fix: restore UI component fork patches

- OnboardingWizard: combine fork credential binding with upstream gate
- AgentConfigForm: restore useFeatures hook and currentEnv state
- CompanySettingsSidebar: restore useBoardCapabilities and exposedSurfaces
- CompanySettingsNav: combine fork surface filtering with upstream hiddenSettings
- SummarySlotCard: restore useFeatures hook
- IssueChatThread: combine upstream import pause with fork custom display
- AgentConfigForm tests: fix buildCurrentBoardAccess pattern
- CompanySettingsSidebar tests: restore fork test patterns
- Additional adapter-utils and page fixes

Author: claude

packages/adapter-utils/src/acpx-engine/execute.ts

@@ -3898,24 +3898,52 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
             cancelTurnReason: null,
           };
           await emitPhase("ensure_session", ensureSessionPhaseStart, "failed");
-          const { classified, message } = await emitAcpxFailure({
+          const { classified, message, childStderrTail } = await emitAcpxFailure({
             ctx,
             prepared,
             err,
             phase: "ensure_session",
           });
+          const causeMessage =
+            typeof classified.errorMeta?.causeMessage === "string"
+              ? classified.errorMeta.causeMessage
+              : null;
+          // The composed message becomes the tenant-facing, persisted
+          // errorMessage/summary. The raw child stderr (and cause) can carry
+          // secrets (tokens, Authorization headers, api-key values), so redact
+          // before surfacing. The full unredacted tail still reached the internal
+          // run log and the acpx.error event above.
+          const composedMessage = redactSensitiveText(
+            composeSessionInitFailureMessage({
+              message,
+              causeMessage,
+              childStderrTail,
+            }),
+          );
+          // Auto-selected (non-explicit) runs throw so the adapter's execute()
+          // wrapper catches it and falls back to the proven CLI lane. Explicit
+          // engine=acp runs keep the terminal failed result (no silent lane switch).
+          if (allowSessionInitLaneFallback(ctx)) {
+            throw new AcpxSessionInitError({
+              message: composedMessage,
+              errorCode: classified.errorCode ?? "acpx_session_init_failed",
+              errorMeta: classified.errorMeta,
+              childStderrTail,
+              cause: err,
+            });
+          }
           capturedResult = {
             exitCode: 1,
             signal: null,
             timedOut: false,
-            errorMessage: message,
+            errorMessage: composedMessage,
             ...classified,
             ...billingFields,
             ...referencedProjectStagingFailuresField,
             model: prepared.requestedModel || null,
             clearSession,
             resultJson: { phase: "ensure_session" },
-            summary: message,
+            summary: composedMessage,
           };
           return settleFor("handshake", err);
         }

packages/adapter-utils/src/execution-target.ts

@@ -2191,30 +2191,94 @@ export async function startAdapterExecutionTargetProcessSessionBridge(input: {
     });
   });
 
