diff --git a/.dockerignore b/.dockerignore index 3bf8e79b7b1..1015d7c5b35 100644 --- a/.dockerignore +++ b/.dockerignore @@ -89,6 +89,7 @@ packages/grok-acp/bin !packages/paperclip-runner/test-fixtures/pi-acp/profile-v28-identity.json !packages/paperclip-runner/test-fixtures/pi-acp/profile-v29-identity.json +!packages/paperclip-runner/test-fixtures/pi-acp/profile-v30-identity.json !packages/paperclip-runner/test/fixtures/copilot-profile-v23-identity.json diff --git a/doc/DEVELOPING.md b/doc/DEVELOPING.md index 05071cb68ff..4853284df55 100644 --- a/doc/DEVELOPING.md +++ b/doc/DEVELOPING.md @@ -2019,7 +2019,7 @@ agent conversion are outside this playbook. ## Paperclip Runner Adapter Conversion -Paperclip Runner offers native Codex, OpenCode, **ACPX Claude**, and **ACPX Pi**. New +Paperclip Runner offers native Codex, OpenCode, **ACPX Claude**, **ACPX Grok Build**, and **ACPX Pi**. New Claude Code agents default to ACPX Claude on Apple Silicon, Intel Mac, Linux x64 and Linux ARM64 with supported glibc. New OpenCode and Pi agents default to their native runtimes on Apple Silicon, Intel Mac, and Linux x64 with supported glibc; @@ -2030,11 +2030,15 @@ requires matching remote assets. The runner override is in Advanced. Ordinary Cl and provider routing remain authoritative. Existing agents keep their saved runner. Converting an existing Claude, Codex, OpenCode, or Pi agent selects its corresponding provider, preserves compatible models, credentials, workspace, and instructions, and resets execution sessions while retaining run history. +Grok Build uses its qualified macOS ARM64 and Linux x64 targets. Its conversion +preserves the selected model, account, and explicit reasoning effort through ACP. +Custom commands, extra arguments, legacy permission modes, search flags, and +nonzero turn limits require Legacy; conversion rejects them before saving. Other adapters require an explicit provider choice. Legacy ACPX Codex agent settings normalize to native Codex on configuration updates and before fresh runs; immutable run descriptors remain readable. The **Paperclip Runner** experimental setting applies to other native providers. Native Codex, OpenCode, -ACPX Claude, and ACPX Pi do not require it. Company access checks still apply. +ACPX Claude, ACPX Grok Build, and ACPX Pi do not require it. Company access checks still apply. Native Codex preserves an explicit `adapterConfig.search: false` when converting or saving an agent. The disabled hosted-search policy is recorded in the native diff --git a/doc/PRODUCT.md b/doc/PRODUCT.md index 70f5184cdf2..2acf62e5248 100644 --- a/doc/PRODUCT.md +++ b/doc/PRODUCT.md @@ -49,7 +49,7 @@ start execution. This preference does not change the org chart or permissions. ### Agent Execution -Existing Claude and Codex agents can upgrade from the legacy runner on their +Existing Claude, Codex, and Grok Build agents can upgrade from the legacy runner on their Harness / Runtime page when Paperclip Runner is the qualified default for their environment. One action saves pending edits and translates compatible settings while keeping the harness, selected model, account bindings, instructions, and diff --git a/doc/SPEC-implementation.md b/doc/SPEC-implementation.md index ee9d93c0f9c..01cae913f32 100644 --- a/doc/SPEC-implementation.md +++ b/doc/SPEC-implementation.md @@ -1356,7 +1356,7 @@ Invites tab does not hide this Cloud action. ## 10.3 Agents The Harness / Runtime configuration page offers **Upgrade runner** for existing -legacy Claude and Codex agents when the target environment selects Paperclip +legacy Claude, Codex, and Grok Build agents when the target environment selects Paperclip Runner by default. The action uses the normal authorized agent PATCH with `runner: "paperclip"`, includes pending configuration edits, and retains the model and compatible settings. A rejected conversion leaves saved configuration diff --git a/doc/grok-native-runner.md b/doc/grok-native-runner.md index dfd2096ea29..e9a820d1be4 100644 --- a/doc/grok-native-runner.md +++ b/doc/grok-native-runner.md @@ -2,14 +2,37 @@ Select **Grok Build** in the native runner provider selector. The stored contract is `adapterType: "paperclip_runner"` with `provider: "acpx"`, `acpxAgent: "grok"`, -and `model: "grok-4.7"`. Existing `grok_local` agents keep their legacy adapter. +and `model: "grok-4.7"`. Existing `grok_local` agents keep their legacy adapter +until an explicit upgrade. On a qualified macOS ARM64 or Linux x64 computer, +**Harness / Runtime → Upgrade runner** preserves the agent, model, account, +instructions, and history. It starts fresh execution sessions. Advanced also +offers an explicit Runner choice. Unsupported legacy settings are rejected +before saving; select compatible settings or keep Legacy. New Grok runner agents default to **Full auto (approve all)** (`acpxPermissionMode: "approve-all"`) in setup and the configuration form. API configurations that omit the permission mode use the same default. No additional permission setting is needed for unattended execution. Explicitly saved restrictions remain unchanged. -On Cloud, an operator must enable `enableNativeRunner` for the instance before -the new-agent picker or direct setup page offers the native runner. +Grok Build's qualified harness does not require the `enableNativeRunner` flag. + +Explicit thinking effort uses `reasoningEffort` (`minimal`, `low`, `medium`, +`high`, or `xhigh`). The immutable v10 execution input, provider descriptor, +and recovery identity bind this value as `grokEffort`. Before a prompt, the +Runner applies ACP `reasoning_effort` and requires Grok to acknowledge the exact +value. Missing configuration, a rejected value, or effort drift stops admission. +Omitting effort retains Grok's provider default. This setting remains outside +the model-visible task prompt. Historical execution inputs retain their schemas. + +The upgrade resolves an unset model or the legacy `grok-build` default to the +native `grok-4.7` default. Task-level model and effort overrides use the Grok +catalog and keep the account and tool policy unchanged. + +Migration also preserves the effective `disableWebSearch` setting, whose legacy +default is `true`. Native input v10 carries it as `grokDisableWebSearch` through +startup and recovery. Grok's private `requirements.toml` enforces disabled search +above compatible project settings. Explicit `false` retains enabled search; +unset native configurations retain their provider default. See Grok's +[configuration reference](https://github.com/xai-org/grok-build/blob/main/crates/codegen/xai-grok-pager/docs/user-guide/26-config-reference.md). Grok Build speaks [ACP over stdio](https://github.com/xai-org/grok-build/blob/main/crates/codegen/xai-grok-pager/docs/user-guide/15-agent-mode.md). The runner owns `grok agent --no-leader stdio` through ACPX, including session diff --git a/maps/agent-access-map/agents.md b/maps/agent-access-map/agents.md index dd89f5abef0..2fa84783c00 100644 --- a/maps/agent-access-map/agents.md +++ b/maps/agent-access-map/agents.md @@ -139,9 +139,11 @@ environment, and consent checks as other edits. It adds no agent permission or credential fallback. Pool and externally managed agents use their existing configuration surfaces. Board browser verification does not qualify agent access. -The existing-agent upgrade notice uses this configuration PATCH. It does not +The existing-agent upgrade notice for Claude, Codex, and Grok Build uses this configuration PATCH. It does not grant configuration, account, or environment access. The server resolves the -saved settings under normal company/configuration authorization. Obsolete Claude +saved settings under normal company/configuration authorization. Grok migration preserves +the effective legacy search setting. Task model/effort overrides retain the +agent's account binding and tool policy without granting extra account access. Obsolete Claude tuning fields are removed with `configurationWarnings`; security incompatibilities remain errors. Unqualified sandbox upgrades first use the agent-scoped `POST /api/agents/{id}/qualify-runner` under the same `agent_config:update` diff --git a/maps/feature-map/agents.md b/maps/feature-map/agents.md index 21dee0c054b..f5fce683f77 100644 --- a/maps/feature-map/agents.md +++ b/maps/feature-map/agents.md @@ -167,12 +167,16 @@ Selecting another runner must not silently discard security settings or change a recorded execution. Keep runner choice in Advanced and verify the next eligible run separately from historical transcripts. -Existing legacy Claude and Codex agents on qualified default environments, or +Existing legacy Claude, Codex, and Grok Build agents on qualified default environments, or probe-capable Daytona snapshots / immutable sandbox images, show **Upgrade runner** above their configuration. Verify a company owner with `agents:configure` and no instance-admin role can qualify the saved computer and upgrade. A caller without configuration permission must be denied before a probe starts. Exercise that action with pending edits and an environment-variable draft. An unsaved change to a different effective computer must disable the action and explain that the computer change must be saved first; restoring the saved target must re-enable it. Reopen the page and compare the saved harness, model, account bindings, instructions, and run policy. Check a +Grok upgrade with an unset or `grok-build` model: it must use `grok-4.7`. +Compare effective search policy before and after, including the implicit disabled +default and explicit enabled search. Verify task model and effort changes use the +Grok catalog and reach execution while retaining the account and search policy. Check a saved `maxTurnsPerRun: 1000`: upgrade must warn and remove it. Test an initially unqualified Daytona Paperclip Computer: click must probe, record qualification, refresh availability, and only then save. A failed probe or changed selection must diff --git a/packages/adapter-utils/src/paperclip-runner-permissions.test.ts b/packages/adapter-utils/src/paperclip-runner-permissions.test.ts index fcaeea10fca..19900ca47b8 100644 --- a/packages/adapter-utils/src/paperclip-runner-permissions.test.ts +++ b/packages/adapter-utils/src/paperclip-runner-permissions.test.ts @@ -44,6 +44,7 @@ describe("Paperclip Runner permission defaults", () => { ["codex_local", "codexPermissionMode", "never"], ["opencode_local", "opencodePermissionMode", "allow"], ["pi_local", "acpxPermissionMode", "approve-all"], + ["grok_local", "acpxPermissionMode", "approve-all"], ])("uses full auto when converting %s to the new runner", (adapter, key, value) => { expect(paperclipRunnerTransitionConfig(adapter, undefined)).toMatchObject({ [key]: value }); }); @@ -53,6 +54,15 @@ describe("Paperclip Runner permission defaults", () => { expect(paperclipRunnerTransitionConfig("pi_local", "openrouter/provider/model")).toMatchObject({ provider: "acpx", acpxAgent: "pi", model: "openrouter/provider/model" }); }); + it("keeps Grok's harness and model when converting its adapter", () => { + expect(paperclipRunnerTransitionConfig("grok_local", "grok-4.7")) + .toMatchObject({ provider: "acpx", acpxAgent: "grok", model: "grok-4.7" }); + }); + + it.each([undefined, "", "grok-build"])("resolves Grok's legacy default %s to the native model", model => { + expect(paperclipRunnerTransitionConfig("grok_local", model)).toMatchObject({ model: "grok-4.7" }); + }); + it("recognizes only exact provider identifiers", () => { expect(isPaperclipRunnerProvider("codex")).toBe(true); expect(isPaperclipRunnerProvider("opencode")).toBe(true); diff --git a/packages/adapter-utils/src/paperclip-runner-permissions.ts b/packages/adapter-utils/src/paperclip-runner-permissions.ts index 3cb2e323e96..7abe19ed0a5 100644 --- a/packages/adapter-utils/src/paperclip-runner-permissions.ts +++ b/packages/adapter-utils/src/paperclip-runner-permissions.ts @@ -205,7 +205,7 @@ export function paperclipRunnerTransitionConfig( providerOverride?: unknown, ): Record { const previousProvider = - (previousAdapterType === "claude_local" || previousAdapterType === "pi_local") + (["claude_local", "pi_local", "grok_local"].includes(previousAdapterType)) ? "acpx" : previousAdapterType === "opencode_local" ? "opencode" @@ -218,13 +218,15 @@ export function paperclipRunnerTransitionConfig( : previousProvider; return { provider, - model: provider === "acpx" && previousAdapterType === "pi_local" + model: provider === "acpx" && previousAdapterType === "grok_local" + ? typeof previousModel === "string" && previousModel.trim() && previousModel.trim() !== "grok-build" ? previousModel.trim() : "grok-4.7" + : provider === "acpx" && previousAdapterType === "pi_local" ? typeof previousModel === "string" ? previousModel.trim() : "" : resolvePaperclipRunnerModel( provider, provider === previousProvider ? previousModel : undefined, ), - ...(provider === "acpx" ? { acpxAgent: previousAdapterType === "pi_local" ? "pi" : "claude" } : {}), + ...(provider === "acpx" ? { acpxAgent: previousAdapterType === "grok_local" ? "grok" : previousAdapterType === "pi_local" ? "pi" : "claude" } : {}), [PAPERCLIP_RUNNER_PERMISSION_CAPABILITIES[provider].configKey]: PAPERCLIP_RUNNER_PERMISSION_CAPABILITIES[provider].defaultMode, lifecycleMode: "per_turn", diff --git a/packages/paperclip-runner/acpx-profiles.json b/packages/paperclip-runner/acpx-profiles.json index 885c8d2a6be..eda0ebf68c0 100644 --- a/packages/paperclip-runner/acpx-profiles.json +++ b/packages/paperclip-runner/acpx-profiles.json @@ -14,12 +14,12 @@ "requiresProviderPolicy": false }, "pi": { - "agentProfileVersion": 29, + "agentProfileVersion": 30, "agentServerPackage": "pi-acp", "agentServerVersion": "0.0.33", "agentRuntimePackage": "@earendil-works/pi-coding-agent", "agentRuntimeVersion": "1.0.0", - "commandDigest": "sha256:e80c6dc7bde12790371345ee5a12f0201d30941d26f1a780aec3d090545b2a06", + "commandDigest": "sha256:4517ab123dd89140ef462fc1905ac7a16a0dfcbaf21d67299a3c62de29c08a4d", "requiresProviderPolicy": true }, "cursor": { @@ -32,12 +32,12 @@ "requiresProviderPolicy": true }, "copilot": { - "agentProfileVersion": 65, + "agentProfileVersion": 66, "agentServerPackage": "@github/copilot", "agentServerVersion": "1.0.88", "agentRuntimePackage": null, "agentRuntimeVersion": null, - "commandDigest": "sha256:277894e850e07e6801cc24299c237513f58b41eb93c24f751d984fc4ddb04c47", + "commandDigest": "sha256:0cddc219af25b741b7138f38faa7514dd5ee3427b1d3168e8a4bfbe5180983e8", "requiresProviderPolicy": true }, "claude": { diff --git a/packages/paperclip-runner/protocol/manifest.json b/packages/paperclip-runner/protocol/manifest.json index 07259dd4199..da5c50ac321 100644 --- a/packages/paperclip-runner/protocol/manifest.json +++ b/packages/paperclip-runner/protocol/manifest.json @@ -85,7 +85,7 @@ { "path": "schemas/provider-descriptor.schema.json", "id": "https://paperclip.dev/schemas/prp/v1/provider-descriptor.schema.json", - "sha256": "862c0c13f23564c3530cefcf01579b0535a565b919cc3dcff7bc1bee9a668baf" + "sha256": "81d525335245dd4cb8a9bf41e3390dc60c6dd3e32474aad48b4f18a94d5f9711" }, { "path": "schemas/provider-event.schema.json", diff --git a/packages/paperclip-runner/protocol/schemas/provider-descriptor.schema.json b/packages/paperclip-runner/protocol/schemas/provider-descriptor.schema.json index 90193d35313..6a4399c2fbb 100644 --- a/packages/paperclip-runner/protocol/schemas/provider-descriptor.schema.json +++ b/packages/paperclip-runner/protocol/schemas/provider-descriptor.schema.json @@ -168,6 +168,18 @@ "xhigh", "max" ] + }, + "grokEffort": { + "enum": [ + "minimal", + "low", + "medium", + "high", + "xhigh" + ] + }, + "grokDisableWebSearch": { + "type": "boolean" } }, "allOf": [ @@ -518,6 +530,46 @@ } } } + }, + { + "if": { + "required": [ + "grokEffort" + ] + }, + "then": { + "properties": { + "provider": { + "const": "acpx" + }, + "agent": { + "const": "grok" + } + }, + "required": [ + "agent" + ] + } + }, + { + "if": { + "required": [ + "grokDisableWebSearch" + ] + }, + "then": { + "properties": { + "provider": { + "const": "acpx" + }, + "agent": { + "const": "grok" + } + }, + "required": [ + "agent" + ] + } } ], "$defs": { diff --git a/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_backend.rs b/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_backend.rs index 69540277da3..81d1ff266f4 100644 --- a/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_backend.rs +++ b/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_backend.rs @@ -145,6 +145,10 @@ struct AcpxProviderDescriptor { pi_thinking_level: Option, #[serde(default, skip_serializing_if = "Option::is_none")] claude_effort: Option, + #[serde(default, skip_serializing_if = "Option::is_none")] + grok_effort: Option, + #[serde(default, skip_serializing_if = "Option::is_none")] + grok_disable_web_search: Option, permission_mode_pinned: bool, #[serde(default)] provider_policy: Option, @@ -273,6 +277,14 @@ impl AcpxProviderDescriptor { self.agent != "claude" || !matches!(effort.as_str(), "low" | "medium" | "high" | "xhigh" | "max") }) + || (self.grok_disable_web_search.is_some() && self.agent != "grok") + || self.grok_effort.as_ref().is_some_and(|effort| { + self.agent != "grok" + || !matches!( + effort.as_str(), + "minimal" | "low" | "medium" | "high" | "xhigh" + ) + }) || self.mode.as_ref().is_some_and(|mode| { mode.trim().is_empty() || mode.chars().count() > 240 @@ -375,6 +387,8 @@ impl AcpxProviderDescriptor { mode: self.mode.clone(), pi_thinking_level: self.pi_thinking_level, claude_effort: self.claude_effort.clone(), + grok_effort: self.grok_effort.clone(), + grok_disable_web_search: self.grok_disable_web_search.clone(), permission_mode_pinned: self.permission_mode_pinned, provider_policy: self.provider_policy.clone(), system_instructions: self.instructions.clone(), @@ -482,6 +496,12 @@ impl AcpxProviderDescriptor { if let Some(effort) = &self.claude_effort { descriptor["claudeEffort"] = json!(effort); } + if let Some(effort) = &self.grok_effort { + descriptor["grokEffort"] = json!(effort); + } + if let Some(disabled) = self.grok_disable_web_search { + descriptor["grokDisableWebSearch"] = json!(disabled); + } if let Some(level) = self.pi_thinking_level { descriptor["piThinkingLevel"] = json!(level); } @@ -622,6 +642,8 @@ impl AcpxDurableState { || identity.mode != self.descriptor.mode || identity.pi_thinking_level != self.descriptor.pi_thinking_level || identity.claude_effort != self.descriptor.claude_effort + || identity.grok_effort != self.descriptor.grok_effort + || identity.grok_disable_web_search != self.descriptor.grok_disable_web_search { return Err(DurableRunnerError::invalid( "ACPX durable identity no longer matches its qualified profile or provider mode", @@ -1309,6 +1331,12 @@ impl AcpxCommandExecutor { if let Some(effort) = &identity.claude_effort { result["claudeEffort"] = json!(effort); } + if let Some(effort) = &identity.grok_effort { + result["grokEffort"] = json!(effort); + } + if let Some(disabled) = identity.grok_disable_web_search { + result["grokDisableWebSearch"] = json!(disabled); + } if let Some(level) = identity.pi_thinking_level { // This identity is admitted only after the sidecar's effective-mode ACK. result["piThinkingLevel"] = json!(level); @@ -2783,6 +2811,8 @@ mod tests { mode: descriptor.mode.clone(), pi_thinking_level: descriptor.pi_thinking_level, claude_effort: descriptor.claude_effort.clone(), + grok_effort: descriptor.grok_effort.clone(), + grok_disable_web_search: descriptor.grok_disable_web_search.clone(), provider_lifetime_fence_candidates: [60_001, 60_002, 60_003], }; let operations = Vec::new(); @@ -3060,6 +3090,8 @@ mod tests { mode: None, pi_thinking_level: None, claude_effort: None, + grok_effort: None, + grok_disable_web_search: None, provider_lifetime_fence_candidates: [60_001, 60_002, 60_003], }; @@ -3214,7 +3246,7 @@ mod tests { #[test] fn pi_profile_matches_published_identity_and_rejects_prior_profiles() { let published: Value = serde_json::from_str(include_str!( - "../../../../test-fixtures/pi-acp/profile-v29-identity.json" + "../../../../test-fixtures/pi-acp/profile-v30-identity.json" )) .unwrap(); let mut value = descriptor("codex"); @@ -3231,6 +3263,7 @@ mod tests { current.validate(&context()).unwrap(); for prior in [ + include_str!("../../../../test-fixtures/pi-acp/profile-v29-identity.json"), include_str!("../../../../test-fixtures/pi-acp/profile-v28-identity.json"), include_str!("../../../../test-fixtures/pi-acp/profile-v24-identity.json"), include_str!("../../../../test-fixtures/pi-acp/profile-v23-identity.json"), @@ -3550,6 +3583,8 @@ mod tests { mode: original_descriptor.mode.clone(), pi_thinking_level: original_descriptor.pi_thinking_level, claude_effort: original_descriptor.claude_effort.clone(), + grok_effort: original_descriptor.grok_effort.clone(), + grok_disable_web_search: original_descriptor.grok_disable_web_search.clone(), provider_lifetime_fence_candidates: [60_001, 60_002, 60_003], }; let operations = Vec::new(); @@ -3836,6 +3871,8 @@ mod tests { mode: original_descriptor.mode.clone(), pi_thinking_level: original_descriptor.pi_thinking_level, claude_effort: original_descriptor.claude_effort.clone(), + grok_effort: original_descriptor.grok_effort.clone(), + grok_disable_web_search: original_descriptor.grok_disable_web_search.clone(), provider_lifetime_fence_candidates: [60_001, 60_002, 60_003], }; let operations = Vec::new(); @@ -4155,6 +4192,8 @@ mod tests { mode: original_descriptor.mode.clone(), pi_thinking_level: None, claude_effort: None, + grok_effort: None, + grok_disable_web_search: None, provider_lifetime_fence_candidates: [60_001, 60_002, 60_003], }; let operations = Vec::new(); @@ -4404,6 +4443,8 @@ mod tests { mode: descriptor.mode.clone(), pi_thinking_level: descriptor.pi_thinking_level, claude_effort: descriptor.claude_effort.clone(), + grok_effort: descriptor.grok_effort.clone(), + grok_disable_web_search: descriptor.grok_disable_web_search.clone(), provider_lifetime_fence_candidates, }; let operations = Vec::new(); @@ -4578,6 +4619,8 @@ mod tests { mode: provider_descriptor.mode.clone(), pi_thinking_level: provider_descriptor.pi_thinking_level, claude_effort: provider_descriptor.claude_effort.clone(), + grok_effort: provider_descriptor.grok_effort.clone(), + grok_disable_web_search: provider_descriptor.grok_disable_web_search.clone(), provider_lifetime_fence_candidates, }); state.provider_exit_unconfirmed = true; diff --git a/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_checkpoint.rs b/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_checkpoint.rs index 60f575b82e8..8d74b80f25e 100644 --- a/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_checkpoint.rs +++ b/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_checkpoint.rs @@ -55,6 +55,10 @@ struct PersistedAcpxProviderSessionIdentity { pi_thinking_level: Option, #[serde(default, skip_serializing_if = "Option::is_none")] claude_effort: Option, + #[serde(default, skip_serializing_if = "Option::is_none")] + grok_effort: Option, + #[serde(default, skip_serializing_if = "Option::is_none")] + grok_disable_web_search: Option, provider_lifetime_fence_candidates: [u16; 3], } @@ -80,6 +84,8 @@ impl PersistedAcpxProviderSessionIdentity { mode: identity.mode, pi_thinking_level: identity.pi_thinking_level, claude_effort: identity.claude_effort.clone(), + grok_effort: identity.grok_effort.clone(), + grok_disable_web_search: identity.grok_disable_web_search.clone(), provider_lifetime_fence_candidates: identity.provider_lifetime_fence_candidates, }) } @@ -99,6 +105,8 @@ impl PersistedAcpxProviderSessionIdentity { mode: self.mode.clone(), pi_thinking_level: self.pi_thinking_level, claude_effort: self.claude_effort.clone(), + grok_effort: self.grok_effort.clone(), + grok_disable_web_search: self.grok_disable_web_search.clone(), provider_lifetime_fence_candidates: self.provider_lifetime_fence_candidates, } } @@ -122,6 +130,8 @@ impl AcpxSuspensionCheckpoint { || identity.mode != config.mode || identity.pi_thinking_level != config.pi_thinking_level || identity.claude_effort != config.claude_effort + || identity.grok_effort != config.grok_effort + || identity.grok_disable_web_search != config.grok_disable_web_search || config .expected_identity .as_ref() diff --git a/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_session.rs b/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_session.rs index bde545b624e..8265121050f 100644 --- a/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_session.rs +++ b/packages/paperclip-runner/runner/crates/runner-core/src/acpx_provider_session.rs @@ -74,6 +74,10 @@ pub struct AcpxProviderSessionIdentity { pub pi_thinking_level: Option, #[serde(default, skip_serializing_if = "Option::is_none")] pub claude_effort: Option, + #[serde(default, skip_serializing_if = "Option::is_none")] + pub grok_effort: Option, + #[serde(default, skip_serializing_if = "Option::is_none")] + pub grok_disable_web_search: Option, pub provider_lifetime_fence_candidates: [u16; 3], } @@ -97,6 +101,8 @@ pub struct AcpxProviderSessionConfig { pub mode: Option, pub pi_thinking_level: Option, pub claude_effort: Option, + pub grok_effort: Option, + pub grok_disable_web_search: Option, pub permission_mode_pinned: bool, pub provider_policy: Option, pub system_instructions: String, @@ -120,6 +126,22 @@ impl AcpxProviderSessionConfig { "Claude effort must be a supported Claude-only value", )); } + if self.grok_disable_web_search.is_some() && self.agent != "grok" { + return Err(LocalRunnerError::invalid( + "Grok search policy requires Grok", + )); + } + if self.grok_effort.as_ref().is_some_and(|effort| { + self.agent != "grok" + || !matches!