reasoning settings via updateSettings.
• Starting Droid twice for the same T3 thread now closes the replaced SDK session before installing the new context.
• User interrupts now complete aborted Droid streams as interrupted instead of surfacing provider failures.
• Droid SDK error stream messages now make the active turn fail and preserve the session error state.
• Rollback now fails as unsupported for Droid instead of mutating only T3 local snapshots while the SDK session keeps stale history.
• Final assistant completion dedup uses the same message/block key as streamed and final text content.
• Model discovery now passes the Effect cancellation signal through to createSession so timeout interruption can close the probe process.
• Runtime-mode normalization in ChatView now waits for provider config before persisting fallback normalization, avoiding temporary Droid medium-access downgrades.

Validation: bun fmt, bun lint (existing 9 warnings only), bun typecheck, and full bun run test all pass.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 450fa08. Configure here.}

[cursor]

Runtime mode normalization persists downgrade before providers stabilize

Medium Severity

The useEffect normalizes and persists the runtime mode as soon as serverConfig is non-null, without verifying that provider selection has stabilized. If resolveSelectableProvider temporarily resolves to a non-Droid provider (e.g., during reconnection, provider reloading, or if the Droid instance ID doesn't match), a thread's medium-access mode is normalized to auto-accept-edits and irreversibly written via setComposerDraftRuntimeMode and setDraftThreadContext. Once persisted, switching back to Droid won't restore medium-access since rawRuntimeMode already reflects the downgrade.

 

^{Reviewed by Cursor Bugbot for commit 450fa08. Configure here.}

[cursor]

Concurrent sendTurn calls corrupt shared context state

Low Severity

sendTurn unconditionally resets mutable context fields (activeAssistantItems, activeAbort, activeTurnError, etc.) and launches a detached fiber without checking if a previous turn is still running. If a second sendTurn is issued before the first completes, both detached fibers share and mutate the same context object, leading to corrupted token accounting, lost streaming items, and incorrect turn completion state.

 

^{Reviewed by Cursor Bugbot for commit 450fa08. Configure here.}