From 15409b3b0532e07bc11ec3a8d02fca809403195d Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Thu, 16 Jul 2026 11:01:05 +0800
Subject: [PATCH 01/15] feat(codex): upgrade codex-acp to 1.1.4 and handle new
 live signals

Pin codex-acp to 1.1.4 (codex 0.144.4) and adapt to the three new
runtime signals it emits so the upgrade is regression-free:

- Retry: surface `_meta.codex.error` (willRetry only) as a transient
  TurnRetrying event, reusing the existing retry banner.
- Context compaction: render `_meta.contextCompaction` tool calls as a
  dedicated status card instead of a generic tool shell.
- Sub-agent activity: suppress `_meta.codex.subagent` tool calls at the
  emit point to preserve current live and reload behavior.
---
 src-tauri/src/acp/connection.rs               | 162 ++++++++++++++++++
 src-tauri/src/acp/registry.rs                 |  21 ++-
 src-tauri/src/acp/session_state.rs            |   3 +
 src-tauri/src/acp/types.rs                    |  15 ++
 .../message/content-parts-renderer.tsx        |  11 ++
 .../message/context-compaction-card.tsx       |  42 +++++
 src/contexts/acp-connections-context.tsx      |  20 +++
 src/i18n/messages/ar.json                     |   4 +
 src/i18n/messages/de.json                     |   4 +
 src/i18n/messages/en.json                     |   4 +
 src/i18n/messages/es.json                     |   4 +
 src/i18n/messages/fr.json                     |   4 +
 src/i18n/messages/ja.json                     |   4 +
 src/i18n/messages/ko.json                     |   4 +
 src/i18n/messages/pt.json                     |   4 +
 src/i18n/messages/zh-CN.json                  |   4 +
 src/i18n/messages/zh-TW.json                  |   4 +
 src/lib/types.ts                              |  10 ++
 18 files changed, 317 insertions(+), 7 deletions(-)
 create mode 100644 src/components/message/context-compaction-card.tsx

diff --git a/src-tauri/src/acp/connection.rs b/src-tauri/src/acp/connection.rs
index 35517ec92..2a021325a 100644
--- a/src-tauri/src/acp/connection.rs
+++ b/src-tauri/src/acp/connection.rs
@@ -5238,6 +5238,58 @@ fn codebuddy_meta_marks_subagent(
         .is_some_and(|s| !s.is_empty())
 }
 