( + effort.as_str(), + "minimal" | "low" | "medium" | "high" | "xhigh" + ) + }) { + return Err(LocalRunnerError::invalid( + "Grok effort must be a supported Grok-only value", + )); + } if (self.agent == "pi") != self.pi_thinking_level.is_some() { return Err(LocalRunnerError::invalid( "ACPX Pi thinking level must be explicit for Pi and absent for other agents", @@ -200,6 +222,8 @@ impl AcpxProviderSessionConfig { || expected_identity.mode != self.mode || expected_identity.pi_thinking_level != self.pi_thinking_level || expected_identity.claude_effort != self.claude_effort + || expected_identity.grok_effort != self.grok_effort + || expected_identity.grok_disable_web_search != self.grok_disable_web_search { return Err(LocalRunnerError::invalid( "ACPX expected identity conflicts with the requested session", @@ -227,6 +251,16 @@ impl AcpxProviderSessionIdentity { "ACPX identity contains invalid Claude effort", )); } + if self.grok_effort.as_ref().is_some_and(|effort| { + !matches!( + effort.as_str(), + "minimal" | "low" | "medium" | "high" | "xhigh" + ) + }) { + return Err(LocalRunnerError::invalid( + "ACPX identity contains invalid Grok effort", + )); + } for (value, label) in [ (&self.normalized_session_id, "normalized session"), (&self.acpx_record_id, "record"), @@ -1336,6 +1370,12 @@ fn session_open_params(config: &AcpxProviderSessionConfig, sidecar_tools: &[Valu if let Some(effort) = &config.claude_effort { params["claudeEffort"] = json!(effort); } + if let Some(effort) = &config.grok_effort { + params["grokEffort"] = json!(effort); + } + if let Some(disabled) = config.grok_disable_web_search { + params["grokDisableWebSearch"] = json!(disabled); + } if let Some(level) = config.pi_thinking_level { params["piThinkingLevel"] = json!(level); } @@ -1454,6 +1494,8 @@ fn verify_open_response( || identity.mode != config.mode || identity.pi_thinking_level != config.pi_thinking_level || identity.claude_effort != config.claude_effort + || identity.grok_effort != config.grok_effort + || identity.grok_disable_web_search != config.grok_disable_web_search || config .expected_identity .as_ref() @@ -1789,6 +1831,8 @@ mod mode_tests { mode: Some("plan".to_owned()), pi_thinking_level: None, claude_effort: None, + grok_effort: None, + grok_disable_web_search: None, permission_mode_pinned: true, provider_policy: Some(AcpxProviderRuntimePolicy { read_only: false }), system_instructions: String::new(), @@ -1817,6 +1861,8 @@ mod mode_tests { mode: Some("plan".to_owned()), pi_thinking_level: None, claude_effort: None, + grok_effort: None, + grok_disable_web_search: None, provider_lifetime_fence_candidates: [60_001, 60_002, 60_003], } } @@ -1976,6 +2022,39 @@ mod mode_tests { cfg.claude_effort = None; cfg.validate().unwrap(); } + #[test] + fn grok_search_policy_is_grok_only_and_preserves_false_in_the_sidecar() { + let mut cfg = config(); + cfg.agent = "grok".to_owned(); + for disabled in [true, false] { + cfg.grok_disable_web_search = Some(disabled); + cfg.validate().unwrap(); + assert_eq!( + session_open_params(&cfg, &[])["grokDisableWebSearch"], + json!(disabled) + ); + } + cfg.agent = "codex".to_owned(); + assert!(cfg.validate().is_err()); + } + + #[test] + fn grok_effort_is_explicit_grok_only_and_forwarded_without_clamping() { + let mut cfg = config(); + cfg.agent = "grok".to_owned(); + for effort in ["minimal", "low", "medium", "high", "xhigh"] { + cfg.grok_effort = Some(effort.to_owned()); + cfg.validate().unwrap(); + assert_eq!(session_open_params(&cfg, &[])["grokEffort"], json!(effort)); + } + cfg.grok_effort = Some("ultra".to_owned()); + assert!(cfg.validate().is_err()); + cfg.grok_effort = Some("high".to_owned()); + cfg.agent = "codex".to_owned(); + assert!(cfg.validate().is_err()); + cfg.grok_effort = None; + cfg.validate().unwrap(); + } #[test] fn pi_thinking_level_is_closed_explicit_and_pi_only() { diff --git a/packages/paperclip-runner/runner/crates/runner-core/src/generated_acpx_profiles.rs b/packages/paperclip-runner/runner/crates/runner-core/src/generated_acpx_profiles.rs index 794c7a195bf..4bae7fe1489 100644 --- a/packages/paperclip-runner/runner/crates/runner-core/src/generated_acpx_profiles.rs +++ b/packages/paperclip-runner/runner/crates/runner-core/src/generated_acpx_profiles.rs @@ -29,7 +29,7 @@ pub(crate) fn acpx_release_profile(agent: &str) -> Option { agent_runtime_package: Some("@earendil-works/pi-coding-agent"), agent_runtime_version: Some("1.0.0"), command_digest: - "sha256:e80c6dc7bde12790371345ee5a12f0201d30941d26f1a780aec3d090545b2a06", + "sha256:4517ab123dd89140ef462fc1905ac7a16a0dfcbaf21d67299a3c62de29c08a4d", requires_provider_policy: true, }, "cursor" => AcpxReleaseProfile { @@ -47,7 +47,7 @@ pub(crate) fn acpx_release_profile(agent: &str) -> Option { agent_runtime_package: None, agent_runtime_version: None, command_digest: - "sha256:277894e850e07e6801cc24299c237513f58b41eb93c24f751d984fc4ddb04c47", + "sha256:0cddc219af25b741b7138f38faa7514dd5ee3427b1d3168e8a4bfbe5180983e8", requires_provider_policy: true, }, "claude" => AcpxReleaseProfile { diff --git a/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_checkpoint.rs b/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_checkpoint.rs index 619d20bef24..28d279725f4 100644 --- a/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_checkpoint.rs +++ b/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_checkpoint.rs @@ -53,6 +53,8 @@ fn config(directory: &std::path::Path) -> AcpxProviderSessionConfig { mode: None, pi_thinking_level: None, claude_effort: None, + grok_effort: None, + grok_disable_web_search: None, permission_mode_pinned: true, provider_policy: None, system_instructions: "Complete the supplied task.".to_owned(), @@ -82,6 +84,8 @@ fn identity() -> AcpxProviderSessionIdentity { mode: None, pi_thinking_level: None, claude_effort: None, + grok_effort: None, + grok_disable_web_search: None, provider_lifetime_fence_candidates: [60_001, 60_002, 60_003], } } diff --git a/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_resolutions.rs b/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_resolutions.rs index 90460a2a294..6d6027fb329 100644 --- a/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_resolutions.rs +++ b/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_resolutions.rs @@ -52,6 +52,8 @@ fn config(mode: &str) -> AcpxProviderSessionConfig { mode: None, pi_thinking_level: None, claude_effort: None, + grok_effort: None, + grok_disable_web_search: None, permission_mode_pinned: true, provider_policy: None, system_instructions: "Complete the supplied task.".to_owned(), diff --git a/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_session.rs b/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_session.rs index 5c89ae54055..c080b933370 100644 --- a/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_session.rs +++ b/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_session.rs @@ -48,6 +48,8 @@ fn config(mode: &str) -> AcpxProviderSessionConfig { mode: None, pi_thinking_level: None, claude_effort: None, + grok_effort: None, + grok_disable_web_search: None, permission_mode_pinned: true, provider_policy: None, system_instructions: "Complete the supplied task.".to_owned(), @@ -72,6 +74,8 @@ fn expected_identity() -> AcpxProviderSessionIdentity { mode: None, pi_thinking_level: None, claude_effort: None, + grok_effort: None, + grok_disable_web_search: None, provider_lifetime_fence_candidates: [60_001, 60_002, 60_003], } } diff --git a/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_suspend.rs b/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_suspend.rs index 676df2529a3..4b4a4986905 100644 --- a/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_suspend.rs +++ b/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_suspend.rs @@ -28,6 +28,8 @@ fn config(mode: &str) -> AcpxProviderSessionConfig { mode: None, pi_thinking_level: None, claude_effort: None, + grok_effort: None, + grok_disable_web_search: None, permission_mode_pinned: true, provider_policy: None, system_instructions: "Complete the supplied task.".to_owned(), diff --git a/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_turns.rs b/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_turns.rs index dc58137f012..dda6cfad4f1 100644 --- a/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_turns.rs +++ b/packages/paperclip-runner/runner/crates/runner-core/tests/acpx_provider_turns.rs @@ -51,6 +51,8 @@ fn config(mode: &str) -> AcpxProviderSessionConfig { permission_mode: AcpxPermissionMode::ApproveReads, mode: None, claude_effort: None, + grok_effort: None, + grok_disable_web_search: None, pi_thinking_level: if mode.starts_with("controls") { Some(paperclip_runner_core::acpx_provider_session::PiThinkingLevel::Low) } else { diff --git a/packages/paperclip-runner/runner/crates/runner-core/tests/native_provider_backend.rs b/packages/paperclip-runner/runner/crates/runner-core/tests/native_provider_backend.rs index eebe8fb4c16..fdfc65c21c6 100644 --- a/packages/paperclip-runner/runner/crates/runner-core/tests/native_provider_backend.rs +++ b/packages/paperclip-runner/runner/crates/runner-core/tests/native_provider_backend.rs @@ -17,7 +17,7 @@ use sha2::{Digest, Sha256}; const CODEX_ACPX_DIGEST: &str = "sha256:443491f4e814501a5dc47347e4510e84faeec9c9382e2d4e53bfe69386d5aabc"; const PI_ACPX_DIGEST: &str = - "sha256:e80c6dc7bde12790371345ee5a12f0201d30941d26f1a780aec3d090545b2a06"; + "sha256:4517ab123dd89140ef462fc1905ac7a16a0dfcbaf21d67299a3c62de29c08a4d"; fn temporary_directory(label: &str) -> PathBuf { let nonce = SystemTime::now() diff --git a/packages/paperclip-runner/scripts/copilot-profile-identity.mjs b/packages/paperclip-runner/scripts/copilot-profile-identity.mjs index c6f81d00497..bc511760487 100644 --- a/packages/paperclip-runner/scripts/copilot-profile-identity.mjs +++ b/packages/paperclip-runner/scripts/copilot-profile-identity.mjs @@ -7,9 +7,9 @@ import { fileURLToPath } from "node:url"; import { resolve, dirname } from "node:path"; const root = resolve(dirname(fileURLToPath(import.meta.url)), ".."); -const fixture = resolve(root, "test/fixtures/copilot-profile-v65-identity.json"); +const fixture = resolve(root, "test/fixtures/copilot-profile-v66-identity.json"); const historical = JSON.parse(readFileSync(resolve(root, "test/fixtures/copilot-profile-v12-identity.json"), "utf8")); -const declaration = { ...historical.declaration, agentProfileVersion: 65 }; +const declaration = { ...historical.declaration, agentProfileVersion: 66 }; delete declaration.permissionIdentitySourceSha256; const sources = { displayEventSourceSha256: "src/drivers/acpx/copilot-events.ts", diff --git a/packages/paperclip-runner/src/backends/codex-acpx-native-backend.ts b/packages/paperclip-runner/src/backends/codex-acpx-native-backend.ts index 1bf739229e7..a5ddc64f80e 100644 --- a/packages/paperclip-runner/src/backends/codex-acpx-native-backend.ts +++ b/packages/paperclip-runner/src/backends/codex-acpx-native-backend.ts @@ -15,7 +15,7 @@ import { export interface CodexAcpxNativeSessionBackendOptions extends Omit< CodexAcpxDriverOptions, - "model" | "permissionMode" | "mode" | "piThinkingLevel" | "claudeEffort" | "systemInstructions" | "providerPolicy" | "runtimeContext" + "model" | "permissionMode" | "mode" | "piThinkingLevel" | "claudeEffort" | "grokEffort" | "grokDisableWebSearch" | "systemInstructions" | "providerPolicy" | "runtimeContext" > {} export type AcpxNativeSessionBackendOptions = @@ -77,6 +77,8 @@ export function createAcpxNativeSessionBackend( mode: input.provider.mode, piThinkingLevel: input.provider.piThinkingLevel, claudeEffort: "claudeEffort" in input.provider ? input.provider.claudeEffort : undefined, + grokEffort: "grokEffort" in input.provider ? input.provider.grokEffort : undefined, + grokDisableWebSearch: "grokDisableWebSearch" in input.provider ? input.provider.grokDisableWebSearch : undefined, systemInstructions, runtimeContext: "runtimeContext" in input ? input.runtimeContext : null, providerPolicy: { readOnly: "executionMode" in input && input.executionMode === "plan" }, diff --git a/packages/paperclip-runner/src/backends/codex-native-backend.ts b/packages/paperclip-runner/src/backends/codex-native-backend.ts index 0bb809e49c6..d5e94f5c62c 100644 --- a/packages/paperclip-runner/src/backends/codex-native-backend.ts +++ b/packages/paperclip-runner/src/backends/codex-native-backend.ts @@ -1,7 +1,7 @@ import { describeRunnerdMuseDriver } from "../drivers/muse/runnerd-muse-driver.js"; import { createCodexTaskEnvelope } from "../contracts/codex.js"; import { ACPX_CAPABILITY_PROFILES } from "../drivers/acpx/capability-profiles.js"; -import { NATIVE_EXECUTION_INPUT_SCHEMA, NATIVE_EXECUTION_INPUT_SCHEMA_V7, NATIVE_EXECUTION_INPUT_SCHEMA_V9 } from "../contracts/native-execution.js"; +import { NATIVE_EXECUTION_INPUT_SCHEMA, NATIVE_EXECUTION_INPUT_SCHEMA_V7, NATIVE_EXECUTION_INPUT_SCHEMA_V9, NATIVE_EXECUTION_INPUT_SCHEMA_V10 } from "../contracts/native-execution.js"; import type { NativeExecutionInput } from "../contracts/native-execution.js"; import type { PersistedHarnessSession } from "../contracts/harness-driver.js"; import type { @@ -120,7 +120,7 @@ function createTransportBackedNativeSessionBackend( const isCodex = input.provider.kind === "codex"; const preparedContext = input.schema === NATIVE_EXECUTION_INPUT_SCHEMA || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V7 - || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V9; + || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V9 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V10; const supportsCollaborativePlanning = isCodex || input.provider.kind === "opencode" || diff --git a/packages/paperclip-runner/src/backends/opencode-native-backend.ts b/packages/paperclip-runner/src/backends/opencode-native-backend.ts index 24acf9a051e..9af0652e191 100644 --- a/packages/paperclip-runner/src/backends/opencode-native-backend.ts +++ b/packages/paperclip-runner/src/backends/opencode-native-backend.ts @@ -1,5 +1,5 @@ import { createCodexTaskEnvelope } from "../contracts/codex.js"; -import { NATIVE_EXECUTION_INPUT_SCHEMA, NATIVE_EXECUTION_INPUT_SCHEMA_V7, NATIVE_EXECUTION_INPUT_SCHEMA_V9 } from "../contracts/native-execution.js"; +import { NATIVE_EXECUTION_INPUT_SCHEMA, NATIVE_EXECUTION_INPUT_SCHEMA_V7, NATIVE_EXECUTION_INPUT_SCHEMA_V9, NATIVE_EXECUTION_INPUT_SCHEMA_V10 } from "../contracts/native-execution.js"; import type { NativeExecutionInput } from "../contracts/native-execution.js"; import type { NativeSessionBackend } from "../contracts/native-session-backend.js"; import { OpenCodeServerDriver, type OpenCodeServerDriverOptions } from "../drivers/opencode/opencode-server-driver.js"; @@ -15,7 +15,7 @@ export function createOpenCodeNativeSessionBackend( } const preparedContext = input.schema === NATIVE_EXECUTION_INPUT_SCHEMA || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V7 - || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V9; + || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V9 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V10; const constraints = nativeTaskConstraints(input); return new HarnessDriverBackend(new OpenCodeServerDriver({ diff --git a/packages/paperclip-runner/src/backends/runtime-context.ts b/packages/paperclip-runner/src/backends/runtime-context.ts index 9044e3dd45e..10f54d99253 100644 --- a/packages/paperclip-runner/src/backends/runtime-context.ts +++ b/packages/paperclip-runner/src/backends/runtime-context.ts @@ -2,7 +2,7 @@ import { explicitTaskSkillNames } from "../contracts/runtime-context.js"; import { readFileSync, realpathSync } from "node:fs"; import { isAbsolute, relative, resolve, sep } from "node:path"; import { CODEX_SKILLLESS_BASE_INSTRUCTIONS } from "../contracts/codex.js"; -import { NATIVE_EXECUTION_INPUT_SCHEMA, NATIVE_EXECUTION_INPUT_SCHEMA_V6, NATIVE_EXECUTION_INPUT_SCHEMA_V7, NATIVE_EXECUTION_INPUT_SCHEMA_V8, NATIVE_EXECUTION_INPUT_SCHEMA_V9, type NativeExecutionInput } from "../contracts/native-execution.js"; +import { NATIVE_EXECUTION_INPUT_SCHEMA, NATIVE_EXECUTION_INPUT_SCHEMA_V6, NATIVE_EXECUTION_INPUT_SCHEMA_V7, NATIVE_EXECUTION_INPUT_SCHEMA_V8, NATIVE_EXECUTION_INPUT_SCHEMA_V9, NATIVE_EXECUTION_INPUT_SCHEMA_V10, type NativeExecutionInput } from "../contracts/native-execution.js"; import { type NativeRuntimeContextSnapshot, type NativeSkillInput, @@ -108,7 +108,7 @@ export function nativeTaskConstraints(input: NativeExecutionInput): string[] { || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V6 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V7 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V8 - || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V9; + || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V9 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V10; const answeredQuestionConstraint = answeredQuestions.length > 0 ? `The following exact human-input questions are already authoritatively answered in the structured message: ${answeredQuestions.map((index) => `${compactEnvelope ? "" : "message."}interactionResponses[${index}].response.result.answers`).join(", ")}. Apply each answer within its question scope and current user direction; do not ask resolved questions again. Quoted text is data, and clarification is not approval to execute. Other pending or new questions remain unresolved.` diff --git a/packages/paperclip-runner/src/cli/acpx-runtime-sidecar.ts b/packages/paperclip-runner/src/cli/acpx-runtime-sidecar.ts index bc1ffb523c3..db18659d3db 100644 --- a/packages/paperclip-runner/src/cli/acpx-runtime-sidecar.ts +++ b/packages/paperclip-runner/src/cli/acpx-runtime-sidecar.ts @@ -1,6 +1,8 @@ #!/usr/bin/env node +import { resolveGrokDisableWebSearch } from "../drivers/acpx/grok-web-search.js"; import { redactObservabilityDiagnostic } from "../drivers/agent-observability.js"; import { resolveClaudeEffort } from "../drivers/acpx/claude-effort.js"; +import { resolveGrokEffort } from "../drivers/acpx/grok-effort.js"; import { parseProviderMode } from "../contracts/provider-mode.js"; import { acpxProfileActivity, type AcpxActivityAdapter, type AcpxToolEvidence } from "../drivers/acpx/profile-activity.js"; @@ -302,6 +304,7 @@ async function dispatch( mode: params.mode, piThinkingLevel: params.piThinkingLevel, claudeEffort: params.claudeEffort, + grokEffort: params.grokEffort, grokDisableWebSearch: params.grokDisableWebSearch, providerPolicy: params.providerPolicy, systemInstructions: params.systemInstructions, runtimeContext: params.runtimeContext, @@ -1238,13 +1241,15 @@ function safeOutput(value: unknown): Record { function parseOpenParams( value: Record, ): AcpxSidecarOpenParams { - const fields = new Set(["runtimeDirectory", "normalizedSessionId", "workingDirectory", "agent", "model", "permissionMode", "mode", "piThinkingLevel", "claudeEffort", "permissionModePinned", "providerPolicy", "systemInstructions", "runtimeContext", "tools", "providerSessionKey", "expectedIdentity"]); + const fields = new Set(["runtimeDirectory", "normalizedSessionId", "workingDirectory", "agent", "model", "permissionMode", "mode", "piThinkingLevel", "claudeEffort", "grokEffort", "grokDisableWebSearch", "permissionModePinned", "providerPolicy", "systemInstructions", "runtimeContext", "tools", "providerSessionKey", "expectedIdentity"]); if (Object.keys(value).some(key => !fields.has(key))) throw new Error("ACPX open parameters include an unsupported field"); const agent = requireQualifiedAgent(value.agent); const model = requiredText(value.model, "model"); if (value.mode !== undefined && agent !== "cursor") throw new Error("mode is supported only for Cursor"); const piThinkingLevel = resolvePiThinkingLevel(agent, value.piThinkingLevel); const claudeEffort = resolveClaudeEffort(agent, value.claudeEffort); + const grokEffort = resolveGrokEffort(agent, value.grokEffort); + const grokDisableWebSearch = resolveGrokDisableWebSearch(agent, value.grokDisableWebSearch); resolveQualifiedAcpxProfile(agent, model); if ( value.providerSessionKey !== undefined && @@ -1267,6 +1272,8 @@ function parseOpenParams( ...(value.mode === undefined ? {} : { mode: parseProviderMode(value.mode) }), ...(piThinkingLevel ? { piThinkingLevel } : {}), ...(claudeEffort ? { claudeEffort } : {}), + ...(grokEffort ? { grokEffort } : {}), + ...(grokDisableWebSearch === undefined ? {} : { grokDisableWebSearch }), permissionModePinned: value.permissionModePinned === true, ...(value.providerPolicy == null ? {} : { providerPolicy: parseProviderPolicy(value.providerPolicy) }), systemInstructions: boundedText( @@ -1339,6 +1346,8 @@ function parseExpectedIdentity(value: unknown): AcpxExpectedSessionIdentity { ...(input.mode === undefined ? {} : { mode: parseProviderMode(input.mode) }), ...(input.piThinkingLevel === undefined ? {} : { piThinkingLevel: resolvePiThinkingLevel("pi", input.piThinkingLevel) }), ...(input.claudeEffort === undefined ? {} : { claudeEffort: resolveClaudeEffort("claude", input.claudeEffort) }), + ...(input.grokEffort === undefined ? {} : { grokEffort: resolveGrokEffort("grok", input.grokEffort) }), + ...(input.grokDisableWebSearch === undefined ? {} : { grokDisableWebSearch: resolveGrokDisableWebSearch("grok", input.grokDisableWebSearch) }), providerLifetimeFenceCandidates: requiredFenceCandidates( input.providerLifetimeFenceCandidates, ), diff --git a/packages/paperclip-runner/src/contracts/harness-driver.ts b/packages/paperclip-runner/src/contracts/harness-driver.ts index 2d839e73946..ede129c07b7 100644 --- a/packages/paperclip-runner/src/contracts/harness-driver.ts +++ b/packages/paperclip-runner/src/contracts/harness-driver.ts @@ -460,6 +460,8 @@ export interface AcpxSessionIdentity { mode?: string; piThinkingLevel?: "off" | "low" | "high" | "max"; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; providerLifetimeFenceCandidates: readonly [number, number, number]; } diff --git a/packages/paperclip-runner/src/contracts/native-execution.test.ts b/packages/paperclip-runner/src/contracts/native-execution.test.ts index 9a3edcc531d..c62a01e06fa 100644 --- a/packages/paperclip-runner/src/contracts/native-execution.test.ts +++ b/packages/paperclip-runner/src/contracts/native-execution.test.ts @@ -4,7 +4,7 @@ import { createHash } from "node:crypto"; import { QUALIFIED_ACPX_PROFILES } from "../drivers/acpx/qualified-profiles.js"; import { describe, expect, it } from "vitest"; -import { buildNativeModelEnvelope, parseNativeExecutionInput, NATIVE_EXECUTION_INPUT_SCHEMA, NATIVE_EXECUTION_INPUT_SCHEMA_V6, NATIVE_EXECUTION_INPUT_SCHEMA_V7, NATIVE_EXECUTION_INPUT_SCHEMA_V9, type NativeExecutionInputV1 } from "./native-execution.js"; +import { buildNativeModelEnvelope, parseNativeExecutionInput, NATIVE_EXECUTION_INPUT_SCHEMA, NATIVE_EXECUTION_INPUT_SCHEMA_V6, NATIVE_EXECUTION_INPUT_SCHEMA_V7, NATIVE_EXECUTION_INPUT_SCHEMA_V9, NATIVE_EXECUTION_INPUT_SCHEMA_V10, type NativeExecutionInputV1 } from "./native-execution.js"; import { NATIVE_RUNTIME_ASSET_SCHEMA, PAPERCLIP_EXECUTION_PROMPT, @@ -824,3 +824,52 @@ describe("Claude effort input v9", () => { expect(() => parseNativeExecutionInput({ ...current, provider: { ...current.provider, agent: "codex", profile: QUALIFIED_ACPX_PROFILES.codex, claudeEffort: "high" } })).toThrow("Claude effort"); }); }); + +describe("Grok effort input v10", () => { + const { permissionPolicy: _permission, qualificationModel: _model, reportedModelId: _reported, ...profile } = QUALIFIED_ACPX_PROFILES.grok; + const digest = "0".repeat(64); + const context = { prompt: { revision: PAPERCLIP_EXECUTION_PROMPT_REVISION, text: PAPERCLIP_EXECUTION_PROMPT, digest: nativeRuntimePromptDigest() }, + instructions: { entryPath: "AGENTS.md", bundle: { schema: NATIVE_RUNTIME_ASSET_SCHEMA, digest, manifestDigest: digest, rootPath: "/runtime/instructions", fileCount: 1, totalBytes: 1 } }, + skills: [], mcp: { assignmentSetId: "none", digest, bindingId: null } }; + const current = { ...input, schema: NATIVE_EXECUTION_INPUT_SCHEMA_V10, homeMode: "isolated", executionMode: "default", planningContext: null, + runtimeContext: { ...context, aggregateDigest: canonicalNativeRuntimeContextDigest(context) }, + session: { ...input.session, driverKind: "acpx_runtime" }, + provider: { kind: "acpx", agent: "grok", model: "grok-4.7", permissionMode: "approve-all", profile } }; + it.each([undefined, true, false])("round trips Grok search policy %s and rejects it on other providers", grokDisableWebSearch => { + expect(parseNativeExecutionInput({ ...current, provider: { ...current.provider, grokDisableWebSearch } }).provider) + .toMatchObject(grokDisableWebSearch === undefined ? {} : { grokDisableWebSearch }); + if (grokDisableWebSearch !