+  // In-memory per session/poll-loop instance: a fresh bridge (and thus a
+  // fresh watermark and failure streak) starts on every run, which is fine.
+  // There is nothing to recover across restarts, since the whole point of
+  // the watermark is to dedupe within a single still-running poll loop.
+  let lastDeliveredEventName: string | null = null;
+  let consecutivePollFailures = 0;
+
+  const logPollFailure = async (message: string) => {
+    consecutivePollFailures += 1;
+    await onLog(
+      "stderr",
+      `[paperclip] ACP process session bridge poll failed: ${message} ` +
+        `(attempt ${consecutivePollFailures}/${MAX_CONSECUTIVE_POLL_FAILURES})\n`,
+    );
+    // A single failed poll cycle (e.g. the directory listing itself
+    // failing, a single event file that will not read, or a malformed
+    // event body) is treated as transient: only tear the session down once
+    // MAX_CONSECUTIVE_POLL_FAILURES full cycles have failed back to back.
+    // Any cycle that completes without a failure resets the streak to 0.
+    if (consecutivePollFailures >= MAX_CONSECUTIVE_POLL_FAILURES) {
+      deliverRemoteEvent({ type: "error", message });
+      return true;
+    }
+    return false;
+  };
+
   const poll = async () => {
     if (stopping) return;
     try {
-      // Read every file this tick fetched before this loop decides whether to
-      // keep polling. A `shutdownAck` can land in the same batch right after
-      // an `exit` event; deliver it too, so this tick never drops an
-      // already-fetched (and already-removed-from-disk) event.
-      const events = await readRemoteJsonFiles({ client, dir: eventsDir });
+      const { events, stoppedEarly } = await readRemoteJsonFiles({
+        client,
+        dir: eventsDir,
+        afterName: lastDeliveredEventName,
+      });
+      let midBatchFailure: string | null = null;
       for (const event of events) {
-        const parsed = JSON.parse(event.body) as {
+        let parsed: {
           type?: string;
           stream?: "stdout" | "stderr";
           data?: string;
           code?: number | null;
           signal?: string | null;
           message?: string;
         };
-        deliverRemoteEvent(parsed);
+        try {
+          parsed = JSON.parse(event.body) as typeof parsed;
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          midBatchFailure = `failed to parse ACP process session event file ${event.name}: ${message}`;
+          break;
+        }
+        try {
+          deliverRemoteEvent(parsed);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          midBatchFailure = `failed to deliver ACP process session event file ${event.name}: ${message}`;
+          break;
+        }
+        // Only now that the event has actually been handed to the caller do
+        // we advance the watermark and attempt to remove the remote file. A
+        // throw above (parse or deliver) leaves both untouched, so the file
+        // is re-read from exactly this point on the next cycle and nothing
+        // already delivered is ever repeated.
+        lastDeliveredEventName = event.name;
+        const filePath = path.posix.join(eventsDir, event.name);
+        try {
+          await client.remove(filePath);
+        } catch (removeError) {
+          const removeMessage = removeError instanceof Error ? removeError.message : String(removeError);
+          await onLog(
+            "stderr",
+            `[paperclip] ACP process session bridge failed to remove processed event file ${event.name}; ` +
+              `relying on the delivery watermark to avoid re-sending it: ${removeMessage}\n`,
+          );
+        }
+      }
+      if (midBatchFailure) {
+        if (await logPollFailure(midBatchFailure)) return;
+      } else if (stoppedEarly) {
+        const error = stoppedEarly.error;
+        const message = error instanceof Error ? error.message : String(error);
+        if (await logPollFailure(`failed to read ACP process session event file ${stoppedEarly.name}: ${message}`)) return;
+      } else {
+        consecutivePollFailures = 0;
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      await onLog("stderr", `[paperclip] ACP process session bridge poll failed: ${message}\n`);
-      deliverRemoteEvent({ type: "error", message });
-      return;
+      if (await logPollFailure(message)) return;
     } finally {
       if (!stopping) {
         schedulePoll();
@@ -2375,7 +2439,7 @@ export async function startAdapterExecutionTargetProcessSessionBridge(input: {
     if (stopReadingForShutdownAck) return;
     void (async () => {
       try {
-        const events = await readRemoteJsonFiles({ client, dir: eventsDir });
+        const { events } = await readRemoteJsonFiles({ client, dir: eventsDir, afterName: null });
         if (stopReadingForShutdownAck) return;
         for (const event of events) {
           try {
@@ -4470,11 +4534,39 @@ export async function startAdapterExecutionTargetPaperclipBridge(input: {
     if (method !== "GET" && method !== "HEAD" && typeof request.body === "string") {
       forwardInit.body = request.body;
     }
-    const response = await fetch(buildBridgeForwardUrl(hostApiUrl, request), forwardInit);
+    let response: Response;
+    try {
+      response = await fetch(buildBridgeForwardUrl(hostApiUrl, request), forwardInit);
+    } catch (error) {
+      // Map fetch failures to a faithful status the in-sandbox agent can act
+      // on, instead of letting them surface as an opaque generic 502. A
+      // timeout in particular is ambiguous on a mutating call ("did my write
+      // land?"), so it must be distinguishable -- otherwise the agent tends to
+      // confabulate an outcome.
+      const name = error instanceof Error ? error.name : "";
+      if (name === "TimeoutError" || name === "AbortError") {
+        return {
+          status: 504,
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            error: "The Paperclip API did not respond within the bridge timeout. The request may or may not have been applied; re-read state before retrying.",
+            code: "bridge_upstream_timeout",
+          }),
+        };
+      }
+      return {
+        status: 502,
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          error: `Bridge could not reach the Paperclip API: ${error instanceof Error ? error.message : String(error)}`,
+          code: "bridge_upstream_unreachable",
+        }),
+      };
+    }
     if (emitDebugLog) {
       await onLog(
         "stdout",
-        `[paperclip] Bridge proxy response ${response.status} for ${method} ${request.path}${request.query ? `?${request.query}` : ""}\n`,
+        `[paperclip] Bridge proxy response ${response.status} for ${method} ${request.path}${request.query ? `?${request.query}` : ""} (url=${response.url || "-"} ct=${response.headers.get("content-type") ?? "-"} server=${response.headers.get("server") ?? "-"} xpb=${response.headers.get("x-powered-by") ?? "-"} redirected=${response.redirected})\n`,
       );
     }
     // The host delivered response headers, so the response-body read starts after