+/// True when a Codex live `tool_call` is a `subAgentActivity` mapping
+/// (codex-acp #304, v1.1.3+). codex-acp maps codex `subAgentActivity`
+/// notifications onto ACP `tool_call(kind:other)` carrying
+/// `_meta.codex.subagent = {threadId, path, activity}`. codeg already renders
+/// codex collaboration from the `collabAgentToolCall` path (spawnAgent/wait/
+/// closeAgent — see `collab-tool.ts`) and reconstructs the full nested
+/// transcript on history reload from `agent-<id>.jsonl` (see
+/// `parsers/codex.rs`), so this new live signal is redundant with what codeg
+/// already shows. Suppressed at the emit point (keeping live and DB-reload
+/// consistent — a suppressed event is never persisted) to preserve the current
+/// live behavior. Gated on Codex.
+fn is_codex_subagent_activity(
+    agent_type: AgentType,
+    meta: Option<&serde_json::Map<String, serde_json::Value>>,
+) -> bool {
+    if agent_type != AgentType::Codex {
+        return false;
+    }
+    meta.and_then(|m| m.get("codex"))
+        .and_then(|codex| codex.get("subagent"))
+        .is_some()
+}
+
+/// Extract a retryable-turn-error indicator from a Codex `session_info_update`'s
+/// `_meta` (codex-acp #289, v1.1.3+). codex ships a transient, auto-retried
+/// error as `_meta.codex.error = {message, codexErrorInfo, additionalDetails,
+/// turnId, willRetry}` and keeps the prompt alive; it emits this only when
+/// `willRetry == true`. Returns `(message, http_status)` when a non-empty
+/// message is present. `codexErrorInfo` may be a bare string enum, an object
+/// variant carrying an inner `httpStatusCode`, or absent — only the object form
+/// yields a status. Defensively refuses a `willRetry == false` payload so a
+/// terminal error can never render as "retrying".
+fn codex_retry_indicator(
+    meta: Option<&serde_json::Map<String, serde_json::Value>>,
+) -> Option<(String, Option<i64>)> {
+    let err = meta?.get("codex")?.get("error")?;
+    if err.get("willRetry").and_then(|v| v.as_bool()) == Some(false) {
+        return None;
+    }
+    let message = err.get("message").and_then(|v| v.as_str())?.trim();
+    if message.is_empty() {
+        return None;
+    }
+    let http_status = err
+        .get("codexErrorInfo")
+        .and_then(|info| info.as_object())
+        .and_then(|obj| obj.values().next())
+        .and_then(|inner| inner.get("httpStatusCode"))
+        .and_then(|v| v.as_i64());
+    Some((message.to_string(), http_status))
+}
+
 /// True when a CodeBuddy sub-agent tool call's `_meta` marks it as a BACKGROUND
 /// sub-agent (`codebuddy.ai/isBackground == true`). A background sub-agent runs
 /// concurrently with the main agent, so the suppression-window invariant (parent
@@ -5592,6 +5644,13 @@ async fn emit_conversation_update(
             // Non-text thought chunks are currently ignored.
         }
         SessionUpdate::ToolCall(tc) => {
+            // codex-acp #304 (v1.1.3+) surfaces codex `subAgentActivity` as a
+            // live `tool_call`; suppress it — it is redundant with the collab
+            // capsule and the history reconstruction (see
+            // `is_codex_subagent_activity`).
+            if is_codex_subagent_activity(agent_type, tc.meta.as_ref()) {
+                return;
+            }
             let tool_call_id = tc.tool_call_id.to_string();
             // CodeBuddy double-wraps a deferred MCP result as a `{type,text}`
             // content part; peel it (in both the content and raw_output channels)
@@ -5715,6 +5774,12 @@ async fn emit_conversation_update(
             .await;
         }
         SessionUpdate::ToolCallUpdate(tcu) => {
+            // Symmetric with the `ToolCall` arm: a follow-up update for a codex
+            // `subAgentActivity` still carries `_meta.codex.subagent`, so drop
+            // it too (see `is_codex_subagent_activity`).
+            if is_codex_subagent_activity(agent_type, tcu.meta.as_ref()) {
+                return;
+            }
             let tool_call_id = tcu.tool_call_id.to_string();
             // Peel CodeBuddy's `{type,text}` deferred-MCP wrapper here too — the
             // result often arrives on an update (see raw_output below).
@@ -5948,6 +6013,21 @@ async fn emit_conversation_update(
                     .await;
                 }
             }
+            // codex-acp #289 (v1.1.3+): a retryable turn error rides under
+            // `_meta.codex.error` (only when `willRetry == true`) and the turn
+            // stays alive. Surface a transient retry indicator (the frontend
+            // reuses the Claude API-retry banner); it is NOT a turn failure.
+            if let Some((message, error_status)) = codex_retry_indicator(info.meta.as_ref()) {
+                emit_with_state(
+                    state,
+                    emitter,
+                    AcpEvent::TurnRetrying {
+                        message,
+                        error_status,
+                    },
+                )
+                .await;
+            }
         }
         other => {
             // Log unhandled update types for debugging
@@ -5969,6 +6049,88 @@ mod tests {
         ToolCallContent::Diff(d)
     }
 