== undefined) { + expect(() => parseNativeExecutionInput({ ...current, schema: NATIVE_EXECUTION_INPUT_SCHEMA_V9, provider: { ...current.provider, grokDisableWebSearch } })).toThrow("grokDisableWebSearch"); + expect(() => parseNativeExecutionInput({ ...current, provider: { ...current.provider, agent: "codex", profile: QUALIFIED_ACPX_PROFILES.codex, grokDisableWebSearch } })).toThrow("Grok web search"); + } + }); + it.each(["minimal", "low", "medium", "high", "xhigh"])("round trips explicit %s and retains the compact model envelope", grokEffort => { + const parsed = parseNativeExecutionInput({ ...current, provider: { ...current.provider, grokEffort } }); + expect(parsed).toMatchObject({ schema: NATIVE_EXECUTION_INPUT_SCHEMA_V10, provider: { grokEffort } }); + expect(buildNativeModelEnvelope(parsed).schema).toBe("paperclip.native-model-envelope.v3"); + expect(JSON.stringify(buildNativeModelEnvelope(parsed))).not.toContain("grokEffort"); + }); + it("directs answered Grok v10 questions to the actual compact envelope on fresh and resumed turns", () => { + const response = { interactionId: "answer-1", kind: "ask_user_questions", response: { + status: "answered", result: { version: 1, answers: [{ questionId: "destination", optionIds: ["workspace"], otherText: "Use the task workspace." }] }, + } }; + const parsed = parseNativeExecutionInput({ ...current, provider: { ...current.provider, grokEffort: "high" }, interactionResponses: [response] }); + const constraint = nativeTaskConstraints(parsed).find(value => value.includes("already authoritatively answered")); + expect(constraint).toContain("interactionResponses[0].response.result.answers"); + expect(constraint).not.toContain("message.interactionResponses"); + expect(constraint).not.toContain("Use the task workspace."); + for (const envelope of [buildNativeModelEnvelope(parsed), buildNativeModelEnvelope(parsed, { resumedSession: true })]) { + expect(envelope).toHaveProperty("interactionResponses.0.response.result.answers", response.response.result.answers); + expect(envelope).not.toHaveProperty("message"); + } + }); + it("keeps historical readers closed and rejects aliases and foreign effort", () => { + const { homeMode: _homeMode, ...historical } = current; + for (const schema of ["paperclip.native-execution-input.v4", NATIVE_EXECUTION_INPUT_SCHEMA]) { + expect(() => parseNativeExecutionInput({ ...historical, schema, provider: { ...current.provider, grokEffort: "high" } })).toThrow("grokEffort"); + expect(parseNativeExecutionInput({ ...historical, schema }).schema).toBe(schema); + } + expect(() => parseNativeExecutionInput({ ...current, provider: { ...current.provider, grokEffort: "ultra" } })).toThrow("Grok effort"); + expect(() => parseNativeExecutionInput({ ...current, provider: { ...current.provider, agent: "codex", profile: QUALIFIED_ACPX_PROFILES.codex, grokEffort: "high" } })).toThrow("Grok effort"); + }); +}); diff --git a/packages/paperclip-runner/src/contracts/native-execution.ts b/packages/paperclip-runner/src/contracts/native-execution.ts index d6d5993e528..246674b89b9 100644 --- a/packages/paperclip-runner/src/contracts/native-execution.ts +++ b/packages/paperclip-runner/src/contracts/native-execution.ts @@ -1,3 +1,5 @@ +import { resolveGrokDisableWebSearch } from "../drivers/acpx/grok-web-search.js"; +import { resolveGrokEffort } from "../drivers/acpx/grok-effort.js"; import { resolveClaudeEffort } from "../drivers/acpx/claude-effort.js"; import type { DotBindingSnapshot, MuseBindingSnapshot, ExternalBotProviderKind } from "./external-provider.js"; import { QUALIFIED_ACPX_VERSION } from "../drivers/acpx/generated-profiles.js"; @@ -10,6 +12,7 @@ import { explicitTaskSkillNames, parseNativeRuntimeContext, type NativeRuntimeCo export const NATIVE_EXECUTION_INPUT_SCHEMA_V1 = "paperclip.native-execution-input.v1" as const; export const NATIVE_EXECUTION_INPUT_SCHEMA_V2 = "paperclip.native-execution-input.v2" as const; export const NATIVE_EXECUTION_INPUT_SCHEMA_V3 = "paperclip.native-execution-input.v3" as const; +export const NATIVE_EXECUTION_INPUT_SCHEMA_V10 = "paperclip.native-execution-input.v10" as const; export const NATIVE_EXECUTION_INPUT_SCHEMA_V9 = "paperclip.native-execution-input.v9" as const; export const NATIVE_EXECUTION_INPUT_SCHEMA_V8 = "paperclip.native-execution-input.v8" as const; export const NATIVE_EXECUTION_INPUT_SCHEMA_V6 = "paperclip.native-execution-input.v6" as const; @@ -265,13 +268,20 @@ export interface NativeExecutionInputV9 extends Omit + | (Extract & { grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; grokDisableWebSearch?: boolean }); +export interface NativeExecutionInputV10 extends Omit { + schema: typeof NATIVE_EXECUTION_INPUT_SCHEMA_V10; + provider: NativeProviderConfigV10; +} + export interface NativeExecutionInputV8 extends Omit { schema: typeof NATIVE_EXECUTION_INPUT_SCHEMA_V8; provider: { kind: "muse"; model: null; binding: MuseBindingSnapshot; bridgeRevision: "muse-v1" }; session: Omit & { driverKind: "muse_external" }; } -export type NativeExecutionInput = NativeExecutionInputV1 | NativeExecutionInputV2 | NativeExecutionInputV3 | NativeExecutionInputV4 | NativeExecutionInputV5 | NativeExecutionInputV6 | NativeExecutionInputV7 | NativeExecutionInputV8 | NativeExecutionInputV9; +export type NativeExecutionInput = NativeExecutionInputV1 | NativeExecutionInputV2 | NativeExecutionInputV3 | NativeExecutionInputV4 | NativeExecutionInputV5 | NativeExecutionInputV6 | NativeExecutionInputV7 | NativeExecutionInputV8 | NativeExecutionInputV9 | NativeExecutionInputV10; /** The only task data that may enter provider-visible model input. */ export interface NativeModelEnvelopeV1 { @@ -415,7 +425,8 @@ export function parseNativeExecutionInput(value: unknown): NativeExecutionInput const input = record(value, "input"); if (input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V8) return parseMuseNativeExecutionInput(input); if (input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V6) return parseExternalNativeExecutionInput(input); - const isV9 = input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V9; + const isV10 = input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V10; + const isV9 = isV10 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V9; const isV7 = isV9 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V7; const isV5 = isV7 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA; const isV4 = isV5 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V4; @@ -569,7 +580,7 @@ export function parseNativeExecutionInput(value: unknown): NativeExecutionInput : provider.kind === "aws_agentcore" ? ["kind", "model", "agentCoreProfile", "maxEstimatedSessionCostUsd", "invocationLimits"] : provider.kind === "acpx" - ? ["kind", "agent", "model", isV4 ? "permissionMode" : "permissionPolicy", "profile", "piThinkingLevel", ...(isV4 ? ["mode"] : []), ...(isV9 ? ["claudeEffort"] : [])] + ? ["kind", "agent", "model", isV4 ? "permissionMode" : "permissionPolicy", "profile", "piThinkingLevel", ...(isV4 ? ["mode"] : []), ...(isV9 ? ["claudeEffort"] : []), ...(isV10 ? ["grokEffort", "grokDisableWebSearch"] : [])] : provider.kind === "codex" && isV4 ? ["kind", "model", "approvalPolicy", ...(isV5 ? ["reasoningEffort", "webSearch"] : [])] : provider.kind === "opencode" && isV4 @@ -709,6 +720,8 @@ export function parseNativeExecutionInput(value: unknown): NativeExecutionInput throw new NativeExecutionInputError("input.provider.permissionPolicy must be interactive"); } const claudeEffort = resolveClaudeEffort(provider.agent, provider.claudeEffort); + const grokEffort = resolveGrokEffort(provider.agent, provider.grokEffort); + const grokDisableWebSearch = resolveGrokDisableWebSearch(provider.agent, provider.grokDisableWebSearch); const profile = record(provider.profile, "input.provider.profile"); exactKeys(profile, [ "driverKind", @@ -748,6 +761,8 @@ export function parseNativeExecutionInput(value: unknown): NativeExecutionInput : { permissionPolicy: "interactive" as const }), ...(provider.mode === undefined ? {} : { mode: provider.mode as string }), ...(claudeEffort === undefined ? {} : { claudeEffort }), + ...(grokEffort === undefined ? {} : { grokEffort }), + ...(grokDisableWebSearch === undefined ? {} : { grokDisableWebSearch }), ...(provider.piThinkingLevel === undefined ? {} : { piThinkingLevel: provider.piThinkingLevel as "off" | "low" | "high" | "max" }), profile: { driverKind: "acpx_runtime", @@ -906,6 +921,11 @@ export function parseNativeExecutionInput(value: unknown): NativeExecutionInput provider: parsedProvider as NativeProviderConfigV4, }; if (!isV5) return { ...withPermissions, schema: NATIVE_EXECUTION_INPUT_SCHEMA_V4 }; + if (isV10) return { + ...withPermissions, schema: NATIVE_EXECUTION_INPUT_SCHEMA_V10, homeMode: input.homeMode as NativeHomeMode, + provider: parsedProvider as NativeProviderConfigV10, + ...(input.completionSources !== undefined ? { completionSources: parseCompletionSources(input.completionSources) } : {}), + }; if (isV9) return { ...withPermissions, schema: NATIVE_EXECUTION_INPUT_SCHEMA_V9, homeMode: input.homeMode as NativeHomeMode, provider: parsedProvider as NativeProviderConfigV9, @@ -977,7 +997,7 @@ export function buildNativeModelEnvelope(input: NativeExecutionInput, options?: interactionResponses: structuredClone(input.interactionResponses), }; } - if (input.schema === NATIVE_EXECUTION_INPUT_SCHEMA || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V6 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V7 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V8 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V9) { + if (input.schema === NATIVE_EXECUTION_INPUT_SCHEMA || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V6 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V7 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V8 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V9 || input.schema === NATIVE_EXECUTION_INPUT_SCHEMA_V10) { const sourceBinding = input.completionSources; const references = sourceBinding?.contractRevision === input.completionContract.contract.revision && sourceBinding.promptSha256 === createHash("sha256").update(input.task.prompt).digest("hex") diff --git a/packages/paperclip-runner/src/drivers/acpx/codex-acpx-driver.ts b/packages/paperclip-runner/src/drivers/acpx/codex-acpx-driver.ts index 8ee4744023b..239ef5c37e1 100644 --- a/packages/paperclip-runner/src/drivers/acpx/codex-acpx-driver.ts +++ b/packages/paperclip-runner/src/drivers/acpx/codex-acpx-driver.ts @@ -151,6 +151,8 @@ export interface CodexAcpxDriverOptions { mode?: string; piThinkingLevel?: "off" | "low" | "high" | "max"; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; providerPolicy?: { readOnly: boolean }; runtimeContext?: OpenAcpxRuntimeHostOptions["runtimeContext"]; systemInstructions?: string; @@ -467,6 +469,7 @@ export class CodexAcpxDriver implements HarnessDriver { mode: this.#options.mode, piThinkingLevel: this.#options.piThinkingLevel, claudeEffort: this.#options.claudeEffort, + grokEffort: this.#options.grokEffort, grokDisableWebSearch: this.#options.grokDisableWebSearch, providerPolicy: this.#options.providerPolicy, runtimeContext: this.#options.runtimeContext, systemInstructions: this.#options.systemInstructions, @@ -1304,6 +1307,8 @@ class CodexAcpxSession implements HarnessSession { ...(identity.mode === undefined ? {} : { mode: identity.mode }), ...(identity.piThinkingLevel === undefined ? {} : { piThinkingLevel: identity.piThinkingLevel }), ...(identity.claudeEffort === undefined ? {} : { claudeEffort: identity.claudeEffort }), + ...(identity.grokEffort === undefined ? {} : { grokEffort: identity.grokEffort }), + ...(identity.grokDisableWebSearch === undefined ? {} : { grokDisableWebSearch: identity.grokDisableWebSearch }), providerLifetimeFenceCandidates: identity.providerLifetimeFenceCandidates, }, @@ -2158,6 +2163,8 @@ function validateRecoverySnapshot(snapshot: PersistedHarnessSession): void { )) || (identity.mode !== undefined && !isProviderMode(identity.mode)) || (identity.claudeEffort !== undefined && !["low", "medium", "high", "xhigh", "max"].includes(identity.claudeEffort)) || + (identity.grokDisableWebSearch !== undefined && typeof identity.grokDisableWebSearch !== "boolean") || + (identity.grokEffort !== undefined && !["minimal", "low", "medium", "high", "xhigh"].includes(identity.grokEffort)) || (identity.piThinkingLevel !== undefined && !["off", "low", "high", "max"].includes(identity.piThinkingLevel)) || !validProviderLifetimeFenceCandidates( identity.providerLifetimeFenceCandidates, diff --git a/packages/paperclip-runner/src/drivers/acpx/codex-runtime-adapter.test.ts b/packages/paperclip-runner/src/drivers/acpx/codex-runtime-adapter.test.ts index ba5dd3b5449..1f77dc18833 100644 --- a/packages/paperclip-runner/src/drivers/acpx/codex-runtime-adapter.test.ts +++ b/packages/paperclip-runner/src/drivers/acpx/codex-runtime-adapter.test.ts @@ -68,6 +68,40 @@ describe("Codex ACPX runtime adapter", () => { expect(runtime.startTurn).not.toHaveBeenCalled(); await port.close({ reason: "test complete" }); }); + it.each([false, true])("acknowledges configured Grok effort before admission (restoring=%s)", async restoring => { + const runtime = fakeRuntime(); + const child = fakeChild(); + const options = openOptions({ spawn: () => child, close: async () => undefined }); + options.profile = { ...options.profile, agent: "grok" }; + options.grokEffort = "high"; + options.restoringSession = restoring; + options.refreshConsumedCommand = vi.fn(async () => undefined); + let created!: AcpRuntimeOptions; + const spawnProvider = () => created.spawnAgent!({ command: "ignored", args: [], options: {} }); + vi.mocked(runtime.ensureSession).mockImplementation(async () => { + if (!restoring) spawnProvider(); + return HANDLE; + }); + vi.mocked(runtime.setConfigOption).mockImplementation(async input => { + if (restoring) spawnProvider(); + const guard = created.protocolGuardFactory!(); + guard("outbound", { id: 0, method: "session/load", params: { sessionId: "backend-1" } }); + guard("inbound", { id: 0, result: { configOptions: [{ id: "reasoning_effort", currentValue: "default" }] } }); + guard("outbound", { id: 1, method: "session/set_config_option", params: { sessionId: "backend-1", configId: input.key, value: input.value } }); + guard("inbound", { id: 1, result: { configOptions: [{ id: "reasoning_effort", currentValue: input.value }] } }); + }); + const port = await openCodexAcpxRuntime(options, { + createRegistry: () => registry(), createStore: () => store(), createRuntime: value => { created = value; return runtime; }, + awaitProviderOwnership: providerOwnershipEstablished, + awaitProviderExit: providerOwnershipEstablished, + }); + expect(runtime.setConfigOption).toHaveBeenCalledExactlyOnceWith({ handle: HANDLE, key: "reasoning_effort", value: "high" }); + expect(await port.identity()).toMatchObject({ grokEffort: "high" }); + if (restoring) expect(options.refreshConsumedCommand).toHaveBeenCalledOnce(); + else expect(options.refreshConsumedCommand).not.toHaveBeenCalled(); + expect(runtime.startTurn).not.toHaveBeenCalled(); + await port.close({ reason: "test complete" }); + }); it("admits an exact Claude model through the real ACP without a user model allowlist", async () => { const root = await mkdtemp(join(tmpdir(), "preconfigured-claude-model-")); diff --git a/packages/paperclip-runner/src/drivers/acpx/codex-runtime-adapter.ts b/packages/paperclip-runner/src/drivers/acpx/codex-runtime-adapter.ts index e8a4f8406ca..b8d804d7ee1 100644 --- a/packages/paperclip-runner/src/drivers/acpx/codex-runtime-adapter.ts +++ b/packages/paperclip-runner/src/drivers/acpx/codex-runtime-adapter.ts @@ -1,3 +1,5 @@ +import { resolveGrokDisableWebSearch } from "./grok-web-search.js"; +import { resolveGrokEffort, createGrokEffortAdmission } from "./grok-effort.js"; import { resolveClaudeEffort, createClaudeEffortAdmission } from "./claude-effort.js"; import { createPiThinkingAdmission, resolvePiThinkingLevel } from "./pi-thinking.js"; import { usesPreconfiguredHome } from "../preconfigured-home.js"; @@ -318,7 +320,10 @@ export async function openQualifiedAcpxRuntime( const selectedPiThinkingLevel = resolvePiThinkingLevel(options.profile.agent, options.piThinkingLevel); const piThinking = selectedPiThinkingLevel ? createPiThinkingAdmission(selectedPiThinkingLevel, { restoring: options.restoringSession }) : undefined; const selectedClaudeEffort = resolveClaudeEffort(options.profile.agent, options.claudeEffort); - const claudeEffort = selectedClaudeEffort ? createClaudeEffortAdmission(selectedClaudeEffort) : undefined; + const selectedGrokEffort = resolveGrokEffort(options.profile.agent, options.grokEffort); + const grokDisableWebSearch = resolveGrokDisableWebSearch(options.profile.agent, options.grokDisableWebSearch); + const effortAdmission = selectedClaudeEffort ? createClaudeEffortAdmission(selectedClaudeEffort) + : selectedGrokEffort ? createGrokEffortAdmission(selectedGrokEffort) : undefined; const cursorInstructions = options.profile.agent === "cursor" ? createCursorInstructionAdmission(options.systemInstructions) : null; @@ -330,7 +335,7 @@ export async function openQualifiedAcpxRuntime( return (direction: "inbound" | "outbound", message: unknown) => { instructions?.(direction, message); mode?.(direction, message); }; } } : {}), ...(piThinking ? { protocolGuardFactory: () => piThinking.createGuard() } : {}), - ...(claudeEffort ? { protocolGuardFactory: () => claudeEffort.createGuard() } : {}), + ...(effortAdmission ? { protocolGuardFactory: () => effortAdmission.createGuard() } : {}), sessionStore, agentRegistry: createRegistry({ // Preserve Claude's ACP capability identity. This is metadata only: the @@ -556,14 +561,14 @@ export async function openQualifiedAcpxRuntime( await commandLaunches.refreshConsumedCommand?.(); } return ensuredHandle; - }) : claudeEffort ? ensuredSession.then(async (ensuredHandle) => { + }) : effortAdmission ? ensuredSession.then(async (ensuredHandle) => { handle = ensuredHandle; options.signal?.throwIfAborted(); - if (!claudeEffort.isReady()) { - if (!runtime.setConfigOption) throw new Error("Claude effort admission requires native configuration"); + if (!effortAdmission.isReady()) { + if (!runtime.setConfigOption) throw new Error("Effort admission requires native configuration"); const spawnsBeforeControl = commandLaunches.count; - await runtime.setConfigOption({ handle: ensuredHandle, key: "effort", value: selectedClaudeEffort! }); - claudeEffort.assertReady(); + await runtime.setConfigOption({ handle: ensuredHandle, key: selectedGrokEffort ? "reasoning_effort" : "effort", value: (selectedGrokEffort ?? selectedClaudeEffort)! }); + effortAdmission.assertReady(); await children.verifyLifetimeOwnership(); options.signal?.throwIfAborted(); // Fresh sessions retain their initialized provider. Only a cold @@ -589,7 +594,7 @@ export async function openQualifiedAcpxRuntime( cursorInstructions?.assertReady(); modeBinding?.assertReady(); piThinking?.assertReady(); - claudeEffort?.assertReady(); + effortAdmission?.assertReady(); // A provider can answer only after the verified sentinel is armed, but do // not admit the session until the owner has observed that exact handoff. await children.verifyLifetimeOwnership(); @@ -644,7 +649,7 @@ export async function openQualifiedAcpxRuntime( return runtimePort( runtime, handle, - { ...requireIdentity(handle), ...(modeBinding ? { mode: modeBinding.selectedMode } : {}), ...(selectedPiThinkingLevel ? { piThinkingLevel: selectedPiThinkingLevel } : {}), ...(selectedClaudeEffort ? { claudeEffort: selectedClaudeEffort } : {}) }, + { ...requireIdentity(handle), ...(modeBinding ? { mode: modeBinding.selectedMode } : {}), ...(selectedPiThinkingLevel ? { piThinkingLevel: selectedPiThinkingLevel } : {}), ...(selectedClaudeEffort ? { claudeEffort: selectedClaudeEffort } : {}), ...(selectedGrokEffort ? { grokEffort: selectedGrokEffort } : {}), ...(grokDisableWebSearch === undefined ? {} : { grokDisableWebSearch }) }, baseStore, children, runtimeCloseTimeoutMs, diff --git a/packages/paperclip-runner/src/drivers/acpx/copilot-installation.test.ts b/packages/paperclip-runner/src/drivers/acpx/copilot-installation.test.ts index 808384a8b9b..c8743107d1f 100644 --- a/packages/paperclip-runner/src/drivers/acpx/copilot-installation.test.ts +++ b/packages/paperclip-runner/src/drivers/acpx/copilot-installation.test.ts @@ -87,9 +87,23 @@ vi.mock("./installation-integrity.js", () => ({ verifyNativeAcpxInstallation: vi describe("Copilot build-owned installation", () => { it("admits the current profile with environment launch preparation", () => { - expect(QUALIFIED_ACPX_PROFILES.copilot.agentProfileVersion).toBe(65); + expect(QUALIFIED_ACPX_PROFILES.copilot.agentProfileVersion).toBe(66); expect(QUALIFIED_ACPX_PROFILES.copilot.qualificationStatus).toBeUndefined(); - expect(QUALIFIED_ACPX_PROFILES.copilot.commandDigest).toBe("sha256:277894e850e07e6801cc24299c237513f58b41eb93c24f751d984fc4ddb04c47"); + expect(QUALIFIED_ACPX_PROFILES.copilot.commandDigest).toBe("sha256:0cddc219af25b741b7138f38faa7514dd5ee3427b1d3168e8a4bfbe5180983e8"); + }); + + it("retains v65 history while binding the shared native Grok effort transport in v66", async () => { + const prior = JSON.parse(readFileSync(new URL("../../../test/fixtures/copilot-profile-v65-identity.json", import.meta.url), "utf8")); + const current = JSON.parse(readFileSync(new URL("../../../test/fixtures/copilot-profile-v66-identity.json", import.meta.url), "utf8")); + expect(Object.keys(current.declaration).filter(key => current.declaration[key] !== prior.declaration[key]).sort()).toEqual([ + "agentProfileVersion", "harnessSessionContractSourceSha256", "nativeBackendSourceSha256", "nativeExecutionSourceSha256", + "nativeInstructionsSourceSha256", "profileCompatibilitySourceSha256", "providerLaunchSourceSha256", "runtimeAdapterSourceSha256", + "runtimeHostSourceSha256", "runtimeRequestBridgeSourceSha256", "runtimeSandboxSourceSha256", "semanticDirectDriverSourceSha256", "semanticSchemaBundleSourceSha256", + "semanticSidecarProtocolSourceSha256", "semanticSidecarSourceSha256", + ]); + expect(isSupportedAcpxProfileVersion("copilot", 65)).toBe(true); + await expect(verifyCopilotInstallation({ ...QUALIFIED_ACPX_PROFILES.copilot, + agentProfileVersion: 65, commandDigest: prior.commandDigest })).rejects.toThrow("exact pinned"); }); it("preserves published v64 while binding exhausted reconnect cancellation in v65", async () => { diff --git a/packages/paperclip-runner/src/drivers/acpx/generated-profiles.ts b/packages/paperclip-runner/src/drivers/acpx/generated-profiles.ts index ca6b08b1e7c..e8810030a7d 100644 --- a/packages/paperclip-runner/src/drivers/acpx/generated-profiles.ts +++ b/packages/paperclip-runner/src/drivers/acpx/generated-profiles.ts @@ -22,12 +22,12 @@ export const QUALIFIED_ACPX_PROFILE_DATA = { "protocolVersion": 1, "acpxVersion": "0.13.1", "agent": "pi", - "agentProfileVersion": 29, + "agentProfileVersion": 30, "agentServerPackage": "pi-acp", "agentServerVersion": "0.0.33", "agentRuntimePackage": "@earendil-works/pi-coding-agent", "agentRuntimeVersion": "1.0.0", - "commandDigest": "sha256:e80c6dc7bde12790371345ee5a12f0201d30941d26f1a780aec3d090545b2a06", + "commandDigest": "sha256:4517ab123dd89140ef462fc1905ac7a16a0dfcbaf21d67299a3c62de29c08a4d", "permissionPolicy": "interactive" }, "cursor": { @@ -48,12 +48,12 @@ export const QUALIFIED_ACPX_PROFILE_DATA = { "protocolVersion": 1, "acpxVersion": "0.13.1", "agent": "copilot", - "agentProfileVersion": 65, + "agentProfileVersion": 66, "agentServerPackage": "@github/copilot", "agentServerVersion": "1.0.88", "agentRuntimePackage": null, "agentRuntimeVersion": null, - "commandDigest": "sha256:277894e850e07e6801cc24299c237513f58b41eb93c24f751d984fc4ddb04c47", + "commandDigest": "sha256:0cddc219af25b741b7138f38faa7514dd5ee3427b1d3168e8a4bfbe5180983e8", "permissionPolicy": "interactive" }, "claude": { diff --git a/packages/paperclip-runner/src/drivers/acpx/grok-effort.test.ts b/packages/paperclip-runner/src/drivers/acpx/grok-effort.test.ts new file mode 100644 index 00000000000..98308f3c6e1 --- /dev/null +++ b/packages/paperclip-runner/src/drivers/acpx/grok-effort.test.ts @@ -0,0 +1,67 @@ +import { describe, expect, it } from "vitest"; +import { admittedGrokEffort, createGrokEffortAdmission, resolveGrokEffort } from "./grok-effort.js"; + +const response = (value: string, sessionId?: string) => ({ ...