fix: realign rebase-casualty files with upstream master after the 8-PR merge wave (#142)

The 2026-06-11 rebase (#141) onto a master that had just merged our 8
give-back PRs left several bad conflict resolutions:

- packages/adapters/codex-local/src/server/runtime-config.ts was
  TRUNCATED mid-function (TS1005) -> Docker build on main failed, no
  image rolled. Restored to upstream (paperclipai#7919 is merged; zero delta).
- server/src/routes/issues.ts + heartbeat.ts and their test files kept
  pre-revert paperclipai#7678 code and missed paperclipai#7855 scoped-wake semantics.
  Restored to upstream (no documented fork delta in these files).
- ui/src/pages/IssueDetail.tsx + ui/src/lib/issue-chat-messages.test.ts:
  same paperclipai#7678 remnants, restored.
- tools/agent-shim/stdout_framer.go: dead code upstream removed during
  the paperclipai#7934 review; deleted here too (main_test.go realigned).

Preserved fork deltas untouched: cloud_tenant (middleware/auth.ts,
live-events-ws.ts), seed CLI, claude-local execute cwd fix (paperclipai#5823 still
open), workspace-restore-merge socket guard, Dockerfile plugin build,
paperclipinc registry names, workspace-init, fork CI workflows.

Verified: server build exit 0 (the exact CI failure), 58 server tests,
87 codex-local tests, 24 ui tests, go build+test agent-shim all green.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: stubbi

doc/execution-semantics.md

@@ -285,7 +285,6 @@ Plain text is not assignment. Writing an agent's name, role, or team label in a
 
 Pause and tree-control previews should make the same distinction visible. They should report whether the affected subtree contains live running work, queued wakes, agent-owned work, or only human-owned/static issues, so a pause after a handoff does not look like it interrupted agent execution when no agent execution path existed.
 
-
 ### Adapter-backed workspace coherence
 
 For adapter-backed execution, an active run or queued wake counts as a live path only when Paperclip can also prove that the selected workspace is coherent for that adapter invocation. A wake that cannot start in the intended workspace is only a failed delivery attempt, not a healthy liveness path.