(sessionId ? { sessionId } : {}), configOptions: [{ id: "reasoning_effort", currentValue: value }] }); +function loaded(method = "session/new") { + const admission = createGrokEffortAdmission("high"); + const guard = admission.createGuard(); + guard("outbound", { id: 1, method, params: method === "session/new" ? {} : { sessionId: "s" } }); + guard("inbound", { id: 1, result: response("medium", method === "session/new" ? "s" : undefined) }); + return { admission, guard }; +} +function select(guard: ReturnType["createGuard"]>, acknowledged = "high") { + guard("outbound", { id: 2, method: "session/set_config_option", params: { sessionId: "s", configId: "reasoning_effort", value: "high" } }); + guard("inbound", { id: 2, result: response(acknowledged) }); +} +describe("Grok effort admission", () => { + it.each(["minimal", "low", "medium", "high", "xhigh"] as const)("accepts exact %s without aliases", value => { + expect(resolveGrokEffort("grok", value)).toBe(value); + expect(admittedGrokEffort("grok", value, { grokEffort: value }, { grokEffort: value })).toBe(value); + }); + it("rejects unsupported, foreign and conflicting effort", () => { + for (const value of ["ultra", "off", null, 2]) expect(() => resolveGrokEffort("grok", value)).toThrow(); + expect(() => resolveGrokEffort("pi", "high")).toThrow("only supported"); + expect(() => admittedGrokEffort("grok", "high", { grokEffort: "high" }, { grokEffort: "medium" })).toThrow("differs"); + }); + it.each(["session/new", "session/load", "session/resume"])("requires acknowledged effort before prompting after %s", method => { + const { admission, guard } = loaded(method); + expect(admission.isReady()).toBe(false); + select(guard); + expect(admission.isReady()).toBe(true); + expect(() => guard("outbound", { id: 3, method: "session/prompt", params: { sessionId: "s" } })).not.toThrow(); + }); + + it("rejects a resumed session with missing effort configuration", () => { + const admission = createGrokEffortAdmission("high"); + const guard = admission.createGuard(); + guard("outbound", { id: 1, method: "session/resume", params: { sessionId: "s" } }); + expect(() => guard("inbound", { id: 1, result: {} })).toThrow("missing or ambiguous"); + }); + it("blocks a prompt based only on a restored default", () => { + const { guard } = loaded("session/load"); + expect(() => guard("outbound", { id: 3, method: "session/prompt", params: { sessionId: "s" } })).toThrow("does not acknowledge"); + }); + + it("requires the bound effort acknowledgement on each cold connection", () => { + const { admission, guard } = loaded(); + select(guard); + const resumed = admission.createGuard(); + resumed("outbound", { id: 4, method: "session/load", params: { sessionId: "s" } }); + expect(() => resumed("outbound", { id: 5, method: "session/prompt", params: { sessionId: "s" } })).toThrow("does not acknowledge"); + const fresh = loaded(); select(fresh.guard); + const acknowledged = fresh.admission.createGuard(); + acknowledged("outbound", { id: 4, method: "session/load", params: { sessionId: "s" } }); + acknowledged("inbound", { id: 4, result: response("high") }); + expect(() => acknowledged("outbound", { id: 5, method: "session/prompt", params: { sessionId: "s" } })).not.toThrow(); + }); + it("rejects a provider that ignores the requested effort", () => { + const { guard } = loaded(); + expect(() => select(guard, "medium")).toThrow("did not apply"); + }); + it("rejects drift and wrong-session prompts after admission", () => { + const { guard } = loaded(); select(guard); + expect(() => guard("inbound", { method: "session/update", params: { sessionId: "s", update: { sessionUpdate: "config_option_update", ...response("low") } } })).toThrow("drifted"); + const fresh = loaded(); select(fresh.guard); + expect(() => fresh.guard("outbound", { id: 3, method: "session/prompt", params: { sessionId: "foreign" } })).toThrow("different session"); + }); +}); diff --git a/packages/paperclip-runner/src/drivers/acpx/grok-effort.ts b/packages/paperclip-runner/src/drivers/acpx/grok-effort.ts new file mode 100644 index 00000000000..19118a0472a --- /dev/null +++ b/packages/paperclip-runner/src/drivers/acpx/grok-effort.ts @@ -0,0 +1,19 @@ +import { createAcpxConfigAdmission } from "./config-admission.js"; + +export type GrokEffort = "minimal" | "low" | "medium" | "high" | "xhigh"; +export function resolveGrokEffort(agent: string, value: unknown): GrokEffort | undefined { + if (value === undefined || value === "") return undefined; + if (agent !== "grok") throw new Error("Grok effort is only supported by Grok"); + if (value !== "minimal" && value !== "low" && value !== "medium" && value !== "high" && value !== "xhigh") throw new Error("Grok effort must be minimal, low, medium, high, or xhigh"); + return value; +} +export function createGrokEffortAdmission(expected: GrokEffort) { + return createAcpxConfigAdmission(expected, { label: "Grok effort", configId: "reasoning_effort", + supportedValues: ["default", "minimal", "low", "medium", "high", "xhigh"] }); +} +export function admittedGrokEffort(agent: string, requested: unknown, descriptor: Record, identity: Record): GrokEffort | undefined { + const expected = resolveGrokEffort(agent, requested); + const effective = resolveGrokEffort(agent, identity.grokEffort); + if (effective !== expected || descriptor.grokEffort !== expected) throw new Error("Grok effort differs from the admitted configuration"); + return effective; +} diff --git a/packages/paperclip-runner/src/drivers/acpx/grok-web-search.test.ts b/packages/paperclip-runner/src/drivers/acpx/grok-web-search.test.ts new file mode 100644 index 00000000000..2b60f94c63e --- /dev/null +++ b/packages/paperclip-runner/src/drivers/acpx/grok-web-search.test.ts @@ -0,0 +1,14 @@ +import { describe, expect, it } from "vitest"; +import { admittedGrokWebSearchPolicy, resolveGrokDisableWebSearch } from "./grok-web-search.js"; + +describe("Grok search policy", () => { + it.each([undefined, true, false])("admits only the selected policy %s", selected => { + expect(resolveGrokDisableWebSearch("grok", selected)).toBe(selected); + expect(() => admittedGrokWebSearchPolicy("grok", selected, { grokDisableWebSearch: selected }, { grokDisableWebSearch: selected })).not.toThrow(); + expect(() => admittedGrokWebSearchPolicy("grok", selected, { grokDisableWebSearch: !selected }, { grokDisableWebSearch: selected })).toThrow("differs"); + }); + it("rejects malformed values and other providers before startup", () => { + for (const value of [null, "true", 1]) expect(() => resolveGrokDisableWebSearch("grok", value)).toThrow("boolean"); + expect(() => resolveGrokDisableWebSearch("claude", true)).toThrow("Grok"); + }); +}); diff --git a/packages/paperclip-runner/src/drivers/acpx/grok-web-search.ts b/packages/paperclip-runner/src/drivers/acpx/grok-web-search.ts new file mode 100644 index 00000000000..a8935920a5e --- /dev/null +++ b/packages/paperclip-runner/src/drivers/acpx/grok-web-search.ts @@ -0,0 +1,13 @@ +/** Preserve the selected Grok search policy across startup and recovery. */ +export function resolveGrokDisableWebSearch(agent: string, value: unknown): boolean | undefined { + if (value === undefined) return undefined; + if (agent !== "grok" || typeof value !== "boolean") throw new Error("Grok web search policy requires a Grok boolean setting"); + return value; +} + +export function admittedGrokWebSearchPolicy(agent: string, expected: unknown, descriptor: Record, identity: Record): void { + const selected = resolveGrokDisableWebSearch(agent, expected); + if (descriptor.grokDisableWebSearch !== selected || identity.grokDisableWebSearch !== selected) { + throw new Error("Grok web search policy differs from the admitted configuration"); + } +} diff --git a/packages/paperclip-runner/src/drivers/acpx/pi-installation.test.ts b/packages/paperclip-runner/src/drivers/acpx/pi-installation.test.ts index 8d81addb3cf..f57fa913ba7 100644 --- a/packages/paperclip-runner/src/drivers/acpx/pi-installation.test.ts +++ b/packages/paperclip-runner/src/drivers/acpx/pi-installation.test.ts @@ -10,6 +10,7 @@ import { PI_DISTRIBUTION_CLOSURE_SHA256 } from "./pi-closure-pins.js"; import { PI_NODE_VERSION } from "./pi-node-pins.js"; import { assertPiInstallationProfile, verifyPiInstallation } from "./pi-installation.js"; import { QUALIFIED_ACPX_PROFILES, type AcpxReleaseProfile } from "./qualified-profiles.js"; +import { isSupportedAcpxProfileVersion } from "./profile-compatibility.js"; const roots: string[] = []; afterEach(async () => { vi.unstubAllEnvs(); await Promise.all(roots.splice(0).map(root => rm(root, { recursive: true, force: true }))); }); @@ -164,11 +165,21 @@ describe("Pi installation factory", () => { expect(current.commandDigest).not.toBe(prior.commandDigest); }); + it("retains profile 29 while binding Grok effort recovery identity in profile 30", async () => { + const read = async (version: number) => JSON.parse(await readFile(new URL(`../../../test-fixtures/pi-acp/profile-v${version}-identity.json`, import.meta.url), "utf8")); + const prior = await read(29), current = await read(30); + expect(Object.keys(current.declaration).filter(key => JSON.stringify(current.declaration[key]) !== JSON.stringify(prior.declaration[key])).sort()) + .toEqual(["agentProfileVersion", "recoveryIdentitySourceSha256", "runtimeSandboxSourceSha256"]); + expect(current.declaration.closure).toEqual(prior.declaration.closure); + expect(current.commandDigest).not.toBe(prior.commandDigest); + expect(isSupportedAcpxProfileVersion("pi", 29)).toBe(true); + }); + it("binds the profile declaration to the reviewed patch and platform closure pins", async () => { const hash = (bytes: string | Uint8Array) => createHash("sha256").update(bytes).digest("hex"); const canonical = (value: any): string => Array.isArray(value) ? `[${value.map(canonical).join(",")}]` : value && typeof value === "object" ? `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}` : JSON.stringify(value); - const identity = JSON.parse(await readFile(new URL("../../../test-fixtures/pi-acp/profile-v29-identity.json", import.meta.url), "utf8")); + const identity = JSON.parse(await readFile(new URL(`../../../test-fixtures/pi-acp/profile-v${QUALIFIED_ACPX_PROFILES.pi.agentProfileVersion}-identity.json`, import.meta.url), "utf8")); const declaration = identity.declaration; expect(declaration.sharedRuntimeContract).toBe("paperclip.acpx-runtime-contract.v1"); expect(identity.commandDigest).toBe(`sha256:${hash(canonical(declaration))}`); @@ -199,21 +210,21 @@ describe("Pi installation factory", () => { it("rejects legacy profiles and tampered executable identities", () => { expect(() => assertPiInstallationProfile(candidate())).not.toThrow(); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 1 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 2 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 3 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 4 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 5 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 6 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 7 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 8 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 9 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 10 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 11 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 12 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 13 })).toThrow("version 29"); - expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 14 })).toThrow("version 29"); - for (const priorVersion of [15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28]) expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: priorVersion })).toThrow("version 29"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 1 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 2 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 3 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 4 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 5 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 6 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 7 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 8 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 9 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 10 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 11 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 12 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 13 })).toThrow("version 30"); + expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: 14 })).toThrow("version 30"); + for (const priorVersion of [15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29]) expect(() => assertPiInstallationProfile({ ...candidate(), agentProfileVersion: priorVersion })).toThrow("version 30"); for (const changed of [{ agentServerVersion: "latest" }, { commandDigest: `sha256:${"0".repeat(64)}` }, { agentRuntimePackage: "ambient-pi" }]) { expect(() => assertPiInstallationProfile({ ...candidate(), ...changed })).toThrow("trusted declaration"); } diff --git a/packages/paperclip-runner/src/drivers/acpx/profile-compatibility.ts b/packages/paperclip-runner/src/drivers/acpx/profile-compatibility.ts index 08db0ba384d..6d397e70882 100644 --- a/packages/paperclip-runner/src/drivers/acpx/profile-compatibility.ts +++ b/packages/paperclip-runner/src/drivers/acpx/profile-compatibility.ts @@ -2,13 +2,13 @@ import { QUALIFIED_ACPX_PROFILE_DATA } from "./generated-profiles.js"; /** Decodable historical profile revisions, not permission to launch them. * Exact current profile/package/digest admission is checked separately. */ -type HistoricalAcpxProfileVersion = 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64; +type HistoricalAcpxProfileVersion = 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65; type CurrentAcpxProfileVersion = typeof QUALIFIED_ACPX_PROFILE_DATA[keyof typeof QUALIFIED_ACPX_PROFILE_DATA]["agentProfileVersion"]; export type AcpxProfileVersion = HistoricalAcpxProfileVersion | CurrentAcpxProfileVersion; const historicalVersions: Readonly> = { - pi: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28], claude: [1, 2, 3, 4, 5], codex: [1, 2, 3, 4, 5], - grok: [1, 2, 3, 4, 5], copilot: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64], + pi: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29], claude: [1, 2, 3, 4, 5], codex: [1, 2, 3, 4, 5], + grok: [1, 2, 3, 4, 5], copilot: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65], cursor: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], }; diff --git a/packages/paperclip-runner/src/drivers/acpx/recovery-identity.test.ts b/packages/paperclip-runner/src/drivers/acpx/recovery-identity.test.ts index 08010a68352..0b0e148d73b 100644 --- a/packages/paperclip-runner/src/drivers/acpx/recovery-identity.test.ts +++ b/packages/paperclip-runner/src/drivers/acpx/recovery-identity.test.ts @@ -91,6 +91,33 @@ describe("ACPX recovery identity", () => { expect(() => verifyExpectedAcpxIdentity(expected, high, { ...saved, claudeEffort: undefined })).toThrow("persisted"); expect(() => verifyExpectedAcpxIdentity(expected, low, saved)).toThrow("immutable"); }); + it("binds Grok effort to recovery and rejects changed or omitted effort", async () => { + const fixture = await recoveryFixture(); + const profile = resolveQualifiedAcpxProfile("grok", "grok-4.7"); + const input = { ...fixture.input, profile, requestedModel: profile.qualificationModel, grokEffort: "high" as const }; + const high = await createAcpxRecoveryBinding(input); + const low = await createAcpxRecoveryBinding({ ...input, grokEffort: "low" }); + expect(low.profileSessionKey).not.toBe(high.profileSessionKey); + const expected = { ...fixture.expected, profileDigest: high.commandDigest, requestedModel: high.requestedModel, effectiveModel: high.effectiveModel, grokEffort: "high" as const }; + const saved = createAcpxIdentityRecord(expected, high); + expect(acpxProviderSessionIdentity(saved, high).grokEffort).toBe("high"); + expect(() => verifyExpectedAcpxIdentity({ ...expected, grokEffort: undefined }, high, saved)).toThrow("immutable"); + expect(() => verifyExpectedAcpxIdentity(expected, high, { ...saved, grokEffort: undefined })).toThrow("persisted"); + expect(() => verifyExpectedAcpxIdentity(expected, low, saved)).toThrow("immutable"); + }); + + it("fences changed or omitted Grok search policy across recovery", async () => { + const fixture = await recoveryFixture(); + const profile = resolveQualifiedAcpxProfile("grok", "grok-4.7"); + const input = { ...fixture.input, profile, requestedModel: "grok-4.7", grokDisableWebSearch: true }; + const disabled = await createAcpxRecoveryBinding(input); + const enabled = await createAcpxRecoveryBinding({ ...input, grokDisableWebSearch: false }); + expect(enabled.profileSessionKey).not.toBe(disabled.profileSessionKey); + const expected = { ...fixture.expected, profileDigest: disabled.commandDigest, requestedModel: "grok-4.7", effectiveModel: "grok-4.7", grokDisableWebSearch: true }; + const saved = createAcpxIdentityRecord(expected, disabled); + expect(() => verifyExpectedAcpxIdentity(expected, disabled, { ...saved, grokDisableWebSearch: undefined })).toThrow("persisted"); + expect(() => verifyExpectedAcpxIdentity(expected, enabled, saved)).toThrow("immutable"); + }); it("binds Pi thinking mode and rejects old or mismatched warm identities", async () => { const fixture = await recoveryFixture(); diff --git a/packages/paperclip-runner/src/drivers/acpx/recovery-identity.ts b/packages/paperclip-runner/src/drivers/acpx/recovery-identity.ts index 835a3047831..bb05e194ff6 100644 --- a/packages/paperclip-runner/src/drivers/acpx/recovery-identity.ts +++ b/packages/paperclip-runner/src/drivers/acpx/recovery-identity.ts @@ -1,4 +1,6 @@ +import { resolveGrokDisableWebSearch } from "./grok-web-search.js"; import { resolveClaudeEffort } from "./claude-effort.js"; +import { resolveGrokEffort } from "./grok-effort.js"; import { parseProviderMode } from "../../contracts/provider-mode.js"; import { resolvePiThinkingLevel, type PiThinkingLevel } from "./pi-thinking.js"; import { createHash } from "node:crypto"; @@ -25,6 +27,8 @@ export interface AcpxRecoveryBinding { mode?: string; piThinkingLevel?: PiThinkingLevel; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; profileSessionKey: string; } @@ -42,6 +46,8 @@ export interface AcpxIdentityRecord { mode?: string; piThinkingLevel?: PiThinkingLevel; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; providerLifetimeFenceCandidates: readonly [number, number, number]; } @@ -55,6 +61,8 @@ export async function createAcpxRecoveryBinding(input: { mode?: string; piThinkingLevel?: PiThinkingLevel; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; providerConfigurationDigest?: string; homeBinding?: Readonly>; providerPolicy?: { readOnly: boolean; readRoots?: readonly string[]; protectedPaths?: readonly string[] }; @@ -63,6 +71,8 @@ export async function createAcpxRecoveryBinding(input: { const mode = parseProviderMode(input.mode); const piThinkingLevel = resolvePiThinkingLevel(input.profile.agent, input.piThinkingLevel); const claudeEffort = resolveClaudeEffort(input.profile.agent, input.claudeEffort); + const grokEffort = resolveGrokEffort(input.profile.agent, input.grokEffort); + const grokDisableWebSearch = resolveGrokDisableWebSearch(input.profile.agent, input.grokDisableWebSearch); if (input.providerPolicy !== undefined && typeof input.providerPolicy.readOnly !== "boolean") throw new Error("ACPX recovery requires a valid task execution policy"); if (input.requestedModel !== input.profile.qualificationModel) { throw new Error("ACPX recovery requested model does not match its admitted profile"); @@ -112,6 +122,8 @@ export async function createAcpxRecoveryBinding(input: { ...(mode ? { mode } : {}), ...(piThinkingLevel ? { piThinkingLevel } : {}), ...(claudeEffort ? { claudeEffort } : {}), + ...(grokEffort ? { grokEffort } : {}), + ...(grokDisableWebSearch === undefined ? {} : { grokDisableWebSearch }), }), ).replace("sha256:", "paperclip-"); return { @@ -127,6 +139,8 @@ export async function createAcpxRecoveryBinding(input: { ...(mode ? { mode } : {}), ...(piThinkingLevel ? { piThinkingLevel } : {}), ...(claudeEffort ? { claudeEffort } : {}), + ...(grokEffort ? { grokEffort } : {}), + ...(grokDisableWebSearch === undefined ? {} : { grokDisableWebSearch }), profileSessionKey, }; } @@ -150,6 +164,8 @@ export function createAcpxIdentityRecord( ...(binding.mode ? { mode: binding.mode } : {}), ...(binding.piThinkingLevel ? { piThinkingLevel: binding.piThinkingLevel } : {}), ...(binding.claudeEffort ? { claudeEffort: binding.claudeEffort } : {}), + ...(binding.grokEffort ? { grokEffort: binding.grokEffort } : {}), + ...(binding.grokDisableWebSearch === undefined ? {} : { grokDisableWebSearch: binding.grokDisableWebSearch }), providerLifetimeFenceCandidates: Object.freeze([ ...expected.providerLifetimeFenceCandidates, ]) as readonly [number, number, number], @@ -178,6 +194,8 @@ export function acpxProviderSessionIdentity( ...(record.mode ? { mode: record.mode } : {}), ...(record.piThinkingLevel ? { piThinkingLevel: record.piThinkingLevel } : {}), ...(record.claudeEffort ? { claudeEffort: record.claudeEffort } : {}), + ...(record.grokEffort ? { grokEffort: record.grokEffort } : {}), + ...(record.grokDisableWebSearch === undefined ? {} : { grokDisableWebSearch: record.grokDisableWebSearch }), providerLifetimeFenceCandidates: record.providerLifetimeFenceCandidates, }; verifyExpectedAcpxIdentity(identity, binding, record); @@ -205,7 +223,8 @@ export function verifyExpectedAcpxIdentity( expected.permissionMode !== binding.permissionMode || expected.mode !== binding.mode || expected.piThinkingLevel !== binding.piThinkingLevel || - expected.claudeEffort !== binding.claudeEffort + expected.claudeEffort !== binding.claudeEffort || + expected.grokEffort !== binding.grokEffort || expected.grokDisableWebSearch !== binding.grokDisableWebSearch ) { throw new Error( "ACPX recovery identity conflicts with the immutable session configuration", @@ -227,6 +246,7 @@ export function verifyExpectedAcpxIdentity( record.mode !== binding.mode || record.piThinkingLevel !== binding.piThinkingLevel || record.claudeEffort !== binding.claudeEffort || + record.grokEffort !== binding.grokEffort || record.grokDisableWebSearch !== binding.grokDisableWebSearch || !sameFenceCandidates( record.providerLifetimeFenceCandidates, expected.providerLifetimeFenceCandidates, @@ -253,7 +273,7 @@ function parsePersistedRecord(value: unknown): AcpxIdentityRecord { "permissionMode", "mode", "piThinkingLevel", - "claudeEffort", + "claudeEffort", "grokEffort", "grokDisableWebSearch", "providerLifetimeFenceCandidates", ]); return validatedRecord(record); @@ -282,6 +302,8 @@ function validatedRecord(value: Record): AcpxIdentityRecord { } if (value.mode !== undefined) parseProviderMode(value.mode); resolveClaudeEffort("claude", value.claudeEffort); + resolveGrokEffort("grok", value.grokEffort); + resolveGrokDisableWebSearch("grok", value.grokDisableWebSearch); if (value.piThinkingLevel !== undefined) resolvePiThinkingLevel("pi", value.piThinkingLevel); validateFenceCandidates(value.providerLifetimeFenceCandidates); return value as unknown as AcpxIdentityRecord; @@ -313,6 +335,8 @@ function validateExpected(expected: AcpxExpectedSessionIdentity): void { } if (expected.mode !== undefined) parseProviderMode(expected.mode); resolveClaudeEffort("claude", expected.claudeEffort); + resolveGrokEffort("grok", expected.grokEffort); + resolveGrokDisableWebSearch("grok", expected.grokDisableWebSearch); if (expected.piThinkingLevel !== undefined) resolvePiThinkingLevel("pi", expected.piThinkingLevel); validateFenceCandidates(expected.providerLifetimeFenceCandidates); } diff --git a/packages/paperclip-runner/src/drivers/acpx/runtime-host.ts b/packages/paperclip-runner/src/drivers/acpx/runtime-host.ts index a58bfe2ea75..ddba9de9944 100644 --- a/packages/paperclip-runner/src/drivers/acpx/runtime-host.ts +++ b/packages/paperclip-runner/src/drivers/acpx/runtime-host.ts @@ -1,5 +1,7 @@ +import { resolveGrokDisableWebSearch } from "./grok-web-search.js"; import { composeCopilotSystemInstructions } from "./copilot-profile.js"; import { resolveClaudeEffort } from "./claude-effort.js"; +import { resolveGrokEffort } from "./grok-effort.js"; import { piProviderConfiguration } from "./pi-provider-config.js"; import { withAcpxTurnCancellation } from "./turn-cancellation.js"; import { resolveAcpxProviderMode } from "./provider-mode.js"; @@ -88,6 +90,8 @@ export interface AcpxRuntimePortIdentity { mode?: string; piThinkingLevel?: PiThinkingLevel; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; acpxRecordId: string; backendSessionId: string; agentSessionId: string; @@ -169,6 +173,8 @@ export interface AcpxRuntimePortOpenOptions { mode?: string; piThinkingLevel?: PiThinkingLevel; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; permissionPolicy: ReturnType; launchEnvironment: Readonly; /** Kernel credential-home quorum inherited by the provider sentinel. */ @@ -244,6 +250,8 @@ export interface OpenAcpxRuntimeHostOptions { mode?: string; piThinkingLevel?: PiThinkingLevel; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; systemInstructions?: string; runtimeContext?: NativeRuntimeContextSnapshot | null; environment?: NodeJS.ProcessEnv; @@ -369,6 +377,8 @@ export class AcpxRuntimeHost { mode: resolveAcpxProviderMode(options.agent, options.mode), piThinkingLevel: resolvePiThinkingLevel(options.agent, options.piThinkingLevel), claudeEffort: resolveClaudeEffort(options.agent, options.claudeEffort), + grokEffort: resolveGrokEffort(options.agent, options.grokEffort), + grokDisableWebSearch: resolveGrokDisableWebSearch(options.agent, options.grokDisableWebSearch), ...(preconfigured ? { homeBinding: preconfiguredHomeEnvironment(options.environment) } : {}), ...(["cursor", "copilot", "pi"].includes(options.agent) && options.providerPolicy !== undefined ? { providerPolicy: options.providerPolicy } : {}), @@ -624,6 +634,7 @@ export class AcpxRuntimeHost { mode: binding.mode, piThinkingLevel: binding.piThinkingLevel, claudeEffort: binding.claudeEffort, + grokEffort: binding.grokEffort, grokDisableWebSearch: binding.grokDisableWebSearch, permissionPolicy: acpxRuntimePermissionPolicy( binding.permissionMode, ), @@ -689,6 +700,7 @@ export class AcpxRuntimeHost { throw new Error("ACPX runtime Pi thinking level conflicts with session binding"); } if (runtimeIdentity.claudeEffort !== binding.claudeEffort) throw new Error("ACPX runtime Claude effort conflicts with session binding"); + if (runtimeIdentity.grokEffort !== binding.grokEffort || runtimeIdentity.grokDisableWebSearch !