packages/adapters/codex-local/src/server/runtime-config.ts

@@ -146,4 +146,285 @@ function parseCodexProvidersConfig(
 function escapeTomlString(value: string): string {
   // TOML 1.0 basic strings require escaping U+0000-U+001F and U+007F (DEL).
   return value.replace(/[\\"\u0000-\u001f\u007f]/g, (char) => {
-    switch (char) {
+    switch (char) {
+      case "\\":
+        return "\\\\";
+      case '"':
+        return '\\"';
+      case "\n":
+        return "\\n";
+      case "\r":
+        return "\\r";
+      case "\t":
+        return "\\t";
+      default:
+        return `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`;
+    }
+  });
+}
+
+const BARE_TOML_KEY_RE = /^[A-Za-z0-9_-]+$/;
+
+function tomlKey(key: string): string {
+  return BARE_TOML_KEY_RE.test(key) ? key : `"${escapeTomlString(key)}"`;
+}
+
+// Hand-emitted TOML for a constrained value space (strings, numbers, booleans,
+// arrays of scalars, plain objects as inline tables). Returns null for values
+// that cannot be represented, which are then skipped.
+function tomlValue(value: unknown): string | null {
+  if (typeof value === "string") return `"${escapeTomlString(value)}"`;
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") return Number.isFinite(value) ? String(value) : null;
+  if (Array.isArray(value)) {
+    const entries = value.map((entry) => tomlValue(entry));
+    if (entries.some((entry) => entry === null)) return null;
+    return `[${entries.join(", ")}]`;
+  }
+  if (isPlainObject(value)) {
+    const pairs: string[] = [];
+    for (const [key, entry] of Object.entries(value)) {
+      const emitted = tomlValue(entry);
+      if (emitted === null) continue;
+      pairs.push(`${tomlKey(key)} = ${emitted}`);
+    }
+    return `{ ${pairs.join(", ")} }`;
+  }
+  return null;
+}
+
+function emitProviderTable(name: string, fields: Record<string, unknown>): string[] {
+  const lines = [`[model_providers.${tomlKey(name)}]`];
+  for (const [key, value] of Object.entries(fields)) {
+    const emitted = tomlValue(value);
+    if (emitted === null) continue;
+    lines.push(`${tomlKey(key)} = ${emitted}`);
+  }
+  return lines;
+}
+
+function stripManagedBlock(lines: string[], begin: string, end: string): string[] {
+  const out: string[] = [];
+  let inBlock = false;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!inBlock && trimmed === begin) {
+      inBlock = true;
+      continue;
+    }
+    if (inBlock) {
+      if (trimmed === end) inBlock = false;
+      continue;
+    }
+    out.push(line);
+  }
+  return out;
+}
+
+export function stripManagedCodexProviderBlocks(content: string): string {
+  let lines = content.split("\n");
+  lines = stripManagedBlock(lines, MANAGED_ROOT_BEGIN, MANAGED_ROOT_END);
+  lines = stripManagedBlock(lines, MANAGED_TABLES_BEGIN, MANAGED_TABLES_END);
+  return lines.join("\n");
+}
+
+const TABLE_HEADER_RE = /^\s*\[\s*([^\]]*?)\s*\]\s*(?:#.*)?$/;
+
+// Best-effort parse of a TOML table header into its dotted path segments,
+// stripping surrounding quotes per segment. Dotted quoted segment names are
+// out of scope for this merge (codex provider ids are simple identifiers).
+function parseTableHeaderPath(line: string): string[] | null {
+  const match = TABLE_HEADER_RE.exec(line);
+  if (!match) return null;
+  return match[1]
+    .split(".")
+    .map((segment) => segment.trim())
+    .map((segment) => segment.replace(/^"(.*)"$/, "$1").replace(/^'(.*)'$/, "$1"));
+}
+
+// Remove pre-existing definitions that would conflict with (or override) the
+// managed content: [model_providers.<name>] tables (and their subtables) for
+// names we are about to define, and the root-level `model_provider` key when
+// we set one. Duplicate TOML tables/keys are parse errors in codex, so the
+// managed definitions must win by excising the originals.
+function stripConflictingDefinitions(
+  content: string,
+  providerNames: string[],
+  removeRootModelProvider: boolean,
+): string {
+  const names = new Set(providerNames);
+  const lines = content.split("\n");
+  const out: string[] = [];
+  let inRootRegion = true;
+  let skippingSection = false;
+  for (const line of lines) {
+    const headerPath = parseTableHeaderPath(line);
+    if (headerPath) {
+      inRootRegion = false;
+      skippingSection =
+        headerPath.length >= 2 &&
+        headerPath[0] === "model_providers" &&
+        names.has(headerPath[1]);
+      if (skippingSection) continue;
+    } else if (skippingSection) {
+      continue;
+    }
+    if (inRootRegion && removeRootModelProvider && /^\s*model_provider\s*=/.test(line)) {
+      continue;
+    }
+    out.push(line);
+  }
+  return out.join("\n");
+}
+
+function buildMergedConfigToml(base: string, parsed: ParsedCodexProvidersConfig): string {
+  const sections: string[] = [];
+  if (parsed.modelProvider) {
+    sections.push(
+      [
+        MANAGED_ROOT_BEGIN,
+        `model_provider = "${escapeTomlString(parsed.modelProvider)}"`,
+        MANAGED_ROOT_END,
+      ].join("\n"),
+    );
+  }
+  const trimmedBase = base.replace(/^\n+/, "").replace(/\n+$/, "");
+  if (trimmedBase.length > 0) sections.push(trimmedBase);
+  const tableLines: string[] = [MANAGED_TABLES_BEGIN];
+  for (const [name, fields] of Object.entries(parsed.providers)) {
+    tableLines.push(...emitProviderTable(name, fields), "");
+  }
+  while (tableLines[tableLines.length - 1] === "") tableLines.pop();
+  tableLines.push(MANAGED_TABLES_END);
+  sections.push(tableLines.join("\n"));
+  return `${sections.join("\n\n")}\n`;
+}
+
+async function readFileOrNull(filePath: string): Promise<string | null> {
+  return fs.readFile(filePath, "utf8").catch(() => null);
+}
+