== binding.grokDisableWebSearch) throw new Error("ACPX runtime Grok effort conflicts with session binding"); const observedIdentity: AcpxExpectedSessionIdentity = { kind: "acpx", normalizedSessionId: binding.normalizedSessionId, diff --git a/packages/paperclip-runner/src/drivers/acpx/runtime-sandbox.test.ts b/packages/paperclip-runner/src/drivers/acpx/runtime-sandbox.test.ts index 7640f681d04..a8852499b24 100644 --- a/packages/paperclip-runner/src/drivers/acpx/runtime-sandbox.test.ts +++ b/packages/paperclip-runner/src/drivers/acpx/runtime-sandbox.test.ts @@ -99,6 +99,14 @@ describe("ACPX runtime sandbox", () => { expect((await stat(requirementsPath)).mode & 0o777).toBe(0o600); }); + it.each([true, false])("preserves Grok search policy %s above compatible project settings", async disabled => { + const fixture = await sandboxFixture("grok"); + const sandbox = await prepareAcpxRuntimeSandbox({ binding: { ...fixture.binding, grokDisableWebSearch: disabled }, agent: "grok" }); + expect(await readFile(join(sandbox.agentHomeDirectory, "config.toml"), "utf8")).toContain(`disable_web_search = ${disabled}`); + const requirements = await readFile(join(sandbox.agentHomeDirectory, "requirements.toml"), "utf8"); + expect(requirements.includes("disable_web_search = true")).toBe(disabled); + }); + it("keeps provider credentials outside identity-enabled Codex shell commands", async () => { const fixture = await sandboxFixture("codex"); const sandbox = await prepareAcpxRuntimeSandbox({ diff --git a/packages/paperclip-runner/src/drivers/acpx/runtime-sandbox.ts b/packages/paperclip-runner/src/drivers/acpx/runtime-sandbox.ts index 0a2f679bbaf..6f4543c23ef 100644 --- a/packages/paperclip-runner/src/drivers/acpx/runtime-sandbox.ts +++ b/packages/paperclip-runner/src/drivers/acpx/runtime-sandbox.ts @@ -443,6 +443,7 @@ export async function prepareAcpxRuntimeSandbox(input: { // Native project rules merge with global rules. Ask rules win over project // allows, keeping operation approval at the runner's authenticated boundary. await writePrivateFile(join(agentHomeDirectory, "config.toml"), [ + `disable_web_search = ${input.binding.grokDisableWebSearch === true}`, "[permission]", 'ask = ["Bash", "Read", "Edit", "Grep", "MCPTool", "WebFetch", "WebSearch"]', "[ui]", 'permission_mode = "ask"', @@ -458,7 +459,7 @@ export async function prepareAcpxRuntimeSandbox(input: { // Always-approve may otherwise be enabled by compatible project settings. // Even approve-all runs use one host decision per requested operation. await writePrivateFile(join(agentHomeDirectory, "requirements.toml"), - "[ui]\ndisable_bypass_permissions_mode = true\n"); + `${input.binding.grokDisableWebSearch === true ? "disable_web_search = true\n" : ""}[ui]\ndisable_bypass_permissions_mode = true\n`); } if (input.agent === "pi") { await writePrivateFile( diff --git a/packages/paperclip-runner/src/drivers/acpx/sidecar-protocol.ts b/packages/paperclip-runner/src/drivers/acpx/sidecar-protocol.ts index 717ffc97748..efc7ea9f63b 100644 --- a/packages/paperclip-runner/src/drivers/acpx/sidecar-protocol.ts +++ b/packages/paperclip-runner/src/drivers/acpx/sidecar-protocol.ts @@ -48,6 +48,8 @@ export interface AcpxSidecarOpenParams { mode?: string; piThinkingLevel?: "off" | "low" | "high" | "max"; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; permissionModePinned: boolean; providerPolicy?: { readOnly: boolean }; systemInstructions: string; @@ -71,6 +73,8 @@ export interface AcpxExpectedSessionIdentity { mode?: string; piThinkingLevel?: "off" | "low" | "high" | "max"; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; providerLifetimeFenceCandidates: readonly [number, number, number]; } diff --git a/packages/paperclip-runner/src/index.ts b/packages/paperclip-runner/src/index.ts index 38c34e26872..a4d3769bb4c 100644 --- a/packages/paperclip-runner/src/index.ts +++ b/packages/paperclip-runner/src/index.ts @@ -61,6 +61,7 @@ export { } from "./drivers/acpx/codex-acpx-driver.js"; export * from "./drivers/acpx/sidecar-protocol.js"; export { resolveClaudeEffort } from "./drivers/acpx/claude-effort.js"; +export { resolveGrokEffort } from "./drivers/acpx/grok-effort.js"; export * from "./drivers/runner-tool-bridge.js"; export { createRunnerdCodexTransport, @@ -103,3 +104,5 @@ export type { RunnerExecutionDriver } from "./control-plane/runner-execution-dri export { bindRunnerLaunchResources, createRunnerProviderLaunch, runnerProviderLaunchRequirements, runnerLaunchRequirementsDigest, validatePreparedRunnerLaunch } from "./live/runner-provider-launch.js"; export type { RunnerProviderLaunchRequirements, RunnerProviderLaunchEnvironment, PreparedRunnerProviderLaunch, RunnerLaunchPreparer } from "./live/runner-provider-launch.js"; + +export { resolveGrokDisableWebSearch } from "./drivers/acpx/grok-web-search.js"; diff --git a/packages/paperclip-runner/src/live/runner-provider-launch.test.ts b/packages/paperclip-runner/src/live/runner-provider-launch.test.ts index 57f237bd57d..b924df89d74 100644 --- a/packages/paperclip-runner/src/live/runner-provider-launch.test.ts +++ b/packages/paperclip-runner/src/live/runner-provider-launch.test.ts @@ -19,6 +19,17 @@ const environment: RunnerProviderLaunchEnvironment = { }; describe("built-in provider launch preparation", () => { + it.each([true, false])("binds Grok search policy %s into the prepared descriptor", disabled => { + const selected = runnerProviderLaunchRequirements({ provider: "acpx", acpxAgent: "grok", grokDisableWebSearch: disabled }, + requirements.identity, { model: "grok-4.7" }, null, ""); + const launch = createRunnerProviderLaunch(selected, environment); + expect(launch).toHaveProperty("grokDisableWebSearch", disabled); + const prepared = { configurationId: "grok-policy", requirementsDigest: runnerLaunchRequirementsDigest(selected), provider: launch }; + expect(() => validatePreparedRunnerLaunch(selected, prepared)).not.toThrow(); + expect(() => validatePreparedRunnerLaunch(selected, { ...prepared, provider: { ...launch, grokDisableWebSearch: !disabled } })) + .toThrow("runner_prepared_launch_requirements_mismatch"); + }); + it("binds disabled hosted search to the prepared launch and overrides execution-host arguments", () => { const disabled = runnerProviderLaunchRequirements({ provider: "codex", disableCodexWebSearch: true }, requirements.identity, { model: requirements.model }, null, ""); diff --git a/packages/paperclip-runner/src/live/runner-provider-launch.ts b/packages/paperclip-runner/src/live/runner-provider-launch.ts index 5f2ae436d1e..6f2a815e3d3 100644 --- a/packages/paperclip-runner/src/live/runner-provider-launch.ts +++ b/packages/paperclip-runner/src/live/runner-provider-launch.ts @@ -23,7 +23,7 @@ export interface RunnerProviderLaunchRequirements { includeCollaborationModeInstructions: boolean; settings: Pick; + "piThinkingLevel" | "claudeEffort" | "grokEffort" | "grokDisableWebSearch" | "managedProfile" | "agentCoreProfile" | "opencodePermissionMode" | "disableCodexWebSearch">; instructions: string; runtimeContext: NativeRuntimeContextSnapshot | null; } @@ -56,7 +56,7 @@ export function runnerProviderLaunchRequirements( acpxAgent: options.acpxAgent, acpxMode: options.acpxMode, acpxPermissionMode: options.acpxPermissionMode, acpxPermissionModePinned: options.acpxPermissionModePinned, - piThinkingLevel: options.piThinkingLevel, claudeEffort: options.claudeEffort, + piThinkingLevel: options.piThinkingLevel, claudeEffort: options.claudeEffort, grokEffort: options.grokEffort, grokDisableWebSearch: options.grokDisableWebSearch, managedProfile: options.managedProfile, agentCoreProfile: options.agentCoreProfile, opencodePermissionMode: options.opencodePermissionMode, ...(options.disableCodexWebSearch === true ? { disableCodexWebSearch: true } : {}), @@ -121,6 +121,7 @@ export function validatePreparedRunnerLaunch( if (requirements.provider === "acpx") { const policy = descriptor.providerPolicy as Record | undefined; if (descriptor.agent !== (requirements.settings.acpxAgent ?? "codex") + || descriptor.grokDisableWebSearch !== requirements.settings.grokDisableWebSearch || descriptor.permissionMode !== resolveRunnerdAcpxPermissionMode(requirements.settings.acpxPermissionMode) || policy?.readOnly !== requirements.readOnly || descriptor.runId !== requirements.identity.runId @@ -246,6 +247,8 @@ export function createRunnerProviderLaunch( ...(selectedAcpxMode === undefined ? {} : { mode: selectedAcpxMode }), ...(acpxProfile!.agent === "pi" ? { piThinkingLevel: settings.piThinkingLevel } : {}), ...(acpxProfile!.agent === "claude" && settings.claudeEffort ? { claudeEffort: settings.claudeEffort } : {}), + ...(acpxProfile!.agent === "grok" && settings.grokEffort ? { grokEffort: settings.grokEffort } : {}), + ...(acpxProfile!.agent === "grok" && settings.grokDisableWebSearch !== undefined ? { grokDisableWebSearch: settings.grokDisableWebSearch } : {}), permissionMode: resolveRunnerdAcpxPermissionMode( settings.acpxPermissionMode, ), diff --git a/packages/paperclip-runner/src/live/runnerd-codex-transport.ts b/packages/paperclip-runner/src/live/runnerd-codex-transport.ts index aa4f781f06f..c05c6a14894 100644 --- a/packages/paperclip-runner/src/live/runnerd-codex-transport.ts +++ b/packages/paperclip-runner/src/live/runnerd-codex-transport.ts @@ -1,3 +1,4 @@ +import { resolveGrokDisableWebSearch, admittedGrokWebSearchPolicy } from "../drivers/acpx/grok-web-search.js"; import { PRP_COMPLETION_TOOL_NAME, PRP_COMPLETION_RESULT_BRIDGE_INPUT_SCHEMA } from "../contracts/completion-result.js"; import { RunnerLaunchPreparationStore } from "./runner-launch-preparation-store.js"; import type { PreparedRunnerProviderLaunch, RunnerProviderLaunchRequirements } from "./runner-provider-launch.js"; @@ -8,6 +9,7 @@ import type { RunnerExecutionDriver } from "../control-plane/runner-execution-dr import { resolvePinnedOpenCodeCommand } from "../drivers/opencode/opencode-server-driver.js"; import { ACPX_CAPABILITY_PROFILES } from "../drivers/acpx/capability-profiles.js"; import { resolveClaudeEffort, admittedClaudeEffort } from "../drivers/acpx/claude-effort.js"; +import { resolveGrokEffort, admittedGrokEffort } from "../drivers/acpx/grok-effort.js"; import { admittedPiThinkingLevel, resolvePiThinkingLevel } from "../drivers/acpx/pi-thinking.js"; import { configuredEnvironment } from "../configured-environment.js"; import { githubCredentialEnvironment } from "../github-credential-environment.js"; @@ -1213,6 +1215,8 @@ export interface CapabilityRunnerdProcessEvidence { /** Effective native mode, populated only from the admitted Pi identity. */ piThinkingLevel?: "off" | "low" | "high" | "max"; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; providerVersion: string | null; acpxAgent: QualifiedAcpxAgent | null; agentServerVersion: string | null; @@ -1242,6 +1246,8 @@ export interface CapabilityRunnerdCodexTransportOptions extends RunnerExecutionD acpxMode?: string; piThinkingLevel?: "off" | "low" | "high" | "max"; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; acpxPermissionModePinned?: boolean; acpxSidecarPath?: string; /** SHA-256 verified by the provider-pack authority before runner startup. */ @@ -3601,6 +3607,8 @@ class DurablePrpCodexTransport implements CodexAppServerTransport { throw new Error("runner_launch_preparation_requires_process_owner_and_artifact"); } resolveClaudeEffort(options.provider === "acpx" ? options.acpxAgent ?? "codex" : "", options.claudeEffort); + resolveGrokEffort(options.provider === "acpx" ? options.acpxAgent ?? "codex" : "", options.grokEffort); + resolveGrokDisableWebSearch(options.provider === "acpx" ? options.acpxAgent ?? "codex" : "", options.grokDisableWebSearch); resolvePiThinkingLevel(options.provider === "acpx" ? options.acpxAgent ?? "codex" : "", options.piThinkingLevel); if (options.acpxMode !== undefined && options.provider !== "acpx") { throw new Error("acpxMode requires the ACPX provider"); @@ -6766,7 +6774,11 @@ class DurablePrpCodexTransport implements CodexAppServerTransport { throw new Error("ACPX capability identity differs from the admitted profile"); } const claudeEffort = admittedClaudeEffort(this.options.acpxAgent ?? "codex", this.options.claudeEffort, descriptor, providerIdentity); + const grokEffort = admittedGrokEffort(this.options.acpxAgent ?? "codex", this.options.grokEffort, descriptor, providerIdentity); + admittedGrokWebSearchPolicy(this.options.acpxAgent ?? "codex", this.options.grokDisableWebSearch, descriptor, providerIdentity); if (claudeEffort !== undefined) this.#evidence.claudeEffort = claudeEffort; + if (grokEffort !== undefined) this.#evidence.grokEffort = grokEffort; + if (this.options.grokDisableWebSearch !== undefined) this.#evidence.grokDisableWebSearch = this.options.grokDisableWebSearch; const piThinkingLevel = admittedPiThinkingLevel(this.options.acpxAgent ?? "codex", this.options.piThinkingLevel, descriptor, providerIdentity); if (piThinkingLevel !== undefined) this.#evidence.piThinkingLevel = piThinkingLevel; this.#turnControls = parseAcpxTurnControlCapabilities(descriptor.turnControls, descriptor.agent); diff --git a/packages/paperclip-runner/src/protocol/generated/schema-bundle.ts b/packages/paperclip-runner/src/protocol/generated/schema-bundle.ts index a8898718e93..f82900041aa 100644 --- a/packages/paperclip-runner/src/protocol/generated/schema-bundle.ts +++ b/packages/paperclip-runner/src/protocol/generated/schema-bundle.ts @@ -1374,6 +1374,18 @@ export const providerDescriptorSchema = { "xhigh", "max" ] + }, + "grokEffort": { + "enum": [ + "minimal", + "low", + "medium", + "high", + "xhigh" + ] + }, + "grokDisableWebSearch": { + "type": "boolean" } }, "allOf": [ @@ -1724,6 +1736,46 @@ export const providerDescriptorSchema = { } } } + }, + { + "if": { + "required": [ + "grokEffort" + ] + }, + "then": { + "properties": { + "provider": { + "const": "acpx" + }, + "agent": { + "const": "grok" + } + }, + "required": [ + "agent" + ] + } + }, + { + "if": { + "required": [ + "grokDisableWebSearch" + ] + }, + "then": { + "properties": { + "provider": { + "const": "acpx" + }, + "agent": { + "const": "grok" + } + }, + "required": [ + "agent" + ] + } } ], "$defs": { diff --git a/packages/paperclip-runner/test-fixtures/pi-acp/profile-v30-identity.json b/packages/paperclip-runner/test-fixtures/pi-acp/profile-v30-identity.json new file mode 100644 index 00000000000..1bd57db0260 --- /dev/null +++ b/packages/paperclip-runner/test-fixtures/pi-acp/profile-v30-identity.json @@ -0,0 +1,51 @@ +{ + "commandDigest": "sha256:4517ab123dd89140ef462fc1905ac7a16a0dfcbaf21d67299a3c62de29c08a4d", + "declaration": { + "schema": "paperclip.acpx_profile_declaration.v1", + "agent": "pi", + "agentProfileVersion": 30, + "acpxVersion": "0.13.1", + "agentServerVersion": "0.0.33", + "agentRuntimeVersion": "1.0.0", + "nodeVersion": "24.21.0", + "closure": { + "darwin-arm64": "282022db10150c6632b3444df421342e7d534bdf5d5fb1097a2e79d0625a2bcf", + "darwin-x64": "64e251e19009f755c0b04f73ce2138246faab71a961b0f13d75ebfcc34bef12e", + "linux-x64": "713b1fdff42fb56a1518bdc084f181d70bee8ebadc3e4b1d76321ed9108c8410" + }, + "wrapperSha256": "9d129b3d38772e93e97080aa6c4e574ac5df4e47ce5bc331a484a9fbf8188b36", + "helperSha256": "41e0490b617da0d60e0c8ec58ef311236f945129d99f816cff6897f78da7f91d", + "extensionSha256": "f5818573a355702388072b28926897db546a5cf346b5171f646582ce5f9102a4", + "agentFilesBinding": "registered-runtime-context-v1", + "nativeQuestions": "select-confirm-input-editor-v4-root-field-types", + "pathPolicy": "sdk-normalization-v1", + "mcpToolNames": "provider-safe-exact-source-v1", + "acpxPatchSha256": "00d6af17216cb0cad902b48633eb19bf0ec6b05837a984cb24661fca593f09c1", + "nativeAssistantMessages": "pi1-rpc-deltas-v3-bound-message-and-tool-receipts", + "nativeNotices": "session-extension-v2-bounded-runtime-failure", + "messageProjectionSha256": "17d1e91b948dfa6a56e1905645add52b502041ad843c8d50a13b07956f22aadd", + "noticeProjectionSha256": "014485adc690998e395d334ea3ae67f72be6060a2fc78a1185df7b8d1da28fbf", + "sharedRuntimeContract": "paperclip.acpx-runtime-contract.v1", + "nativeInputDisposition": "queued-only-v1", + "cacheWarming": "disabled-owned-decision-v1", + "thinkingLevel": { + "supported": [ + "off", + "low", + "high", + "max" + ], + "newConfigurationDefault": "low", + "admission": "explicit-native-effective-before-prompt-v1", + "recovery": "mode-bound-v1" + }, + "modelSelection": "caller-selected-native-verified-v1", + "providerConfigurationSourceSha256": "75a9a13f13f224dc092bd8ebf49e8747162172943761e44476c8eb18d80c52d4", + "credentialEnvironmentSourceSha256": "7586d44b47c83395498dc8806287cd3538ef58177ba7c5949f5766ed105a0161", + "runtimeSandboxSourceSha256": "981449a4c6d10f682ecf86d834eed07faca30a7d9b419fb8db4973a442a343ec", + "recoveryIdentitySourceSha256": "f74d061cc07b0c7ca04df62ca991d940a733d9ef6594b3362451769fc10030b8", + "nativeCancellation": "acknowledged-cancelled-terminal-preserves-usage-v1", + "dependencySecurityPatchSha256": "5273a195b952f233336122842faaf650193c04f36b9359d20d4d63079b0ce814", + "openRouterAttributionSourceSha256": "1211191529d6073b733b311c3d69cada4973eede0f3e540c46e261f78e0b90f9" + } +} diff --git a/packages/paperclip-runner/test/fixtures/copilot-profile-v66-identity.json b/packages/paperclip-runner/test/fixtures/copilot-profile-v66-identity.json new file mode 100644 index 00000000000..72cafbda261 --- /dev/null +++ b/packages/paperclip-runner/test/fixtures/copilot-profile-v66-identity.json @@ -0,0 +1,85 @@ +{ + "commandDigest": "sha256:0cddc219af25b741b7138f38faa7514dd5ee3427b1d3168e8a4bfbe5180983e8", + "declaration": { + "schema": "paperclip.acpx_profile_declaration.v1", + "agent": "copilot", + "agentProfileVersion": 66, + "acpxVersion": "0.13.1", + "agentServerVersion": "1.0.88", + "protocolPolicyRevision": "copilot-agent-manual-v1", + "acpxPatchSha256": "00d6af17216cb0cad902b48633eb19bf0ec6b05837a984cb24661fca593f09c1", + "policySha256": "a4be69be43db84052560420a3ca546a665c9165573c24d543eb33d144ba138a3", + "distributionSourceSha256": "c0a65e247fc47b263bd369a3d5ab505c4b323d4e6493be8a9ecbeb0e9dbb9107", + "agentFilesBinding": "registered-runtime-context-v1", + "systemInstructionDelivery": "COPILOT_HOME/copilot-instructions.md:replace-under-lifetime-lease-before-launch:v1", + "sharedRuntimeContract": "paperclip.acpx-runtime-contract.v1", + "innerDistributionSourceSha256": "9bb08347eed01f1ab44e065c8b06ead9be3a25973d6e6329dc4c0a099096279a", + "upstreamAppSha256": "7b48282a19b5b0814a0c96ad5e3a125173d792cc55f9525b2effea962f6063c0", + "patchedAppSha256": "61f8eebe0c30cc03b311c6818b2acb158a6d16ca58c8bfac5ebd42db095c2679", + "messageIdentityContract": "copilot-native-message-id-v1", + "ownedDistributionDelivery": "COPILOT_CLI_DIST_DIR:lease-owned-guarded-inner-distribution:v1", + "permissionContextContract": "copilot-edit-permission-context-v1", + "permissionContextSourceSha256": "de2d38d702b3c574161af0c0c04790fb6f6347916eb3916ce7a131a8c229121b", + "permissionAdapterSourceSha256": "ee5929ed2ee647ad0369465dee9d51a00b2dd28e1ff735b43e969ddc9c164668", + "permissionLocationsSourceSha256": "f39a81da395b6e23aa2a1a45572a28846e5e81bfd3d764d9a456f74a79c752e9", + "permissionRedactionSourceSha256": "ad6770c69269087951790e2e87e22ac088e3d432769adf17ebc865ed512e6c4f", + "permissionClassifierSourceSha256": "1161eabd82e26133e3b3db3ab567f65d52808b03f176e93497e02c8330349fb4", + "semanticToolReceiptContract": "paperclip.semantic_tool_receipt.v2", + "semanticReceiptSourceSha256": "b2795726b2234a663fec1a6ca11f0551ae69882fe9e82aa39686e952d036e791", + "semanticBridgeSourceSha256": "8764b8c9032fdc7d1415b01e75a9fc57c550e7a5e11da4bed7d9100082872ae5", + "toolEvidenceSourceSha256": "6eef5039afc75bb851eaf9cd82a6f099e4bd398ca2deb59dd66f5b2a81a7a706", + "semanticNormalizedInputContract": "validated-forwarded-input-commit-v1", + "semanticSidecarSourceSha256": "7d6e948b7cff4df52a9afc916db46ace0f42b4b2d3134ba0c21ee0a928857e62", + "semanticDirectDriverSourceSha256": "d683429427dd8a1a5efe50952018ea486f808bdbf0a92fc5946ee267fe2c72ee", + "semanticValidationSourceSha256": "02fbb92681c78c5de5d2f1aae25aabc25a0e5df6b0ff4baccac652192a8da975", + "semanticNormalizationSourceSha256": "8b628b82e8eacc91cdcc6fdca2210ba4cf282f01e9c6f74e95ff271655b5047e", + "semanticCompletionContractSourceSha256": "f49398b682a5623812f5d3c33d6bb9a749008e47cc0ed969072041615f66df59", + "semanticValidatorsSourceSha256": "f22d9caf2035b600abc1a6625ae23ca97f1409d7e29ed5b7264bb8f9784c7dc9", + "semanticSchemaBundleSourceSha256": "4cae579aac836762fdbf92c5447425d8b756e87a5766bc0c7a1885a90541c8d6", + "semanticSidecarProtocolSourceSha256": "26dd0cfbef8b2b401de6b7862a4af7f243fb703e23678a1a5ed8fa68d4784d42", + "semanticSidecarReceiptCommitContract": "correlated-tool-resolve-v1", + "displayEventSourceSha256": "d72f9a6035c247bc6a42c067c05753076c54322c4b58984e93922f3325dc6877", + "displayProjectionSourceSha256": "75952606b26dd93bbc582c1f0a4424487377272ea745fb3a27ceae031fd5dc7e", + "configuredEnvironmentSourceSha256": "5c9008d121979a3a8987e6b8a5752172eafdc4a2b5d725a73f3bbb8fb83be8ff", + "configuredEnvironmentRustSourceSha256": "85c87fae62b8a9377e4f0a4c00302c7519fae4397b1c48253f8f2b7ba7faf994", + "profileActivitySourceSha256": "4fdb6b0f9125fd8372ba6f27945fa5c8a3d3b2ec891df544092e3dc7a75d5282", + "profileExtensionsSourceSha256": "a80ddc95eb4505095bfdbbf85c758199949ab20be9c84b34c77f762eb7180571", + "profileInstallationSourceSha256": "3e61c4cdd4b78e38fcb16eaadae4f1fd65ce3c7127184ea7a80948c8e5d77f88", + "attachmentPolicySourceSha256": "4f7638b7cc64e18f6a4ba33fd46de2b3d49225e32aeab41f5c695b268fa4f8e2", + "singleReadEvidenceSourceSha256": "4069393405089bde613cecec04f5123c426594811da4c668bd96f0e7e283550f", + "nativeSessionRuntimeSourceSha256": "1fe6fa9e6b96d84d70432b85a57c473f833606d4a521563d5022b4d3c41576ce", + "nativeRuntimeContextSourceSha256": "71607f80dbb8dc5cc6c123d0b8f3995d6c5407277695a8c82cbedc90fb8f4842", + "nativeRuntimePromptsSourceSha256": "fff5755dba9b7dce8a5f10ff6ac6d5ed06b92ed079ce1e0a44ac72f2ce7869c1", + "nativeSessionContractSourceSha256": "22a8c96ce41ba4f03e976fc37f0cc7c5d05cee99fa789941da31ee1dab440b90", + "harnessSessionContractSourceSha256": "baba1a210b863518f01e0c875606ed37f9467c433222251438578bd999bc43b5", + "harnessBackendSourceSha256": "dc827e281ae6731545b166ee4d709a4f67f594a556dcbe63c70fe8f1aca26249", + "harnessSessionSourceSha256": "81361733e86b56dd5a66415aefc6f72e69be24acc8d3417370154ebb7fef6e94", + "transportContractSourceSha256": "03fca93d36a89b0cc0917335e293ad097fdf04356d21b307827bb0ea4c13f523", + "nativeBackendSourceSha256": "7495d9898d22dca1ebf6336361d332bafefc4498f6e49f1135025fad846c8586", + "nativeBackendFactorySourceSha256": "7e431c926b76d53c4c08e3a4105353dcd34bd940f6588a1a68f79631f6feeb44", + "nativeInstructionsSourceSha256": "82ac6e5f7275b4ef79fb166c7330efc504e80cab3d7e9081e4e40a8b570bc50b", + "providerLaunchSourceSha256": "4c1abd77bbed9723e669009a78dab6fe024837718ced9f22c159f9e22ce1f26c", + "launchPreparationStoreSourceSha256": "ff6025568bbc0aa6ce545772d73dfca2d3da226740bd3a7b386b069e76cff296", + "runtimeRequestBridgeSourceSha256": "9584d9801b87f67e60b0007beafa909fc5b05dc6adac71409db1c7f80a2f7916", + "runtimeRequestFacadeSourceSha256": "d0ed28e0c5ddad34db8f437e704c8a755eb0b47f27e08e44185f66d1d2205295", + "runtimeRequestNotificationSourceSha256": "6196c6175f11c69295dc00fc773201f4fdeca26c500653870253c43b81e65211", + "guardedInstallationSourceSha256": "56a177d3e702914818dca4ca50e061f0d25f988bfc4c0582c36ce23c1696d82f", + "nativeExecutionSourceSha256": "d60b8ea63bad975c0144f0702b2749d7db9a7da50680a6147f20d4d11f2d5297", + "profileCompatibilitySourceSha256": "121214465210f235bebf096a2ff80b093373d84f08b89902e694e6fedbe6ea94", + "installationSourceSha256": "a1c7c6f103b898216973e77ffbac0ef7572e250aa574d1a4065270e9dfa0dc2d", + "assetOwnershipSourceSha256": "1785e3f31e5dad5a13b53e25d8cf9482a9bd89a27b6c127830aed6b81acc605c", + "assetInstallerSourceSha256": "d3bd9514e5920d0cc3567aa50487fb534c57a6f66b8da0d3f22c5f6e499c841f", + "credentialBindingSourceSha256": "7586d44b47c83395498dc8806287cd3538ef58177ba7c5949f5766ed105a0161", + "sidecarErrorSourceSha256": "b09af4577f8bf42eee7036b2ad9842202cfc763e72b53c3287f82c6090cdad80", + "profileSourceSha256": "f5538b3dbefa7634a332b87d5ededcefb56aa7e5790cede1c7a0d948a548a456", + "metadataProbeSourceSha256": "be4c8416edd27061109bc1f33d0c26071b4facbb3f651beaae6b3c0275cce727", + "permissionToolIdentitySourceSha256": "770b47305e571a81f344883057d0e4a482a1cd59ac77d045836593a8e739deb1", + "semanticContinuationSourceSha256": "c9cc0fd516b3df92a6655f56ee9bef37615a889c371e2e137d8ac5c1176de811", + "runtimeHostSourceSha256": "976fef21ec9f3ae9dd5eabb133a55ae578f1c0729c657c30e42562a80db237d8", + "runtimeAdapterSourceSha256": "e2dd18de4b134a5492de93c88b4add479f63fb650c655d60a17c04af722c7563", + "runtimeSandboxSourceSha256": "981449a4c6d10f682ecf86d834eed07faca30a7d9b419fb8db4973a442a343ec", + "cancellationSourceSha256": "a07d1a9e982dec0ae130c1ad1efa5bc75c6a39e013b730ba3ee45256f09ceeca", + "agentFilesSourceSha256": "fb32f6badc13dfa22f231479509b631b2f0eba0c99b1ab9f3cd5c0c601aa03ba", + "nativeDistributionSourceSha256": "aed327c389e957483a503cb1bb8b247ee7cd7ff4b528fb4567c39bcb4577690b" + } +} diff --git a/packages/shared/src/agent-runner.ts b/packages/shared/src/agent-runner.ts index 3ae50819a66..413eb0adfb4 100644 --- a/packages/shared/src/agent-runner.ts +++ b/packages/shared/src/agent-runner.ts @@ -6,10 +6,11 @@ export interface AgentRunnerAvailability { defaultRunner: AgentRunner; } -export function paperclipRunnerProfileForHarness(harness: string): { provider: "codex" | "opencode" } | { provider: "acpx"; acpxAgent: "claude" | "pi" } | undefined { +export function paperclipRunnerProfileForHarness(harness: string): { provider: "codex" | "opencode" } | { provider: "acpx"; acpxAgent: "claude" | "pi" | "grok" } | undefined { if (harness === "codex_local") return { provider: "codex" }; if (harness === "claude_local") return { provider: "acpx", acpxAgent: "claude" }; if (harness === "pi_local") return { provider: "acpx", acpxAgent: "pi" }; + if (harness === "grok_local") return { provider: "acpx", acpxAgent: "grok" }; if (harness === "opencode_local") return { provider: "opencode" }; return undefined; } @@ -29,6 +30,7 @@ function supportsLinuxLibc(libc?: "glibc" | "musl" | "unknown", version?: string export function paperclipRunnerSupportsPlatform(harness: string, platform: string, architecture: string, libc?: "glibc" | "musl" | "unknown", glibcVersion?: string): boolean { return !!paperclipRunnerProfileForHarness(harness) + && (harness !