+// Pre-run backup of the original config.toml, written before the merged file.
+// If a run dies without reaching cleanup() (a setup throw between prepare and
+// execution, SIGKILL, ...), the next prepare restores the original from this
+// backup with full fidelity -- including user [model_providers.*] sections the
+// merge excised, which block-stripping alone cannot bring back.
+function configTomlBackupPath(configTomlPath: string): string {
+  return `${configTomlPath}.paperclip-backup`;
+}
+
+// Merge custom Codex model providers supplied via PAPERCLIP_CODEX_PROVIDERS
+// into the managed CODEX_HOME's config.toml.
+//
+// Codex has no CLI flag or env var for pointing at a custom OpenAI-compatible
+// endpoint: custom endpoints are `[model_providers.<id>]` tables in
+// $CODEX_HOME/config.toml, selected by a top-level `model_provider = "<id>"`
+// key (the `--model` CLI flag picks the model WITHIN the selected provider).
+// We accept the providers as config (not hard-coded) so the gateway URL, key
+// indirection, and wire protocol stay declarative.
+//
+// The merge preserves any existing config.toml content (seeded from the shared
+// ~/.codex by prepareManagedCodexHome): managed content lives between marker
+// comments and conflicting pre-existing definitions are excised so the managed
+// definitions win. cleanup() restores the original file; if a run dies before
+// cleanup, the next prepare restores the original from the pre-run backup file
+// written alongside config.toml (including when PAPERCLIP_CODEX_PROVIDERS is
+// no longer set), falling back to stripping the stale managed blocks.
+//
+// When the adapter config explicitly sets env.CODEX_HOME (a user-managed home),
+// pass codexHome: null -- the file is left untouched and a note is surfaced.
+export async function prepareCodexRuntimeConfig(input: {
+  env: Record<string, string>;
+  codexHome: string | null;
+}): Promise<PreparedCodexRuntimeConfig> {
+  const resolveEnv = (name: string): string | undefined => input.env[name] ?? process.env[name];
+  const notes: string[] = [];
+  const parsed = parseCodexProvidersConfig(
+    input.env.PAPERCLIP_CODEX_PROVIDERS ?? process.env.PAPERCLIP_CODEX_PROVIDERS,
+    resolveEnv,
+    notes,
+  );
+
+  if (!parsed) {
+    // Self-heal state left behind by a crashed run (cleanup() never ran).
+    if (input.codexHome) {
+      const configTomlPath = path.join(input.codexHome, "config.toml");
+      const reason = notes.length === 0 ? " (PAPERCLIP_CODEX_PROVIDERS is no longer set)" : "";
+      const backupPath = configTomlBackupPath(configTomlPath);
+      const backup = await readFileOrNull(backupPath);
+      if (backup !== null) {
+        // Full-fidelity restore: the backup is the pre-run original, including
+        // any user provider sections the crashed run's merge excised.
+        await fs.writeFile(configTomlPath, backup, "utf8");
+        await fs.rm(backupPath, { force: true });
+        return {
+          notes: [
+            ...notes,
+            `Restored "${configTomlPath}" from its pre-run backup, removing stale Paperclip-managed model providers left by an interrupted run${reason}.`,
+          ],
+          cleanup: async () => {},
+        };
+      }
+      // Fallback for pre-backup stale state: strip the managed blocks.
+      const existing = await readFileOrNull(configTomlPath);
+      if (existing !== null) {
+        const stripped = stripManagedCodexProviderBlocks(existing);
+        if (stripped !== existing) {
+          await fs.writeFile(configTomlPath, stripped, "utf8");
+          return {
+            notes: [
+              ...notes,
+              `Removed stale Paperclip-managed model provider blocks from "${configTomlPath}"${reason}.`,
+            ],
+            cleanup: async () => {},
+          };
+        }
+      }
+    }
+    return { notes, cleanup: async () => {} };
+  }
+
+  if (!input.codexHome) {
+    return {
+      notes: [
+        ...notes,
+        "PAPERCLIP_CODEX_PROVIDERS is set but the adapter config explicitly sets env.CODEX_HOME; leaving the user-managed Codex home untouched (no model provider merge).",
+      ],
+      cleanup: async () => {},
+    };
+  }
+
+  const configTomlPath = path.join(input.codexHome, "config.toml");
+  const backupPath = configTomlBackupPath(configTomlPath);
+  // A surviving backup from an interrupted run is the true pre-run content;
+  // the current config.toml would still carry that run's managed blocks.
+  const original = (await readFileOrNull(backupPath)) ?? (await readFileOrNull(configTomlPath));
+  const providerNames = Object.keys(parsed.providers);
+  const base = stripConflictingDefinitions(
+    stripManagedCodexProviderBlocks(original ?? ""),
+    providerNames,
+    parsed.modelProvider !== null,
+  );
+  await fs.mkdir(input.codexHome, { recursive: true });
+  // Persist the original BEFORE writing the merged file so a run that never
+  // reaches cleanup() can be restored by the next prepare.
+  await fs.writeFile(backupPath, original ?? "", "utf8");
+  await fs.writeFile(configTomlPath, buildMergedConfigToml(base, parsed), "utf8");
+
+  return {
+    notes: [
+      ...notes,
+      `Merged ${providerNames.length} custom Codex model provider(s) from PAPERCLIP_CODEX_PROVIDERS into "${configTomlPath}": ${providerNames.join(", ")}${
+        parsed.modelProvider ? `; selected model_provider "${parsed.modelProvider}"` : ""
+      }.`,
+    ],
+    cleanup: async () => {
+      if (original === null) {
+        await fs.rm(configTomlPath, { force: true });
+      } else {
+        await fs.writeFile(configTomlPath, original, "utf8");
+      }
+      await fs.rm(backupPath, { force: true });
+    },
+  };
+}

server/src/__tests__/environment-service.test.ts

@@ -300,7 +300,6 @@ describeEmbeddedPostgres("environmentService leases", () => {
     expect((rows[0]?.metadata as Record<string, unknown>)?.managedKubernetesSandbox).toBe(true);
   });
 
-
   it("does not treat a non-kubernetes sandbox environment as the managed k8s env", async () => {
     const companyId = randomUUID();
     await db.insert(companies).values({

server/src/__tests__/heartbeat-accepted-plan-workspace-refresh.test.ts

@@ -737,17 +737,6 @@ describeEmbeddedPostgres("accepted plan workspace refresh", () => {
       createdAt: new Date(),
       updatedAt: new Date(),
     });
-    const planCommentId = randomUUID();
-    await db.insert(issueComments).values({
-      id: planCommentId,
-      companyId,
-      issueId,
-      authorUserId: "board-user-1",
-      authorType: "user",
-      body: "Keep the accepted plan rollout split into separate child tasks.",
-      createdAt: new Date("2026-06-07T00:00:00.000Z"),
-      updatedAt: new Date("2026-06-07T00:00:00.000Z"),
-    });
     await seedAcceptedPlanClaim({
       companyId,
       issueId,
@@ -814,14 +803,5 @@ describeEmbeddedPostgres("accepted plan workspace refresh", () => {
     expect(adapterInput.runtime.sessionId).toBe("accepted-plan-retry-session");
     expect(adapterInput.context.acceptedPlanWakeRouting).toBeUndefined();
     expect(adapterInput.context.paperclipTaskMarkdown).toContain("Create child issues from the approved plan only");
-    expect(adapterInput.context.paperclipTaskMarkdown).toContain("Comments included with the confirmed plan:");
-    expect(adapterInput.context.paperclipTaskMarkdown).toContain(planCommentId);
-    expect(adapterInput.context.paperclipTaskMarkdown).toContain(
-      "Keep the accepted plan rollout split into separate child tasks.",
-    );
-    expect(adapterInput.context.paperclipWake).toEqual(expect.objectContaining({
-      commentIds: [planCommentId],
-      commentContextSource: "accepted_plan_confirmation",
-    }));
   }, 20_000);
 });

server/src/__tests__/heartbeat-context-summary.test.ts

@@ -72,34 +72,6 @@ describe("buildPaperclipTaskMarkdown", () => {
     expect(acceptedConfirmation).not.toContain("- Work mode: \"planning\"");
   });
 
-  it("includes confirmed-plan comments in accepted-plan continuation task context", () => {
-    const acceptedConfirmation = buildPaperclipTaskMarkdown({
-      issue: {
-        id: "issue-1",
-        identifier: "PAP-3404",
-        title: "Plan first",
-        workMode: "planning",
-        description: null,
-      },
-      interaction: {
-        kind: "request_confirmation",
-        status: "accepted",
-      },
-      acceptedPlanComments: [
-        {
-          id: "comment-1",
-          authorType: "user",
-          body: "Please keep the migration backwards compatible.",
-        },
-      ],
-    });
-
-    expect(acceptedConfirmation).toContain("Create child issues from the approved plan only");
-    expect(acceptedConfirmation).toContain("Comments included with the confirmed plan:");
-    expect(acceptedConfirmation).toContain("Comment 1 - user - comment-1:");
-    expect(acceptedConfirmation).toContain("Please keep the migration backwards compatible.");
-  });
-
   it("prefers ordinary comment planning guidance over stale accepted confirmation state", () => {
     const commentWake = buildPaperclipTaskMarkdown({
       issue: {