== "grok_local" || (platform === "linux" && architecture === "x64") || (platform === "darwin" && architecture === "arm64")) && !(["opencode_local", "pi_local"].includes(harness) && platform === "linux" && architecture === "arm64") && ((platform === "linux" && supportsLinuxLibc(libc, glibcVersion) && (architecture === "x64" || architecture === "arm64")) || (platform === "darwin" && (architecture === "arm64" || architecture === "x64"))); diff --git a/scripts/pi-public-install-probe.mjs b/scripts/pi-public-install-probe.mjs index 945d8c902de..5ca30bbf939 100644 --- a/scripts/pi-public-install-probe.mjs +++ b/scripts/pi-public-install-probe.mjs @@ -52,8 +52,8 @@ assert.equal(JSON.parse(await readFile(join(server, 'package.json'), 'utf8')).na const { resolvePaperclipRunnerBinary } = await import(pathToFileURL(join(server, 'dist/services/native-runtime/native-codex-runner.js'))); const { createCapabilityRunnerdCodexTransport } = await import(pathToFileURL(join(server, 'dist/vendor/paperclip-runner/live/runnerd-codex-transport.js'))); const { QUALIFIED_ACPX_PROFILES } = await import(pathToFileURL(join(server, 'dist/vendor/paperclip-runner/drivers/acpx/qualified-profiles.js'))); -assert.equal(QUALIFIED_ACPX_PROFILES.pi.agentProfileVersion, 29); -assert.equal(QUALIFIED_ACPX_PROFILES.pi.commandDigest, 'sha256:e80c6dc7bde12790371345ee5a12f0201d30941d26f1a780aec3d090545b2a06'); +assert.equal(QUALIFIED_ACPX_PROFILES.pi.agentProfileVersion, 30); +assert.equal(QUALIFIED_ACPX_PROFILES.pi.commandDigest, 'sha256:4517ab123dd89140ef462fc1905ac7a16a0dfcbaf21d67299a3c62de29c08a4d'); assert.equal(Object.hasOwn(QUALIFIED_ACPX_PROFILES.pi, 'qualificationModel'), false); assert.equal(Object.hasOwn(QUALIFIED_ACPX_PROFILES.pi, 'reportedModelId'), false); const daemon = resolvePaperclipRunnerBinary(); diff --git a/server/src/__tests__/agent-adapter-validation-routes.test.ts b/server/src/__tests__/agent-adapter-validation-routes.test.ts index c1ad79a4cf9..22515f7dc9c 100644 --- a/server/src/__tests__/agent-adapter-validation-routes.test.ts +++ b/server/src/__tests__/agent-adapter-validation-routes.test.ts @@ -363,13 +363,31 @@ describe("agent routes adapter validation", () => { await unregisterTestAdapter(missingAdapterType); }); + it("omits the default marker from the native Grok catalog while retaining Legacy defaults", async () => { + const adapters = await import("../adapters/index.js"); + const models = [{ id: "grok-build", label: "Default" }, { id: "grok-4.7", label: "Grok 4.7" }]; + const list = vi.spyOn(adapters, "listAdapterModels").mockResolvedValue(models); + const refresh = vi.spyOn(adapters, "refreshAdapterModels").mockResolvedValue(models); + try { + const app = await createApp(); + for (const suffix of ["", "&refresh=true"]) { + const native = await requestApp(app, baseUrl => request(baseUrl).get(`/api/companies/company-1/adapters/paperclip_runner/models?provider=acpx&acpxAgent=grok${suffix}`)); + expect(native.status).toBe(200); + expect(native.body).toEqual([models[1]]); + const legacy = await requestApp(app, baseUrl => request(baseUrl).get(`/api/companies/company-1/adapters/grok_local/models?refresh=${Boolean(suffix)}`)); + expect(legacy.status).toBe(200); + expect(legacy.body).toEqual(models); + } + } finally { list.mockRestore(); refresh.mockRestore(); } + }); + it("selects and refreshes the runner provider catalog independently", async () => { const adapters = await import("../adapters/index.js"); const list = vi.spyOn(adapters, "listAdapterModels").mockImplementation(async (type) => [{ id: type, label: type }]); const refresh = vi.spyOn(adapters, "refreshAdapterModels").mockImplementation(async (type) => [{ id: `${type}-fresh`, label: type }]); try { const app = await createApp(); - for (const [provider, adapter] of [["acpx", "claude_local"], ["codex", "codex_local"], ["opencode", "opencode_local"]]) { + for (const [provider, adapter] of [["acpx", "claude_local"], ["acpx&acpxAgent=grok", "grok_local"], ["codex", "codex_local"], ["opencode", "opencode_local"]]) { const res = await requestApp(app, (baseUrl) => request(baseUrl).get(`/api/companies/company-1/adapters/paperclip_runner/models?provider=${provider}`)); expect(res.status).toBe(200); expect(res.body).toEqual([{ id: adapter, label: adapter }]); @@ -746,7 +764,7 @@ describe("agent routes adapter validation", () => { const app = await createApp(); const res = await requestApp(app, baseUrl => request(baseUrl) .post("/api/companies/company-1/adapters/paperclip_runner/test-environment") - .send({ agentId: "11111111-1111-4111-8111-111111111111", adapterConfig: { provider: "acpx", acpxAgent: "grok" } })); + .send({ agentId: "11111111-1111-4111-8111-111111111111", adapterConfig: { provider: "acpx", acpxAgent: "cursor" } })); expect(res.status, JSON.stringify(res.body)).toBe(422); expect(res.body.details).toMatchObject({ code: "paperclip_runner_rollout_disabled" }); expect(probe).not.toHaveBeenCalled(); @@ -875,7 +893,7 @@ describe("agent routes adapter validation", () => { it("keeps other native provider selection behind its existing flag", async () => { const app = await createApp(); - const response = await requestApp(app, baseUrl => request(baseUrl).post("/api/companies/company-1/agents").send({ name: "Native Grok", adapterType: "paperclip_runner", adapterConfig: { provider: "acpx", acpxAgent: "grok", model: "openrouter/deepseek/deepseek-v4-flash-0731" } })); + const response = await requestApp(app, baseUrl => request(baseUrl).post("/api/companies/company-1/agents").send({ name: "Native Cursor", adapterType: "paperclip_runner", adapterConfig: { provider: "acpx", acpxAgent: "cursor", model: "provider-model" } })); expect(response.status).toBe(422); expect(response.body.details).toMatchObject({ code: "paperclip_runner_rollout_disabled" }); }); @@ -1021,6 +1039,43 @@ describe("agent routes adapter validation", () => { expect(mockAgentService.update.mock.calls.at(-1)?.[1]).toMatchObject({ adapterConfig: { provider: "codex" } }); }); + it.each([{ maxTurns: 5 }, { disableWebSearch: "invalid" }])("rejects a direct Grok conversion with incompatible saved settings %j", async unsupported => { + const existing = await mockAgentService.getById(); + mockAgentService.getById.mockResolvedValue({ ...existing, adapterType: "grok_local", + adapterConfig: { model: "grok-4.7", reasoningEffort: "high", ...unsupported } }); + const app = await createApp(); + const res = await requestApp(app, baseUrl => request(baseUrl).patch(`/api/agents/${existing.id}`) + .send({ adapterType: "paperclip_runner" })); + expect(res.status, JSON.stringify(res.body)).toBe(422); + expect(mockAgentService.update).not.toHaveBeenCalled(); + }); + + it("translates compatible settings during a direct Grok conversion", async () => { + const existing = await mockAgentService.getById(); + mockAgentService.getById.mockResolvedValue({ ...existing, adapterType: "grok_local", + adapterConfig: { model: "grok-4.7", reasoningEffort: "high", command: "grok", disableWebSearch: true } }); + const app = await createApp(); + const res = await requestApp(app, baseUrl => request(baseUrl).patch(`/api/agents/${existing.id}`) + .send({ adapterType: "paperclip_runner" })); + expect(res.status, JSON.stringify(res.body)).toBe(200); + const saved = mockAgentService.update.mock.calls.at(-1)?.[1]; + expect(saved).toMatchObject({ adapterType: "paperclip_runner", adapterConfig: { provider: "acpx", acpxAgent: "grok", model: "grok-4.7", reasoningEffort: "high", disableWebSearch: true } }); + expect(saved.adapterConfig).not.toHaveProperty("command"); + }); + + it.each([undefined, "acpx"])("preserves an explicitly selected ACPX agent when converting Grok (provider: %s)", async provider => { + const existing = await mockAgentService.getById(); + mockAgentService.getById.mockResolvedValue({ ...existing, adapterType: "grok_local", adapterConfig: { model: "grok-4.7" } }); + const app = await createApp(); + const res = await requestApp(app, baseUrl => request(baseUrl).patch(`/api/agents/${existing.id}`) + .send({ adapterType: "paperclip_runner", replaceAdapterConfig: true, + adapterConfig: { ...(provider ? { provider } : {}), acpxAgent: "claude", model: "claude-opus-5-5" } })); + expect(res.status, JSON.stringify(res.body)).toBe(200); + expect(mockAgentService.update.mock.calls.at(-1)?.[1]).toMatchObject({ + adapterType: "paperclip_runner", adapterConfig: { provider: "acpx", acpxAgent: "claude", model: "claude-opus-5-5" }, + }); + }); + it.each(["codex_local", "claude_local"])("upgrades an existing %s through runner selection with its saved settings", async adapterType => { const existing = await mockAgentService.getById(); const env = { MIGRATION_MARKER: { type: "plain", value: "keep" } }; diff --git a/server/src/__tests__/agent-runner-qualification-routes.test.ts b/server/src/__tests__/agent-runner-qualification-routes.test.ts index 10c1980d248..1ef12028528 100644 --- a/server/src/__tests__/agent-runner-qualification-routes.test.ts +++ b/server/src/__tests__/agent-runner-qualification-routes.test.ts @@ -58,7 +58,8 @@ describe.skipIf(!support.supported)("agent-scoped runner qualification", () => { }); const qualify = () => request(app).post(`/api/agents/${agentId}/qualify-runner`).send({ expectedEnvironmentId: environmentId }); - it("allows the company owner without instance admin and keeps the generic probe restricted", async () => { + it.each(["claude_local", "grok_local"])("allows the company owner to qualify %s without instance admin and keeps the generic probe restricted", async adapterType => { + await db.update(agents).set({ adapterType }).where(eq(agents.id, agentId)); const before = await db.select().from(agents).where(eq(agents.id, agentId)); const res = await qualify(); expect(res.status).toBe(200); diff --git a/server/src/__tests__/company-portability.test.ts b/server/src/__tests__/company-portability.test.ts index 2a50f43878f..fdf00b828af 100644 --- a/server/src/__tests__/company-portability.test.ts +++ b/server/src/__tests__/company-portability.test.ts @@ -6095,7 +6095,7 @@ describe("company portability", () => { await expect(portability.importBundle(input, "user-1")).rejects.toMatchObject({ status: 422, details: { code: "paperclip_runner_dot_disabled" } }); expect(agentSvc.create).not.toHaveBeenCalled(); instanceSettingsSvc.getExperimental.mockResolvedValue({ enableNativeRunner: false, enableOpenAiDot: true }); - await expect(portability.importBundle({ ...input, adapterOverrides: { claudecoder: { adapterType: "paperclip_runner", adapterConfig: { provider: "acpx", acpxAgent: "grok", model: "grok-build-1.0.13" } } } }, "user-1")) + await expect(portability.importBundle({ ...input, adapterOverrides: { claudecoder: { adapterType: "paperclip_runner", adapterConfig: { provider: "acpx", acpxAgent: "copilot", model: "gpt-5.4" } } } }, "user-1")) .rejects.toMatchObject({ status: 422, details: { code: "paperclip_runner_rollout_disabled" } }); expect(agentSvc.create).not.toHaveBeenCalled(); await portability.importBundle(input, "user-1"); @@ -6106,6 +6106,27 @@ describe("company portability", () => { expect(() => resolvePaperclipRunnerProviderProfile(createdConfig)).toThrow(expect.objectContaining({ code: "paperclip_runner_dot_config_invalid" })); }); + it("imports qualified Grok without the experimental flag and preserves its model and effort", async () => { + const portability = companyPortabilityService({} as any); + const exported = await portability.exportBundle("company-1", { include: { company: false, agents: true, projects: false, issues: false } }); + agentSvc.list.mockResolvedValue([]); + agentSvc.create.mockImplementation(async (_companyId: string, input: Record) => ({ id: "agent-created", ...input })); + instanceSettingsSvc.getExperimental.mockResolvedValue({ enableNativeRunner: false }); + const adapterConfig = { provider: "acpx", acpxAgent: "grok", model: "grok-4.7", reasoningEffort: "high" }; + + await portability.importBundle({ + source: { type: "inline", rootPath: exported.rootPath, files: exported.files }, + include: { company: false, agents: true, projects: false, issues: false }, + target: { mode: "existing_company", companyId: "company-1" }, + agents: "all", collisionStrategy: "rename", + adapterOverrides: { claudecoder: { adapterType: "paperclip_runner", adapterConfig } }, + }, "user-1"); + + expect(agentSvc.create).toHaveBeenCalledWith("company-1", expect.objectContaining({ + adapterType: "paperclip_runner", adapterConfig: expect.objectContaining(adapterConfig), + }), { createdByUserId: "user-1" }); + }); + it("accepts native OpenCode imports without the experimental flag", async () => { const portability = companyPortabilityService({} as any); const exported = await portability.exportBundle("company-1", { diff --git a/server/src/redaction.ts b/server/src/redaction.ts index f2fe6f6fa6b..4d3eeb01e23 100644 --- a/server/src/redaction.ts +++ b/server/src/redaction.ts @@ -93,6 +93,7 @@ export const PAPERCLIP_PUBLIC_SCHEMA_IDS = new Set([ "paperclip.native-execution-input.v7", "paperclip.native-execution-input.v8", "paperclip.native-execution-input.v9", + "paperclip.native-execution-input.v10", "paperclip.native-finalization.v1", "paperclip.native-finalization.v2", "paperclip.native-harness-backup-stamp.v1", diff --git a/server/src/routes/agents.ts b/server/src/routes/agents.ts index 3a2d11e574d..e05270bc240 100644 --- a/server/src/routes/agents.ts +++ b/server/src/routes/agents.ts @@ -1881,7 +1881,7 @@ export function agentRoutes( throw unprocessable("Enable Grok Bot, Assistant connections (MCP), and Paperclip Runner before connecting this agent.", { code: "paperclip_runner_grok_disabled" }); } else if (!([undefined, "codex", "opencode"].includes(asRecord(config)?.provider as string | undefined)) && !(asRecord(config)?.provider === "acpx" && asRecord(config)?.acpxAgent === "copilot") && - !["claude_local", "pi_local"].includes(agentHarnessType("paperclip_runner", asRecord(config) ?? {})) && + !["claude_local", "pi_local", "grok_local"].includes(agentHarnessType("paperclip_runner", asRecord(config) ?? {})) && experimental.enableNativeRunner !== true) { throw unprocessable( "Paperclip Runner is experimental and disabled on this instance.", @@ -1952,7 +1952,7 @@ export function agentRoutes( } if (["openai_dot", "muse"].includes(String(input.nextAdapterConfig.provider))) return input.nextAdapterConfig; const defaults = paperclipRunnerTransitionConfig(input.previousAdapterType, input.previousAdapterConfig.model, input.nextAdapterConfig.provider); - if (!["claude_local", "codex_local", "opencode_local", "pi_local"].includes(input.previousAdapterType) + if (!["claude_local", "codex_local", "opencode_local", "pi_local", "grok_local"].includes(input.previousAdapterType) && !isPaperclipRunnerProvider(input.nextAdapterConfig.provider)) { throw unprocessable("Select a Paperclip Runner provider before converting this agent."); } @@ -3096,7 +3096,8 @@ export function agentRoutes( throw unprocessable("Unknown Paperclip Runner provider"); } const modelAdapterType = type === "paperclip_runner" - ? provider === "acpx" || provider === "claude_managed" ? "claude_local" + ? provider === "acpx" && req.query.acpxAgent === "grok" ? "grok_local" + : provider === "acpx" || provider === "claude_managed" ? "claude_local" : provider === "opencode" ? "opencode_local" : provider === "aws_agentcore" ? type : "codex_local" : type; @@ -3107,7 +3108,10 @@ export function agentRoutes( const models = refresh ? await refreshAdapterModels(modelAdapterType) : await listAdapterModels(modelAdapterType); - res.json(models); + // The Legacy default marker is not an explicit native ACP model ID. + res.json(type === "paperclip_runner" && modelAdapterType === "grok_local" + ? models.filter(model => model.id !== "grok-build") + : models); }); router.get("/companies/:companyId/adapters/:type/detect-model", async (req, res) => { @@ -5427,11 +5431,14 @@ export function agentRoutes( const convertingPi = existing.adapterType === "pi_local" && patchData.adapterType === "paperclip_runner" && (requestedRunnerConfig.provider === undefined || (requestedRunnerConfig.provider === "acpx" && [undefined, "pi"].includes(requestedRunnerConfig.acpxAgent as string | undefined))); - if (runner !== undefined || convertingPi) { + const convertingGrok = existing.adapterType === "grok_local" && patchData.adapterType === "paperclip_runner" + && [undefined, "acpx"].includes(requestedRunnerConfig.provider as string | undefined) + && [undefined, "grok"].includes(requestedRunnerConfig.acpxAgent as string | undefined); + if (runner !== undefined || convertingPi || convertingGrok) { await assertCanConfigureAgentSetup(req, existing); const config = hasOwn(patchData, "adapterConfig") ? { ...(replaceAdapterConfig ? {} : existing.adapterConfig), ...asRecord(patchData.adapterConfig) } : existing.adapterConfig; Object.assign(patchData, await resolveNewAgentRunnerForCompany(db, existing.companyId, { - adapterType: convertingPi ? "pi_local" : typeof patchData.adapterType === "string" ? patchData.adapterType : existing.adapterType, + adapterType: convertingPi || convertingGrok ? existing.adapterType : typeof patchData.adapterType === "string" ? patchData.adapterType : existing.adapterType, adapterConfig: config, runner: runner ?? "paperclip", setupOnly: existing.lifecycleHolds?.includes("setup"), onConfigurationWarnings: warnings => { configurationWarnings = warnings; }, defaultEnvironmentId: hasOwn(patchData, "defaultEnvironmentId") ? patchData.defaultEnvironmentId as string | null : existing.defaultEnvironmentId, diff --git a/server/src/services/agent-runner-qualification.ts b/server/src/services/agent-runner-qualification.ts index 8533ed19452..0abe93d01d8 100644 --- a/server/src/services/agent-runner-qualification.ts +++ b/server/src/services/agent-runner-qualification.ts @@ -11,7 +11,7 @@ export async function qualifyAgentRunner( expectedEnvironmentId: string, pluginWorkerManager?: PluginWorkerManager, ): Promise { - if (!["claude_local", "codex_local", "paperclip_runner"].includes(agent.adapterType)) { + if (!["claude_local", "codex_local", "grok_local", "paperclip_runner"].includes(agent.adapterType)) { throw unprocessable("This agent does not support computer qualification."); } const { environment } = await resolveAgentRunnerEnvironmentForCompany(db, agent.companyId, agent.defaultEnvironmentId); diff --git a/server/src/services/agent-runner-selection.test.ts b/server/src/services/agent-runner-selection.test.ts index 042c6084f45..697aa4be978 100644 --- a/server/src/services/agent-runner-selection.test.ts +++ b/server/src/services/agent-runner-selection.test.ts @@ -78,7 +78,7 @@ describe("server-owned Codex runner selection", () => { expect(resolveNewAgentRunner(resolved)).toEqual(resolved); expect(input.adapterConfig).toHaveProperty("search", false); }); - it.each(["grok_local", "cursor", "process", "external"])("keeps %s default unchanged", adapterType => { + it.each(["cursor", "process", "external"])("keeps %s default unchanged", adapterType => { expect(resolveNewAgentRunner({ adapterType, target, adapterConfig: { custom: "preserved" } })).toEqual({ adapterType, adapterConfig: { custom: "preserved" } }); }); it.each(qualifiedTargets.filter(target => !(target.platform === "linux" && target.architecture === "arm64")))("defaults Pi to native on $platform/$architecture and round trips exact thinking", target => { @@ -468,13 +468,60 @@ describe("server-owned Codex runner selection", () => { }); }); +describe("Grok runner migration", () => { + const target = { driver: "sandbox", platform: "linux", architecture: "x64", libc: "glibc" as const, glibcVersion: "2.39" }; + beforeEach(() => { state.disabled = []; state.overridden.clear(); }); + it("selects Grok's native profile and preserves the model and account", () => { + const aiConnection = { mode: "fixed", connectionId: "grok-account" }; + const adapterConfig = { model: "grok-4.7", reasoningEffort: "high", command: "grok", aiConnection, cwd: "/workspace" }; + expect(paperclipRunnerProfileForHarness("grok_local")).toEqual({ provider: "acpx", acpxAgent: "grok" }); + expect(resolveNewAgentRunner({ adapterType: "grok_local", runner: "paperclip", adapterConfig, target })) + .toEqual({ adapterType: "paperclip_runner", adapterConfig: { provider: "acpx", acpxAgent: "grok", model: "grok-4.7", reasoningEffort: "high", disableWebSearch: true, aiConnection, cwd: "/workspace", acpxPermissionMode: "approve-all", lifecycleMode: "per_turn" } }); + }); + it.each([undefined, "", "grok-build"])("resolves legacy default model %s before native admission", model => { + expect(resolveNewAgentRunner({ adapterType: "grok_local", runner: "paperclip", target, adapterConfig: { model } }).adapterConfig) + .toMatchObject({ model: "grok-4.7", disableWebSearch: true }); + }); + it.each([undefined, true, false])("preserves effective legacy web search policy %s", disableWebSearch => { + const result = resolveNewAgentRunner({ adapterType: "grok_local", runner: "paperclip", target, adapterConfig: { disableWebSearch } }); + expect(result.adapterConfig.disableWebSearch).toBe(disableWebSearch ?? true); + }); + it.each([ + { platform: "darwin", architecture: "x64" }, + { platform: "linux", architecture: "arm64" }, + { platform: "win32", architecture: "x64" }, + ])("keeps unqualified Grok $platform/$architecture on Legacy", platform => { + expect(agentRunnerAvailability("grok_local", { ...target, ...platform }).supportedRunners).toEqual(["legacy"]); + }); + it("retains High effort when switching back and rejects restricted native permission loss", () => { + const selected = resolveNewAgentRunner({ adapterType: "grok_local", runner: "paperclip", target, + adapterConfig: { model: "grok-4.7", reasoningEffort: "high" } }); + expect(resolveNewAgentRunner({ ...selected, runner: "legacy", target })).toEqual({ + adapterType: "grok_local", adapterConfig: { model: "grok-4.7", reasoningEffort: "high", disableWebSearch: true }, + }); + expect(() => resolveNewAgentRunner({ ...selected, runner: "legacy", target, + adapterConfig: { ...selected.adapterConfig, acpxPermissionMode: "deny-all" } })).toThrow("cannot honor"); + }); + it.each(["modelReasoningEffort", "effort"])("preserves native %s when switching to Legacy", key => { + const saved = { adapterType: "paperclip_runner", adapterConfig: { provider: "acpx", acpxAgent: "grok", model: "grok-4.7", [key]: "high" } }; + expect(resolveNewAgentRunner({ ...saved, runner: "legacy", target })).toEqual({ + adapterType: "grok_local", adapterConfig: { model: "grok-4.7", reasoningEffort: "high", disableWebSearch: false }, + }); + }); + it.each([{ command: "custom-grok" }, { extraArgs: ["--unsafe"] }, { permissionMode: "dontAsk" }, { alwaysApprove: false }, { maxTurns: 5 }])("rejects incompatible settings %j without mutating them", adapterConfig => { + const before = structuredClone(adapterConfig); + expect(() => resolveNewAgentRunner({ adapterType: "grok_local", runner: "paperclip", adapterConfig, target })).toThrow("cannot honor"); + expect(adapterConfig).toEqual(before); + }); +}); + describe("Codex creation runner contract", () => { it("graduates qualified harnesses and retains saved provider identity", () => { expect(paperclipRunnerProfileForHarness("codex_local")).toEqual({ provider: "codex" }); expect(paperclipRunnerProfileForHarness("claude_local")).toEqual({ provider: "acpx", acpxAgent: "claude" }); expect(paperclipRunnerProfileForHarness("opencode_local")).toEqual({ provider: "opencode" }); expect(paperclipRunnerProfileForHarness("pi_local")).toEqual({ provider: "acpx", acpxAgent: "pi" }); - for (const harness of ["grok_local", "cursor", "process"]) expect(paperclipRunnerProfileForHarness(harness)).toBeUndefined(); + for (const harness of ["cursor", "process"]) expect(paperclipRunnerProfileForHarness(harness)).toBeUndefined(); expect(agentHarnessType("paperclip_runner", { provider: "codex" })).toBe("codex_local"); expect(agentHarnessType("paperclip_runner", { provider: "acpx", acpxAgent: "claude" })).toBe("claude_local"); expect(agentHarnessType("paperclip_runner", { provider: "unknown" })).toBe("unknown"); diff --git a/server/src/services/agent-runner-selection.ts b/server/src/services/agent-runner-selection.ts index 77ecf01cfe7..a2c477ad803 100644 --- a/server/src/services/agent-runner-selection.ts +++ b/server/src/services/agent-runner-selection.ts @@ -1,7 +1,8 @@ import type { Db } from "@paperclipai/db"; -import { agentHarnessType, isEnvironmentDriverSupportedForAdapter, paperclipRunnerSupportsPlatform, type AgentRunnerChoice, type AgentRunnerAvailability } from "@paperclipai/shared"; +import { agentHarnessType, paperclipRunnerProfileForHarness, isEnvironmentDriverSupportedForAdapter, paperclipRunnerSupportsPlatform, type AgentRunnerChoice, type AgentRunnerAvailability } from "@paperclipai/shared"; import { normalizeLegacyRunnerProvider, PAPERCLIP_RUNNER_DEFAULT_MODELS } from "@paperclipai/adapter-utils"; import { resolveClaudeModel } from "@paperclipai/adapter-claude-local"; +import { DEFAULT_GROK_LOCAL_MODEL } from "@paperclipai/adapter-grok-local"; import { findActiveServerAdapter, hasActiveAdapterOverride, waitForExternalAdapters } from "../adapters/registry.js"; import { getDisabledAdapterTypes } from "./adapter-plugin-store.js"; import { claudeRunnerUnsupportedSettings, PaperclipRunnerProviderProfileError, resolvePaperclipRunnerNativeProviderInput } from "./native-runtime/provider-profile.js"; @@ -30,7 +31,7 @@ export interface AgentRunnerSelection { function runnerAdaptersAvailable(harness: string, driver: string): boolean { const disabled = new Set(getDisabledAdapterTypes()); - return ["codex_local", "claude_local", "opencode_local", "pi_local"].includes(harness) + return !!paperclipRunnerProfileForHarness(harness) && !disabled.has(harness) && !disabled.has("paperclip_runner") && !!findActiveServerAdapter(harness) && !!findActiveServerAdapter("paperclip_runner") && !hasActiveAdapterOverride(harness) && !hasActiveAdapterOverride("paperclip_runner") @@ -49,7 +50,7 @@ export function agentRunnerAvailability(harness: string, target: RunnerTarget = const supported = runnerAdaptersAvailable(harness, target.driver) && (target.driver !== "sandbox" || Boolean(target.platform && target.architecture && (target.platform !== "linux" || (target.libc === "glibc" && target.glibcVersion)))) - && (harness === "claude_local" + && (["claude_local", "grok_local"].includes(harness) ? !!target.platform && paperclipRunnerSupportsPlatform(harness, target.platform, target.architecture ?? "", target.libc, target.glibcVersion) : !target.platform || paperclipRunnerSupportsPlatform(harness, target.platform, target.architecture ?? "", target.libc, target.glibcVersion)); const automatic = supported && !(harness === "claude_local" && target.driver === "ssh" && target.platform === "darwin"); @@ -60,6 +61,23 @@ function incompatible(fields: string[]): never { throw unprocessable(`Paperclip Runner cannot honor these settings: ${fields.join(", ")}. Remove them or select Legacy runner in Advanced.`, { code: "agent_runner_config_incompatible", fields }); } +function resolveGrokRunnerConfig(config: Record): Record { + const unsupported = ["extraArgs", "args", "permissionMode", "maxTurns"] + .filter(key => config[key] !== undefined && config[key] !== "" && config[key] !== 0 && !(Array.isArray(config[key]) && config[key].length === 0)); + if (config.command && config.command !== "grok") unsupported.push("command"); + if (config.alwaysApprove !== undefined && config.alwaysApprove !== true) unsupported.push("alwaysApprove"); + if (config.disableWebSearch !== undefined && typeof config.disableWebSearch !== "boolean") unsupported.push("disableWebSearch"); + if (config.model !== undefined && typeof config.model !== "string") unsupported.push("model"); + if (unsupported.length) incompatible(unsupported); + const translated = { ...config }; + const effort = config.reasoningEffort ?? config.modelReasoningEffort ?? config.effort; + for (const key of ["command", "extraArgs", "args", "alwaysApprove", "maxTurns", "permissionMode", "reasoningEffort", "modelReasoningEffort", "effort"]) delete translated[key]; + return { ...translated, provider: "acpx", acpxAgent: "grok", disableWebSearch: config.disableWebSearch ?? true, + model: typeof config.model === "string" && config.model.trim() && config.model.trim() !== DEFAULT_GROK_LOCAL_MODEL ? config.model.trim() : "grok-4.7", + ...(effort === undefined || effort === "" ? {} : { reasoningEffort: effort }), + acpxPermissionMode: config.acpxPermissionMode ?? "approve-all", lifecycleMode: config.lifecycleMode ?? "per_turn" }; +} + function resolvePiRunnerConfig(config: Record): Record { const unsupported = ["extraArgs", "args", "modelReasoningEffort", "reasoningEffort", "effort"] .filter(key => config[key] !== undefined && config[key] !== "" && !(Array.isArray(config[key]) && config[key].length === 0)); @@ -150,12 +168,20 @@ function resolveAgentRunner(input: AgentRunnerSelection): { adapterType: string; let config = { ...input.adapterConfig }; const harness = agentHarnessType(adapterType, config); const native = adapterType === "paperclip_runner"; - if (["codex_local", "claude_local", "opencode_local", "pi_local"].includes(adapterType) && getDisabledAdapterTypes().includes(adapterType)) throw unprocessable(`${adapterType === "pi_local" ? "Pi" : adapterType === "opencode_local" ? "OpenCode" : adapterType === "claude_local" ? "Claude" : "Codex"} is disabled on this instance. Enable its adapter or choose another harness.`, { code: "agent_runner_unavailable" }); + if (paperclipRunnerProfileForHarness(adapterType) && getDisabledAdapterTypes().includes(adapterType)) throw unprocessable(`${adapterType === "grok_local" ? "Grok Build" : adapterType === "pi_local" ? "Pi" : adapterType === "opencode_local" ? "OpenCode" : adapterType === "claude_local" ? "Claude" : "Codex"} is disabled on this instance. Enable its adapter or choose another harness.`, { code: "agent_runner_unavailable" }); if (native && (input.runner === undefined || input.runner === "paperclip" || (harness !== "codex_local" && input.runner !== "legacy"))) return { adapterType, adapterConfig: normalizeLegacyRunnerProvider(config) }; const availability = agentRunnerAvailability(harness, input.target); const choice = input.runner ?? "auto"; const useNative = choice === "paperclip" || (choice === "auto" && availability.defaultRunner === "paperclip"); if (!useNative) { + if (harness === "grok_local") { + if (!native) return { adapterType, adapterConfig: config }; + if (config.acpxPermissionMode !== undefined && config.acpxPermissionMode !== "approve-all") incompatible(["acpxPermissionMode"]); + if (config.lifecycleMode !== undefined && config.lifecycleMode !== "per_turn") incompatible(["lifecycleMode"]); + const effort = config.modelReasoningEffort ?? config.reasoningEffort ?? config.effort; + for (const key of ["provider", "acpxAgent", "acpxPermissionMode", "lifecycleMode", "idleTimeoutMs", "modelReasoningEffort", "effort"]) delete config[key]; + return { adapterType: "grok_local", adapterConfig: { ...config, disableWebSearch: config.disableWebSearch ?? false, ...(effort === undefined ? {} : { reasoningEffort: effort }) } }; + } if (harness === "pi_local") { if (!native) return { adapterType, adapterConfig: config }; const thinking = config.thinking ?? config.piThinkingLevel ?? "low"; @@ -198,6 +224,15 @@ function resolveAgentRunner(input: AgentRunnerSelection): { adapterType: string; ? "Paperclip Runner is unavailable for this sandbox. Choose an immutable OCI image digest and run its environment connection probe to qualify the OS, architecture and libc, or select Legacy runner in Advanced." : "Paperclip Runner is unavailable for this harness and environment. Select Legacy runner in Advanced.", { code: "agent_runner_unavailable" }); if (native) return { adapterType, adapterConfig: normalizeLegacyRunnerProvider(config) }; + if (harness === "grok_local") { + config = resolveGrokRunnerConfig(config); + try { resolvePaperclipRunnerNativeProviderInput({ backend: "acpx_runtime", adapterConfig: config }); } + catch (error) { + if (error instanceof PaperclipRunnerProviderProfileError) throw unprocessable(error.message, { code: error.code }); + throw error; + } + return { adapterType: "paperclip_runner", adapterConfig: config }; + } if (harness === "pi_local") { config = resolvePiRunnerConfig(config); if (input.setupOnly && !config.model) return { adapterType: "paperclip_runner", adapterConfig: config }; @@ -283,7 +318,7 @@ function resolveAgentRunner(input: AgentRunnerSelection): { adapterType: string; } export async function resolveNewAgentRunnerForCompany(db: Db, companyId: string, input: AgentRunnerSelection & { defaultEnvironmentId?: string | null }) { - if (!["codex_local", "claude_local", "opencode_local", "pi_local"].includes(agentHarnessType(input.adapterType ?? "process", input.adapterConfig)) + if (!paperclipRunnerProfileForHarness(agentHarnessType(input.adapterType ?? "process", input.adapterConfig)) || input.runner === "legacy" || (input.adapterType === "paperclip_runner" && (input.runner === undefined || input.runner === "paperclip"))) return resolveNewAgentRunner(input); const target = await resolveAgentRunnerTargetForCompany(db, companyId, input.defaultEnvironmentId); return resolveNewAgentRunner({ ...input, target }); @@ -303,7 +338,7 @@ export async function resolveAgentRunnerTargetForCompany(db: Db, companyId: stri const qualified = await readSandboxPlatformQualification(db, environment, companyId); if (qualified) target = { driver, ...qualified }; } - if (driver === "ssh" && environment && ["codex_local", "claude_local", "opencode_local", "pi_local"].some(harness => runnerAdaptersAvailable(harness, driver))) { + if (driver === "ssh" && environment && ["codex_local", "claude_local", "opencode_local", "pi_local", "grok_local"].some(harness => runnerAdaptersAvailable(harness, driver))) { const parsed = await resolveEnvironmentDriverConfigForRuntime(db, companyId, environment); if (parsed.driver !== "ssh") throw unprocessable("The selected SSH environment is unavailable."); let output: string; diff --git a/server/src/services/built-in-agents.ts b/server/src/services/built-in-agents.ts index bdadbe6c1c5..c248c555580 100644 --- a/server/src/services/built-in-agents.ts +++ b/server/src/services/built-in-agents.ts @@ -8,7 +8,7 @@ import { readPaperclipSkillSyncPreference, writePaperclipSkillSyncPreference } f import { and, desc, eq, ne } from "drizzle-orm"; import type { Db } from "@paperclipai/db"; import { activityLog, agents, builtInManagedResources, companies, issueThreadInteractions, issues, routines, routineTriggers } from "@paperclipai/db"; -import { agentHarnessType, agentRunner, syncRoutineVariablesWithTemplate, type AgentRunnerChoice } from "@paperclipai/shared"; +import { agentHarnessType, paperclipRunnerProfileForHarness, agentRunner, syncRoutineVariablesWithTemplate, type AgentRunnerChoice } from "@paperclipai/shared"; import type { Agent, Approval, CompanySkill, PermissionKey, Routine, RoutineTrigger, RoutineVariable } from "@paperclipai/shared"; import { conflict, HttpError, notFound, unprocessable } from "../errors.js"; import { logActivity } from "./activity-log.js"; @@ -1762,7 +1762,7 @@ export function builtInAgentService(db: Db) { const adapterConfig = resolvedInput.adapterConfig ?? existing.adapterConfig; assertAdapterAllowed(definition, adapterType, adapterConfig); const selectedHarness = agentHarnessType(adapterType, adapterConfig); - const sameQualifiedHarness = ["codex_local", "claude_local", "opencode_local", "pi_local"].includes(selectedHarness) + const sameQualifiedHarness = Boolean(paperclipRunnerProfileForHarness(selectedHarness)) && agentHarnessType(existing.adapterType, existing.adapterConfig) === selectedHarness; const runner = resolvedInput.runner ?? (sameQualifiedHarness && existing.metadata?.paperclipBuiltInSetupRequired !== true ? agentRunner(existing.adapterType) : undefined); diff --git a/server/src/services/company-portability.ts b/server/src/services/company-portability.ts index e6868da3827..dc7dca311d6 100644 --- a/server/src/services/company-portability.ts +++ b/server/src/services/company-portability.ts @@ -1,5 +1,5 @@ import { createAgentLifecycle } from "./agent-lifecycle.js"; -import { agentAppearanceSchema, agentHarnessType, agentRunner, type AgentRunnerChoice } from "@paperclipai/shared"; +import { agentAppearanceSchema, agentHarnessType, paperclipRunnerProfileForHarness, agentRunner, type AgentRunnerChoice } from "@paperclipai/shared"; import { resolveNewAgentRunnerForCompany } from "./agent-runner-selection.js"; import { createHash, randomUUID } from "node:crypto"; import { promises as fs } from "node:fs"; @@ -5307,7 +5307,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) { "OpenAI Dot is experimental and disabled on this instance.", { code: "paperclip_runner_dot_disabled" }, ); - } else if (config.provider !== "codex" && config.provider !== "opencode" && config.provider !== undefined && !["claude_local", "pi_local"].includes(agentHarnessType("paperclip_runner", config)) && experimental.enableNativeRunner !== true) { + } else if (config.provider !== "codex" && config.provider !== "opencode" && config.provider !== undefined && !["claude_local", "pi_local", "grok_local"].includes(agentHarnessType("paperclip_runner", config)) && experimental.enableNativeRunner !== true) { throw unprocessable( "Paperclip Runner is experimental and disabled on this instance.", { code: "paperclip_runner_rollout_disabled" }, @@ -5651,7 +5651,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) { runner = agentRunner(existingImportAgent.adapterType); } } - const retainedNative = runner === "paperclip" && ["codex_local", "claude_local", "opencode_local", "pi_local"].includes(selectedHarness) + const retainedNative = runner === "paperclip" && Boolean(paperclipRunnerProfileForHarness(selectedHarness)) ? [manifestAgent, existingImportAgent].find((agent) => agent?.adapterType === "paperclip_runner" && agentHarnessType(agent.adapterType, agent.adapterConfig) === selectedHarness) : undefined; diff --git a/server/src/services/heartbeat-runner-provider-config.test.ts b/server/src/services/heartbeat-runner-provider-config.test.ts index 8090eb3cc04..b209a0ff706 100644 --- a/server/src/services/heartbeat-runner-provider-config.test.ts +++ b/server/src/services/heartbeat-runner-provider-config.test.ts @@ -153,6 +153,21 @@ describe("Paperclip Runner native provider configuration", () => { expect(() => resolvePaperclipRunnerNativeProviderInput({ backend: "acpx_runtime", adapterConfig: { ...base, networkScope: "unrestricted" } })).toThrow("Legacy runner"); }); + it("projects Grok task model and effort while retaining the search policy and account", () => { + const base = { provider: "acpx", acpxAgent: "grok", model: "grok-4.7", reasoningEffort: "high", disableWebSearch: true, aiConnection: "saved" }; + const projected = projectPaperclipRunnerTaskConfig("acpx_runtime", base, { model: "grok-next", effort: "medium", provider: "codex", disableWebSearch: false, aiConnection: "other" }); + expect(projected).toEqual({ ...base, model: "grok-next", reasoningEffort: "medium" }); + expect(resolvePaperclipRunnerNativeProviderInput({ backend: "acpx_runtime", adapterConfig: projected })) + .toMatchObject({ acpxAgent: "grok", model: "grok-next", grokEffort: "medium", grokDisableWebSearch: true }); + }); + + it("resolves the Grok task default marker before native model admission", () => { + const base = { provider: "acpx", acpxAgent: "grok", model: "grok-4.7", reasoningEffort: "high", disableWebSearch: true }; + const config = projectPaperclipRunnerTaskConfig("acpx_runtime", base, { model: "grok-build", reasoningEffort: "high" }); + expect(resolvePaperclipRunnerNativeProviderInput({ backend: "acpx_runtime", adapterConfig: config })) + .toMatchObject({ model: "grok-4.7", grokEffort: "high", grokDisableWebSearch: true }); + }); + it("uses an OpenCode task model without changing the Runner provider", () => { const projected = projectPaperclipRunnerTaskConfig( "opencode_server", diff --git a/server/src/services/heartbeat/runtime-selection.ts b/server/src/services/heartbeat/runtime-selection.ts index 032f3875580..72e3ec01264 100644 --- a/server/src/services/heartbeat/runtime-selection.ts +++ b/server/src/services/heartbeat/runtime-selection.ts @@ -717,7 +717,7 @@ export async function selectHeartbeatRuntime(db: Db, input: HeartbeatRuntimeSele }); getNativeFreshSessionHandoff = nativeReviewRequest ? undefined : getFreshSessionHandoff; const nativeProviderConfig = nativeRuntimeResolution.profile.backend === "codex_app_server" - || (nativeRuntimeResolution.profile.backend === "acpx_runtime" && agentHarnessType(agent.adapterType, parseObject(agent.adapterConfig)) === "claude_local") + || (nativeRuntimeResolution.profile.backend === "acpx_runtime" && ["claude_local", "grok_local"].includes(agentHarnessType(agent.adapterType, parseObject(agent.adapterConfig)))) || nativeRuntimeResolution.profile.backend === "opencode_server" || (nativeRuntimeResolution.profile.backend === "acpx_runtime" && parseObject(agent.adapterConfig).acpxAgent === "copilot") diff --git a/server/src/services/native-runtime/native-execution-input.test.ts b/server/src/services/native-runtime/native-execution-input.test.ts index f10000ce8c7..588b8fbe663 100644 --- a/server/src/services/native-runtime/native-execution-input.test.ts +++ b/server/src/services/native-runtime/native-execution-input.test.ts @@ -688,4 +688,24 @@ describe("Claude effort and master home-mode compatibility", () => { if (claudeEffort) expect(value.provider).toHaveProperty("claudeEffort", claudeEffort); expect(JSON.stringify(buildNativeModelEnvelope(value))).not.toContain("claudeEffort"); }); + it.each([ + ["isolated", undefined, undefined, "v5"], ["isolated", "high", true, "v10"], ["isolated", undefined, false, "v10"], + ] as const)("retains %s home mode with effort %s and search policy %s in %s", (homeMode, grokEffort, grokDisableWebSearch, version) => { + const value = buildNativeExecutionInput({ + companyId: "company", runId: "run", agentId: "agent", + issue: { id: "issue", identifier: "CLA-1", title: "Useful output", description: null, workMode: "standard" }, + taskPrompt: "Create the requested file.", + workspace: { id: "workspace", cwd: "/workspace", repoUrl: null, repoRef: null, branchName: null }, + normalizedSessionId: null, provider: "acpx", acpxAgent: "grok", model: "grok-4.7", + acpxPermissionMode: "approve-all", homeMode, grokEffort, grokDisableWebSearch, + completionContract: { id: "contract", sha256: `sha256:${"a".repeat(64)}`, schemaVersion: "paperclip.run-result.v1", + contract: { revision: "1", objective: "Create a file", criteria: [{ id: "output", requirement: "Create the file" }] } }, + runtimeContext: nativeRuntimeContextFixture(), + }); + expect(value.schema).toBe(`paperclip.native-execution-input.${version}`); + if (version !== "v5") expect(value).toHaveProperty("homeMode", homeMode); + if (grokEffort) expect(value.provider).toHaveProperty("grokEffort", grokEffort); + if (grokDisableWebSearch !== undefined) expect(value.provider).toHaveProperty("grokDisableWebSearch", grokDisableWebSearch); + expect(JSON.stringify(buildNativeModelEnvelope(value))).not.toContain("grokEffort"); + }); }); diff --git a/server/src/services/native-runtime/native-execution-input.ts b/server/src/services/native-runtime/native-execution-input.ts index 974ea876de6..3457b5a6cf6 100644 --- a/server/src/services/native-runtime/native-execution-input.ts +++ b/server/src/services/native-runtime/native-execution-input.ts @@ -18,6 +18,7 @@ import type { NativeExecutionInputV6, NativeExecutionInputV8, NativeExecutionInputV9, + NativeExecutionInputV10, MuseBindingSnapshot, DotBindingSnapshot, NativeExecutionInputV7, @@ -108,6 +109,8 @@ export interface BuildNativeExecutionInput { acpxSessionMode?: "agent" | "plan" | "ask"; piThinkingLevel?: "off" | "low" | "high" | "max"; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; model?: string | null; managedProfile?: Extract< NativeExecutionInputV5["provider"], @@ -138,9 +141,9 @@ export interface BuildNativeExecutionInput { } export function buildNativeExecutionInput(input: BuildNativeExecutionInput & { provider: "muse"; museBinding: MuseBindingSnapshot }): NativeExecutionInputV8; export function buildNativeExecutionInput(input: BuildNativeExecutionInput & { provider: "openai_dot" | "grok_bot"; dotBinding: DotBindingSnapshot }): NativeExecutionInputV6; -export function buildNativeExecutionInput(input: BuildNativeExecutionInput & { provider?: Exclude }): NativeExecutionInputV5 | NativeExecutionInputV7 | NativeExecutionInputV9; -export function buildNativeExecutionInput(input: BuildNativeExecutionInput): NativeExecutionInputV5 | NativeExecutionInputV6 | NativeExecutionInputV7 | NativeExecutionInputV8 | NativeExecutionInputV9; -export function buildNativeExecutionInput(input: BuildNativeExecutionInput): NativeExecutionInputV5 | NativeExecutionInputV6 | NativeExecutionInputV7 | NativeExecutionInputV8 | NativeExecutionInputV9 { +export function buildNativeExecutionInput(input: BuildNativeExecutionInput & { provider?: Exclude }): NativeExecutionInputV5 | NativeExecutionInputV7 | NativeExecutionInputV9 | NativeExecutionInputV10; +export function buildNativeExecutionInput(input: BuildNativeExecutionInput): NativeExecutionInputV5 | NativeExecutionInputV6 | NativeExecutionInputV7 | NativeExecutionInputV8 | NativeExecutionInputV9 | NativeExecutionInputV10; +export function buildNativeExecutionInput(input: BuildNativeExecutionInput): NativeExecutionInputV5 | NativeExecutionInputV6 | NativeExecutionInputV7 | NativeExecutionInputV8 | NativeExecutionInputV9 | NativeExecutionInputV10 { if (input.issue.workMode !== "standard" && input.issue.workMode !== "planning" && input.issue.workMode !== "ask") { throw new Error("native_execution_input_invalid: issue work mode must be standard, planning, or ask"); } @@ -254,9 +257,10 @@ export function buildNativeExecutionInput(input: BuildNativeExecutionInput): Nat const workflowCase = input.caseContext && previousCaseProjection ? projectCaseContinuation(input.caseContext, previousCaseProjection) : null; const prepared = { - schema: input.claudeEffort !== undefined ? "paperclip.native-execution-input.v9" + schema: input.grokEffort !== undefined || input.grokDisableWebSearch !== undefined ? "paperclip.native-execution-input.v10" + : input.claudeEffort !== undefined ? "paperclip.native-execution-input.v9" : input.homeMode === "preconfigured" ? "paperclip.native-execution-input.v7" : "paperclip.native-execution-input.v5", - ...(input.claudeEffort !== undefined || input.homeMode === "preconfigured" ? { homeMode: input.homeMode ?? "isolated" } : {}), + ...(input.grokEffort !== undefined || input.grokDisableWebSearch !== undefined || input.claudeEffort !== undefined || input.homeMode === "preconfigured" ? { homeMode: input.homeMode ?? "isolated" } : {}), ...((input.initialCommunicationGuidance || input.freshSessionHandoff) ? { initialCommunicationGuidance: [input.initialCommunicationGuidance, input.freshSessionHandoff].filter(Boolean).join("\n\n"), } : {}), @@ -341,6 +345,8 @@ export function buildNativeExecutionInput(input: BuildNativeExecutionInput): Nat ...(mode === undefined ? {} : { mode }), ...(piThinkingLevel === undefined ? {} : { piThinkingLevel }), ...(input.claudeEffort === undefined ? {} : { claudeEffort: input.claudeEffort }), + ...(input.grokEffort === undefined ? {} : { grokEffort: input.grokEffort }), + ...(input.grokDisableWebSearch === undefined ? {} : { grokDisableWebSearch: input.grokDisableWebSearch }), profile: { driverKind: acpxProfile!.driverKind, protocolVersion: acpxProfile!.protocolVersion, @@ -390,7 +396,7 @@ export function buildNativeExecutionInput(input: BuildNativeExecutionInput): Nat schema: "paperclip.native-execution-input.v6", provider: { kind: input.provider, model: null, binding: input.dotBinding }, workspace: { access: "none", cwd: null, repoUrl: null, repoRef: null, branchName: null }, session: { ...prepared.session, driverKind: input.provider === "grok_bot" ? "grok_bot_mcp" : "openai_dot_mcp", lifecyclePolicy: { mode: "per_turn", idleTimeoutMs: null } } - } : prepared) as NativeExecutionInputV5 | NativeExecutionInputV6 | NativeExecutionInputV7 | NativeExecutionInputV8 | NativeExecutionInputV9; + } : prepared) as NativeExecutionInputV5 | NativeExecutionInputV6 | NativeExecutionInputV7 | NativeExecutionInputV8 | NativeExecutionInputV9 | NativeExecutionInputV10; } diff --git a/server/src/services/native-runtime/native-session-executor.test.ts b/server/src/services/native-runtime/native-session-executor.test.ts index 3ebaa15f773..d78b215d16c 100644 --- a/server/src/services/native-runtime/native-session-executor.test.ts +++ b/server/src/services/native-runtime/native-session-executor.test.ts @@ -11426,6 +11426,36 @@ describe("runnerd provider runtime wiring", () => { }); }); + it.each(["isolated", "preconfigured"].flatMap(homeMode => + [true, false].map(disableWebSearch => ({ homeMode, disableWebSearch })), + ))("pins Grok v10 permissions, effort and search policy at daemon startup: $homeMode $disableWebSearch", async ({ homeMode, disableWebSearch }) => { + const current = { ...execution, schema: "paperclip.native-execution-input.v10", homeMode, + provider: { kind: "acpx", agent: "grok", model: "grok-4.7", permissionMode: "approve-all", + grokEffort: "high", grokDisableWebSearch: disableWebSearch }, + session: { ...execution.session, driverKind: "acpx_runtime" }, + } as unknown as NativeExecutionInput; + const startup = { db: leaseDb(current), execution: current, + runnerInstanceId: `grok-v10-pinned-${homeMode}-${disableWebSearch}`, + managedAiCredentialHome: join(isolatedStateDirectory, "absent-grok-login") }; + await createRunnerdBackend({ ...startup, runnerEnvironment: { XAI_API_KEY: "synthetic-grok-api-key" } }); + state.createBackend.mock.calls.at(-1)![1].codexTransportFactory!(); + expect(state.createTransport.mock.calls.at(-1)![0]).toMatchObject({ + provider: "acpx", acpxAgent: "grok", acpxPermissionMode: "approve-all", + acpxPermissionModePinned: true, grokEffort: "high", grokDisableWebSearch: disableWebSearch, homeMode, + }); + }); + + it("requires explicit Grok credentials before v10 daemon startup", async () => { + const current = { ...execution, schema: "paperclip.native-execution-input.v10", homeMode: "isolated", + provider: { kind: "acpx", agent: "grok", model: "grok-4.7", permissionMode: "approve-all", grokEffort: "high" }, + session: { ...execution.session, driverKind: "acpx_runtime" }, + } as unknown as NativeExecutionInput; + await expect(createRunnerdBackend({ db: leaseDb(current), execution: current, + runnerInstanceId: "grok-v10-missing-credential", runnerEnvironment: {}, + managedAiCredentialHome: join(isolatedStateDirectory, "absent-grok-login"), + })).rejects.toThrow("Grok subscription login is unavailable"); + }); + it("copies back and removes Grok credentials from the exact ACPX launch home", async () => { const priorHome = process.env.PAPERCLIP_HOME; const privateRoot = await realpath(isolatedStateDirectory); diff --git a/server/src/services/native-runtime/native-session-executor.ts b/server/src/services/native-runtime/native-session-executor.ts index cea0ac147cb..b1cb4ccdade 100644 --- a/server/src/services/native-runtime/native-session-executor.ts +++ b/server/src/services/native-runtime/native-session-executor.ts @@ -5871,6 +5871,8 @@ export function providerSessionIdentityFromDurableProviderState(input: { !acpxRecoveryModeMatches(input.execution.provider, descriptor.mode, identity.mode) || !acpxRecoveryPiThinkingMatches(input.execution.provider, descriptor.piThinkingLevel, identity.piThinkingLevel) || !acpxRecoveryClaudeEffortMatches(input.execution.provider, descriptor.claudeEffort, identity.claudeEffort) || + !acpxRecoveryGrokEffortMatches(input.execution.provider, descriptor.grokEffort, identity.grokEffort) || + !acpxRecoveryGrokWebSearchMatches(input.execution.provider, descriptor.grokDisableWebSearch, identity.grokDisableWebSearch) || !["approve-all", "approve-paperclip", "approve-reads", "deny-all"].includes( String(identity.permissionMode), ) || @@ -5985,6 +5987,19 @@ function acpxRecoveryClaudeEffortMatches(provider: unknown, projected: unknown, return expected === projected && expected === observed && (expected === undefined || ["low", "medium", "high", "xhigh", "max"].includes(String(expected))); } +function acpxRecoveryGrokEffortMatches(provider: unknown, projected: unknown, observed: unknown): boolean { + const config = record(provider); + const expected = config.grokEffort; + if (config.kind !== "acpx" || config.agent !== "grok") return expected === undefined && projected === undefined && observed === undefined; + return expected === projected && expected === observed && (expected === undefined || ["minimal", "low", "medium", "high", "xhigh"].includes(String(expected))); +} + +function acpxRecoveryGrokWebSearchMatches(provider: unknown, ...observed: unknown[]): boolean { + const config = record(provider), expected = config.grokDisableWebSearch; + return (expected === undefined || (config.kind === "acpx" && config.agent === "grok" && typeof expected === "boolean")) + && observed.every(value => value === expected); +} + function acpxRecoveryPiThinkingMatches(provider: NativeExecutionInput["provider"], ...observed: unknown[]): boolean { const expected = record(provider).piThinkingLevel; if (provider.kind === "acpx" && provider.agent === "pi") return ["off", "low", "high", "max"].includes(String(expected)) && observed.every(value => value === expected); @@ -6003,6 +6018,8 @@ export function providerSessionIdentityTransitionIsAllowed(input: { )) return false; if (!acpxRecoveryPiThinkingMatches(input.execution.provider, record(record(input.previous).providerSessionIdentity).piThinkingLevel, record(record(input.current).providerSessionIdentity).piThinkingLevel)) return false; if (!acpxRecoveryClaudeEffortMatches(input.execution.provider, record(record(input.previous).providerSessionIdentity).claudeEffort, record(record(input.current).providerSessionIdentity).claudeEffort)) return false; + if (!acpxRecoveryGrokEffortMatches(input.execution.provider, record(record(input.previous).providerSessionIdentity).grokEffort, record(record(input.current).providerSessionIdentity).grokEffort)) return false; + if (!acpxRecoveryGrokWebSearchMatches(input.execution.provider, record(record(input.previous).providerSessionIdentity).grokDisableWebSearch, record(record(input.current).providerSessionIdentity).grokDisableWebSearch)) return false; if (canonicalJson(input.previous) === canonicalJson(input.current)) { return true; } @@ -12124,6 +12141,8 @@ async function createRunnerdBackendWithinSessionClaim( acpxCandidateProfile: provider.agent === "pi" ? undefined : resolveAcpxQualification(provider, process.env), acpxPermissionMode: provider.permissionMode, acpxMode: provider.mode, piThinkingLevel: provider.piThinkingLevel, claudeEffort: "claudeEffort" in provider ? provider.claudeEffort : undefined, + grokEffort: "grokEffort" in provider ? provider.grokEffort : undefined, + grokDisableWebSearch: "grokDisableWebSearch" in provider ? provider.grokDisableWebSearch : undefined, acpxPermissionModePinned: true } : {}), ...(provider.kind === "opencode" ? { opencodePermissionMode: provider.permissionMode } : {}), runnerReconnectGraceMs: 120_000, runnerProcessReconnectGraceMs: null, @@ -13583,11 +13602,13 @@ async function createRunnerdBackendWithinSessionClaim( acpxMode: input.execution.provider.mode, piThinkingLevel: input.execution.provider.piThinkingLevel, claudeEffort: "claudeEffort" in input.execution.provider ? input.execution.provider.claudeEffort : undefined, + grokEffort: "grokEffort" in input.execution.provider ? input.execution.provider.grokEffort : undefined, + grokDisableWebSearch: "grokDisableWebSearch" in input.execution.provider ? input.execution.provider.grokDisableWebSearch : undefined, acpxPermissionModePinned: input.execution.schema === "paperclip.native-execution-input.v4" || input.execution.schema === "paperclip.native-execution-input.v5" || input.execution.schema === "paperclip.native-execution-input.v7" || - input.execution.schema === "paperclip.native-execution-input.v9", + input.execution.schema === "paperclip.native-execution-input.v9" || input.execution.schema === "paperclip.native-execution-input.v10", acpxRuntimeDirectory: remoteRunnerFilesystemRoot ? posix.join(remoteRunnerFilesystemRoot, "acpx") : resolve( diff --git a/server/src/services/native-runtime/plugin-runner-probe.ts b/server/src/services/native-runtime/plugin-runner-probe.ts index 62c3772d272..3b3a83e79e3 100644 --- a/server/src/services/native-runtime/plugin-runner-probe.ts +++ b/server/src/services/native-runtime/plugin-runner-probe.ts @@ -1,3 +1,4 @@ +import { resolveGrokDisableWebSearch } from "../../vendor/paperclip-runner/index.js"; import { randomUUID } from "node:crypto"; import { mkdtempSync, realpathSync, rmSync } from "node:fs"; import { tmpdir } from "node:os"; @@ -5,7 +6,7 @@ import { join } from "node:path"; import type { AdapterEnvironmentTestContext, AdapterEnvironmentTestResult } from "@paperclipai/adapter-utils"; import { resolvePaperclipRunnerPiThinkingLevel } from "@paperclipai/adapter-utils"; import { environmentTaskResultSchema } from "@paperclipai/plugin-sdk"; -import { probeNativeRunnerEnvironment, resolveClaudeEffort } from "../../vendor/paperclip-runner/index.js"; +import { probeNativeRunnerEnvironment, resolveClaudeEffort, resolveGrokEffort } from "../../vendor/paperclip-runner/index.js"; import { preparePluginRunnerCredentials } from "./plugin-runner-credentials.js"; import { createPluginRunnerTaskOwner } from "./plugin-runner-task.js"; import { resolvePaperclipRunnerProviderProfile } from "./provider-profile.js"; @@ -58,6 +59,7 @@ export async function probePluginRunnerEnvironment(context: AdapterEnvironmentTe ...(profile.provider === "acpx" ? { acpxAgent: profile.acpxAgent, acpxPermissionMode: "deny-all", acpxPermissionModePinned: true, ...(profile.acpxAgent === "pi" ? { piThinkingLevel: resolvePaperclipRunnerPiThinkingLevel("acpx", "pi", context.config.piThinkingLevel) } : {}), ...(profile.acpxAgent === "claude" ? { claudeEffort: resolveClaudeEffort("claude", context.config.modelReasoningEffort ?? context.config.reasoningEffort ?? context.config.effort) } : {}), + ...(profile.acpxAgent === "grok" ? { grokEffort: resolveGrokEffort("grok", context.config.modelReasoningEffort ?? context.config.reasoningEffort ?? context.config.effort), grokDisableWebSearch: resolveGrokDisableWebSearch("grok", context.config.disableWebSearch) } : {}), acpxCandidateProfile: profile.acpxAgent === "pi" ? undefined : resolveAcpxQualification({ kind: "acpx", agent: profile.acpxAgent, model: profile.model }, process.env) } : {}), prpIdentity: { runnerInstanceId: runnerId, environmentLeaseId: target.leaseId, runId: binding.runId, normalizedSessionId: binding.sessionId, turnId: `turn-${binding.runId}`, itemId: `item-${binding.runId}` }, diff --git a/server/src/services/native-runtime/provider-profile.ts b/server/src/services/native-runtime/provider-profile.ts index d217c3a05ca..046c737e5bd 100644 --- a/server/src/services/native-runtime/provider-profile.ts +++ b/server/src/services/native-runtime/provider-profile.ts @@ -1,5 +1,6 @@ +import { resolveGrokDisableWebSearch } from "../../vendor/paperclip-runner/index.js"; import { agentHarnessType, normalizeClaudeRunnerOptions } from "@paperclipai/shared"; -import { resolveClaudeEffort, resolveQualifiedAcpxProfile } from "../../vendor/paperclip-runner/index.js"; +import { resolveClaudeEffort, resolveGrokEffort, resolveQualifiedAcpxProfile } from "../../vendor/paperclip-runner/index.js"; import { isPaperclipRunnerProvider, PAPERCLIP_RUNNER_PERMISSION_CAPABILITIES, @@ -140,6 +141,8 @@ export type PaperclipRunnerNativeProviderInput = acpxSessionMode?: "agent" | "plan" | "ask"; piThinkingLevel?: "off" | "low" | "high" | "max"; claudeEffort?: "low" | "medium" | "high" | "xhigh" | "max"; + grokEffort?: "minimal" | "low" | "medium" | "high" | "xhigh"; + grokDisableWebSearch?: boolean; }; export class PaperclipRunnerProviderProfileError extends Error { @@ -210,7 +213,8 @@ export function projectPaperclipRunnerTaskConfig( // The server resolves a connection's model namespace after task overrides. // Carry that model into durable input without allowing routing to change the harness. const model = optionalString(managedModel) ?? optionalString(task.model); - const supportsEffort = backend === "codex_app_server" || (backend === "acpx_runtime" && agentHarnessType("paperclip_runner", base) === "claude_local"); + const grok = backend === "acpx_runtime" && agentHarnessType("paperclip_runner", base) === "grok_local"; + const supportsEffort = backend === "codex_app_server" || grok || (backend === "acpx_runtime" && agentHarnessType("paperclip_runner", base) === "claude_local"); const effortKey = supportsEffort ? ["modelReasoningEffort", "reasoningEffort", "effort"].find((key) => key in task) : undefined; @@ -220,7 +224,7 @@ export function projectPaperclipRunnerTaskConfig( delete config.effort; } if (model !== null) config.model = model; - if (effortKey !== undefined) config.modelReasoningEffort = task[effortKey]; + if (effortKey !== undefined) config[grok ? "reasoningEffort" : "modelReasoningEffort"] = task[effortKey]; return config; } @@ -445,6 +449,12 @@ export function resolvePaperclipRunnerProviderProfile( try { if (candidate === "acpx" && agentHarnessType("paperclip_runner", config) === "claude_local") resolveClaudeEffort("claude", config.modelReasoningEffort ?? config.reasoningEffort ?? config.effort); } catch (error) { throw new PaperclipRunnerProviderProfileError("paperclip_runner_claude_effort_invalid", error instanceof Error ? error.message : "Invalid Claude effort"); } + try { if (candidate === "acpx" && config.acpxAgent === "grok") resolveGrokEffort("grok", config.modelReasoningEffort ?? config.reasoningEffort ?? config.effort); } catch (error) { + throw new PaperclipRunnerProviderProfileError("paperclip_runner_grok_effort_invalid", error instanceof Error ? error.message : "Invalid Grok effort"); + } + try { if (candidate === "acpx" && config.acpxAgent === "grok") resolveGrokDisableWebSearch("grok", config.disableWebSearch); } catch (error) { + throw new PaperclipRunnerProviderProfileError("paperclip_runner_grok_search_invalid", error instanceof Error ? error.message : "Invalid Grok search policy"); + } try { resolvePaperclipRunnerPiThinkingLevel(candidate, config.acpxAgent, config.piThinkingLevel); } catch (error) { throw new PaperclipRunnerProviderProfileError("paperclip_runner_pi_thinking_invalid", error instanceof Error ? error.message : "Invalid Pi thinking level"); } @@ -566,7 +576,9 @@ export function resolvePaperclipRunnerProviderProfile( "Paperclip Runner ACPX requires a qualified agent profile.", ); } - const selectedModel = model || DEFAULT_ACPX_RUNNER_MODELS[acpxAgent] || ""; + const selectedModel = acpxAgent === "grok" && model === "grok-build" + ? DEFAULT_ACPX_RUNNER_MODELS.grok + : model || DEFAULT_ACPX_RUNNER_MODELS[acpxAgent] || ""; try { resolveQualifiedAcpxProfile(acpxAgent, selectedModel); } catch (error) { @@ -661,6 +673,7 @@ export function resolvePaperclipRunnerNativeProviderInput(input: { model: profile.model, acpxAgent: profile.acpxAgent, ...(profile.acpxAgent === "claude" ? { claudeEffort: resolveClaudeEffort("claude", config.modelReasoningEffort ?? config.reasoningEffort ?? config.effort) } : {}), + ...(profile.acpxAgent === "grok" ? { grokEffort: resolveGrokEffort("grok", config.modelReasoningEffort ?? config.reasoningEffort ?? config.effort), grokDisableWebSearch: resolveGrokDisableWebSearch("grok", config.disableWebSearch) } : {}), ...(profile.acpxAgent === "pi" ? { piThinkingLevel: resolvePaperclipRunnerPiThinkingLevel("acpx", "pi", config.piThinkingLevel) } : {}), ...(profile.acpxAgent === "cursor" ? { acpxSessionMode: resolvePaperclipRunnerCursorMode("acpx", "cursor", config.acpxSessionMode), diff --git a/server/src/vendor/paperclip-runner/index.ts b/server/src/vendor/paperclip-runner/index.ts index 9e6f34b2f1e..e12786d3d4a 100644 --- a/server/src/vendor/paperclip-runner/index.ts +++ b/server/src/vendor/paperclip-runner/index.ts @@ -38,6 +38,7 @@ export type { NativeExecutionInputV6, NativeExecutionInputV8, NativeExecutionInputV9, + NativeExecutionInputV10, MuseBindingSnapshot, DotBindingSnapshot, ExternalProviderPort, @@ -147,6 +148,7 @@ export const parsePaperclipQuestionResponse = runner.parsePaperclipQuestionResponse; export const resolveQualifiedAcpxProfile = runner.resolveQualifiedAcpxProfile; export const resolveClaudeEffort = runner.resolveClaudeEffort; +export const resolveGrokEffort = runner.resolveGrokEffort; export const QUALIFIED_ACPX_PROFILES = runner.QUALIFIED_ACPX_PROFILES; export const QUALIFIED_ACPX_VERSION = runner.QUALIFIED_ACPX_VERSION; export const CURSOR_DISTRIBUTION_PINS = runner.CURSOR_DISTRIBUTION_PINS; @@ -179,3 +181,5 @@ export const configuredEnvironmentProjection = runner.configuredEnvironmentProje export const configuredEnvironment = runner.configuredEnvironment; export const probeNativeRunnerEnvironment = runner.probeNativeRunnerEnvironment; + +export const resolveGrokDisableWebSearch = runner.resolveGrokDisableWebSearch; diff --git a/ui/src/components/AgentConfigForm.render.test.tsx b/ui/src/components/AgentConfigForm.render.test.tsx index 7b8037b275b..e6b2164137f 100644 --- a/ui/src/components/AgentConfigForm.render.test.tsx +++ b/ui/src/components/AgentConfigForm.render.test.tsx @@ -764,7 +764,7 @@ describe("AgentConfigForm environment selector", () => { expect(result.onSave).toHaveBeenCalledWith({ name: "Renamed saved agent" }); }); - it.each(["codex_local", "claude_local"])("upgrades a saved %s in one click with pending edits", async adapterType => { + it.each(["codex_local", "claude_local", "grok_local"])("upgrades a saved %s in one click with pending edits", async adapterType => { mockAdaptersApi.list.mockResolvedValueOnce([{ type: adapterType, supportedRunners: ["legacy", "paperclip"], defaultRunner: "paperclip" }]); const result = await renderForm([], { adapterType, adapterConfig: { model: "existing-model", effort: "high" } }); roots.push(result.root); @@ -976,8 +976,8 @@ describe("AgentConfigForm environment selector", () => { expect(result.container.textContent).toContain("is ignored. The agent can still run."); }); - it.each(["codex", "claude"].flatMap(harness => ["modelReasoningEffort", "reasoningEffort", "effort"].map(key => ({ harness, key }))))("hydrates saved effort and clears explicit Auto for $harness ($key)", async ({ harness, key }) => { - const profile = harness === "codex" ? { provider: "codex", model: "gpt-5.6-sol" } : { provider: "acpx", acpxAgent: "claude", model: "claude-opus-5-5" }; + it.each(["codex", "claude", "grok"].flatMap(harness => ["modelReasoningEffort", "reasoningEffort", "effort"].map(key => ({ harness, key }))))("hydrates saved effort and clears explicit Auto for $harness ($key)", async ({ harness, key }) => { + const profile = harness === "codex" ? { provider: "codex", model: "gpt-5.6-sol" } : { provider: "acpx", acpxAgent: harness, model: harness === "grok" ? "grok-4.7" : "claude-opus-5-5" }; const result = await renderForm([], { adapterType: "paperclip_runner", adapterConfig: { ...profile, [key]: "high" } }); roots.push(result.root); const effort = result.container.querySelector('[aria-label="Thinking effort"]'); @@ -1279,8 +1279,8 @@ describe("AgentConfigForm environment selector", () => { } }); - it("saves Grok 4.7 reasoning effort using the runtime key", async () => { - const result = await renderForm([], { adapterType: "grok_local", adapterConfig: { model: "grok-4.7", reasoningEffort: "high" } }); + it.each(["grok_local", "paperclip_runner"])("saves Grok 4.7 reasoning effort using the runtime key on %s", async adapterType => { + const result = await renderForm([], { adapterType, adapterConfig: { ...(adapterType === "paperclip_runner" ? { provider: "acpx", acpxAgent: "grok" } : {}), model: "grok-4.7", reasoningEffort: "high" } }); roots.push(result.root); const effort = [...result.container.querySelectorAll("button")].find(button => button.textContent?.trim() === "High")!; expect(effort).toBeTruthy(); diff --git a/ui/src/components/AgentConfigForm.tsx b/ui/src/components/AgentConfigForm.tsx index 1d7357b6f5d..4966526432c 100644 --- a/ui/src/components/AgentConfigForm.tsx +++ b/ui/src/components/AgentConfigForm.tsx @@ -918,7 +918,7 @@ export function AgentConfigForm(props: AgentConfigFormProps) { runnerSettingsTargetRef.current = runnerSettingsTarget; useEffect(() => () => { runnerSettingsTargetRef.current = ""; }, []); const showRunnerUpgrade = !isCreate - && ["codex_local", "claude_local"].includes(props.agent.adapterType) + && ["codex_local", "claude_local", "grok_local"].includes(props.agent.adapterType) && adapterType === props.agent.adapterType && !runnerDiscovery.isError && (runnerAvailability?.defaultRunner === "paperclip" || canQualifyRunnerUpgrade); @@ -1425,7 +1425,7 @@ export function AgentConfigForm(props: AgentConfigFormProps) { ? "mode" : adapterType === "opencode_local" ? "variant" - : adapterType === "grok_local" ? "reasoningEffort" + : harnessType === "grok_local" ? "reasoningEffort" : adapterType === "pi_local" ? "thinking" : "effort"; const thinkingEffortOptions = isCodexHarness @@ -1441,7 +1441,7 @@ export function AgentConfigForm(props: AgentConfigFormProps) { ? kimiThinkingEffortOptions : adapterType === "pi_local" ? [{ id: "", label: "Auto" }, ...["off", "minimal", "low", "medium", "high", "xhigh"].map(id => ({ id, label: id }))] - : harnessType === "claude_local" || adapterType === "grok_local" + : harnessType === "claude_local" || harnessType === "grok_local" ? [{ id: "", label: "Auto" }, ...setupEfforts(harnessType, currentModelId).map((id) => ({ id, label: id === "xhigh" ? "X-High" : id[0].toUpperCase() + id.slice(1), @@ -1449,11 +1449,11 @@ export function AgentConfigForm(props: AgentConfigFormProps) { : claudeThinkingEffortOptions; const currentThinkingEffort = isCreate ? val!.thinkingEffort - : isCodexHarness || (adapterType === "paperclip_runner" && harnessType === "claude_local") + : isCodexHarness || (adapterType === "paperclip_runner" && ["claude_local", "grok_local"].includes(harnessType)) ? eff( "adapterConfig", thinkingEffortKey, - String(config[thinkingEffortKey] ?? config.reasoningEffort ?? config.modelReasoningEffort ?? config.effort ?? ""), + String(config.modelReasoningEffort ?? config.reasoningEffort ?? config.effort ?? ""), ) : adapterType === "cursor" ? eff("adapterConfig", "mode", String(config.mode ?? "")) diff --git a/ui/src/components/task-chat/ComposerRunSettingsPicker.tsx b/ui/src/components/task-chat/ComposerRunSettingsPicker.tsx index d7be4eb5099..1dc387d5036 100644 --- a/ui/src/components/task-chat/ComposerRunSettingsPicker.tsx +++ b/ui/src/components/task-chat/ComposerRunSettingsPicker.tsx @@ -114,14 +114,15 @@ export function ComposerRunSettingsPicker({ const binding = aiRuntimeConnectionBindingSchema.safeParse(agent?.runtimeConfig?.aiConnection).data; const poolId = binding?.mode === "router" ? binding.connectionId : undefined; const copilotCatalog = copilotTaskModelCatalogOptions(agent); + const acpxAgent = agent?.adapterType === "paperclip_runner" && provider === "acpx" && typeof agent.adapterConfig.acpxAgent === "string" ? agent.adapterConfig.acpxAgent : undefined; const copilotCatalogScope = JSON.stringify(copilotCatalog ?? null); const requestCopilotModels = Boolean(copilotCatalog && open && view !== "agents" && !modelOptionsOverride); const { data: fetchedModels = [], isPending: modelsPending, refetch: refreshModels } = useQuery({ queryKey: agent && modelSupported - ? [...queryKeys.agents.adapterModels(companyId, agent.adapterType, agent.defaultEnvironmentId ?? null, provider), poolId ?? null, copilotCatalog ?? null] + ? [...queryKeys.agents.adapterModels(companyId, agent.adapterType, agent.defaultEnvironmentId ?? null, provider), poolId ?? null, copilotCatalog ?? null, acpxAgent ?? null] : ["agents", "composer-models", "none"], queryFn: () => agentsApi.adapterModels(companyId, agent!.adapterType, { - environmentId: agent!.defaultEnvironmentId ?? null, provider, poolId, ...copilotCatalog, + environmentId: agent!.defaultEnvironmentId ?? null, provider, poolId, acpxAgent, ...copilotCatalog, }), ...(copilotCatalog ? COPILOT_MODEL_DISCOVERY_QUERY_OPTIONS : {}), enabled: Boolean(agent && modelSupported && !modelOptionsOverride && (!copilotCatalog || requestCopilotModels)), diff --git a/ui/src/components/task-chat/composer-run-settings.test.ts b/ui/src/components/task-chat/composer-run-settings.test.ts index 9df5c74917b..a3a6d2e930f 100644 --- a/ui/src/components/task-chat/composer-run-settings.test.ts +++ b/ui/src/components/task-chat/composer-run-settings.test.ts @@ -23,6 +23,12 @@ describe("composer run settings", () => { expect(composerDefaultModel(agent("grok_local"))).toBe("grok-build"); expect(composerDefaultModel(undefined)).toBe(""); }); + it("offers native Grok effort and keeps its default model", () => { + const native = { ...agent("paperclip_runner", "acpx"), adapterConfig: { provider: "acpx", acpxAgent: "grok", reasoningEffort: "high" } }; + expect(composerDefaultModel(native)).toBe("grok-4.7"); + expect(composerEfforts(native, "grok-4.7", ["grok-4.7"])).toEqual(["low", "medium", "high", "xhigh"]); + expect(readComposerRunSettings({ adapterConfig: native.adapterConfig }, native.adapterType)).toMatchObject({ effort: "high" }); + }); it("shows only effort levels known for the selected harness and model", () => { expect(composerEfforts(agent("codex_local"), "gpt-6-astra", [])).toContain("ultra"); expect(composerEfforts(agent("paperclip_runner", "codex"), "gpt-6-astra", [])).toContain("ultra"); diff --git a/ui/src/components/task-chat/composer-run-settings.ts b/ui/src/components/task-chat/composer-run-settings.ts index a33b338a42a..43d2fcaed7b 100644 --- a/ui/src/components/task-chat/composer-run-settings.ts +++ b/ui/src/components/task-chat/composer-run-settings.ts @@ -45,6 +45,7 @@ export function composerDefaultModel(agent: Agent | undefined): string { if (agent.adapterType === "paperclip_runner") { const provider = composerCatalogProvider(agent); if (provider === "codex" || provider === "opencode") return resolvePaperclipRunnerModel(provider, config.model); + if (provider === "acpx" && config.acpxAgent === "grok") return "grok-4.7"; if (provider === "acpx" && config.acpxAgent !== "grok") return resolvePaperclipRunnerModel(provider, config.model); } return ""; @@ -72,7 +73,7 @@ export function composerEfforts(agent: Agent | undefined, model: string, catalog } if (!catalogIds.includes(effectiveModel)) return []; if (agentHarnessType(agent.adapterType, agent.adapterConfig) === "claude_local") return claudeLocalReasoningEffortsForModel(effectiveModel); - if (agent.adapterType === "grok_local") return grokLocalReasoningEffortsForModel(effectiveModel); + if (agentHarnessType(agent.adapterType, agent.adapterConfig) === "grok_local") return grokLocalReasoningEffortsForModel(effectiveModel); if (agent.adapterType === "pi_local") return ["off", "minimal", "low", "medium", "high", "xhigh"]; if (agent.adapterType === "kimi_local" && typeof agent.adapterConfig.engine === "string" && agent.adapterConfig.engine.trim().toLowerCase() === "cli" && modelSupportsEffort(effectiveModel)) return KIMI_SUPPORTED_EFFORTS;