+    /// Clone a `_meta` map out of a JSON object literal, mirroring how codex-acp
+    /// ships tool-call / session-info `_meta`.
+    fn meta_map(v: serde_json::Value) -> serde_json::Map<String, serde_json::Value> {
+        v.as_object().expect("object").clone()
+    }
+
+    #[test]
+    fn codex_subagent_activity_detected_only_for_codex_subagent_meta() {
+        // codex-acp #304: `_meta.codex.subagent` marks the suppressed activity.
+        let sub = meta_map(serde_json::json!({
+            "codex": { "subagent": { "threadId": "t1", "path": "/root/x", "activity": "started" } }
+        }));
+        assert!(is_codex_subagent_activity(AgentType::Codex, Some(&sub)));
+        // Only Codex is gated — the same meta never suppresses another agent.
+        assert!(!is_codex_subagent_activity(AgentType::ClaudeCode, Some(&sub)));
+        // Absent meta and sibling codex meta keys (goal / collaboration) are not
+        // subagent activity and must render normally.
+        assert!(!is_codex_subagent_activity(AgentType::Codex, None));
+        let goal = meta_map(serde_json::json!({ "codex": { "goal": { "objective": "x" } } }));
+        assert!(!is_codex_subagent_activity(AgentType::Codex, Some(&goal)));
+        let collab = meta_map(serde_json::json!({
+            "codex": { "collaboration": { "tool": "spawnAgent" } }
+        }));
+        assert!(!is_codex_subagent_activity(AgentType::Codex, Some(&collab)));
+    }
+
+    #[test]
+    fn codex_retry_indicator_extracts_message_and_object_http_status() {
+        // codex-acp #289: object-variant `codexErrorInfo` carries an inner
+        // `httpStatusCode`; the message + status are surfaced.
+        let m = meta_map(serde_json::json!({
+            "codex": { "error": {
+                "message": "Reconnecting after provider returned 401",
+                "codexErrorInfo": { "responseStreamDisconnected": { "httpStatusCode": 401 } },
+                "additionalDetails": "HTTP status 401",
+                "turnId": "turn-id",
+                "willRetry": true
+            } }
+        }));
+        assert_eq!(
+            codex_retry_indicator(Some(&m)),
+            Some((
+                "Reconnecting after provider returned 401".to_string(),
+                Some(401)
+            ))
+        );
+    }
+
+    #[test]
+    fn codex_retry_indicator_string_enum_yields_no_status() {
+        // A bare string `codexErrorInfo` yields the message but no http status.
+        let m = meta_map(serde_json::json!({
+            "codex": { "error": {
+                "message": "Server overloaded",
+                "codexErrorInfo": "serverOverloaded",
+                "willRetry": true
+            } }
+        }));
+        assert_eq!(
+            codex_retry_indicator(Some(&m)),
+            Some(("Server overloaded".to_string(), None))
+        );
+    }
+
+    #[test]
+    fn codex_retry_indicator_refuses_terminal_empty_and_absent() {
+        // `willRetry: false` (e.g. 401 auth) must never render a retry banner.
+        let terminal = meta_map(serde_json::json!({
+            "codex": { "error": { "message": "unauthorized", "willRetry": false } }
+        }));
+        assert_eq!(codex_retry_indicator(Some(&terminal)), None);
+        // Blank/whitespace message → nothing to show.
+        let blank = meta_map(serde_json::json!({
+            "codex": { "error": { "message": "   ", "willRetry": true } }
+        }));
+        assert_eq!(codex_retry_indicator(Some(&blank)), None);
+        // No `codex.error` at all (a goal-only or empty session_info_update).
+        let goal_only = meta_map(serde_json::json!({ "codex": { "goal": null } }));
+        assert_eq!(codex_retry_indicator(Some(&goal_only)), None);
+        assert_eq!(codex_retry_indicator(None), None);
+    }
+
     #[test]
     fn classify_load_failure_resource_not_found_maps_to_code() {
         assert_eq!(
diff --git a/src-tauri/src/acp/registry.rs b/src-tauri/src/acp/registry.rs
index c21a73add..c3fa77b7a 100644
--- a/src-tauri/src/acp/registry.rs
+++ b/src-tauri/src/acp/registry.rs
@@ -177,16 +177,23 @@ pub fn get_agent_meta(agent_type: AgentType) -> AcpAgentMeta {
             description: "ACP adapter for OpenAI's coding assistant",
             // codex-acp moved from zed-industries (Rust binary) to the
             // agentclientprotocol org (TypeScript rewrite, npx-distributed).
-            // 1.1.2 depends on `@openai/codex` ^0.144.0 and drives `codex
+            // 1.1.4 depends on `@openai/codex` ^0.144.4 and drives `codex
             // app-server`; since 1.0.1 it also resolves the resumed
             // `model_provider` from `~/.codex/config.toml` (#224), so codeg no
             // longer injects `MODEL_PROVIDER` to keep resumed sessions on the
-            // custom provider. 1.1.0 (#263) also reports `/goal` transitions as a
+            // custom provider. 1.1.0 (#263) reports `/goal` transitions as a
             // structured `session_info_update` (`_meta.codex.goal`) rather than
-            // live agent text — see `crate::acp::codex_goal`.
+            // live agent text — see `crate::acp::codex_goal`. 1.1.3+ adds three
+            // new live signals codeg handles in `connection::emit_conversation_update`:
+            // `subAgentActivity` tool calls (#304, suppressed via
+            // `is_codex_subagent_activity` — redundant with the collab capsule),
+            // retryable turn errors (#289, `_meta.codex.error` → a transient
+            // retry banner via `codex_retry_indicator`), and the
+            // context-compaction lifecycle (#288, `_meta.contextCompaction` tool
+            // call → a dedicated frontend card).
             distribution: AgentDistribution::Npx {
-                version: "1.1.2",
-                package: "@agentclientprotocol/codex-acp@1.1.2",
+                version: "1.1.4",
+                package: "@agentclientprotocol/codex-acp@1.1.4",
                 cmd: "codex-acp",
                 args: &[],
                 env: &[],
@@ -518,8 +525,8 @@ mod tests {
         );
         assert_npx_version(
             AgentType::Codex,
-            "1.1.2",
-            "@agentclientprotocol/codex-acp@1.1.2",
+            "1.1.4",
+            "@agentclientprotocol/codex-acp@1.1.4",
             Some("20.0.0"),
         );
         assert_npx_version(AgentType::Pi, "0.0.31", "pi-acp@0.0.31", Some("22.0.0"));
diff --git a/src-tauri/src/acp/session_state.rs b/src-tauri/src/acp/session_state.rs
index bee6aea0a..0891e570d 100644
--- a/src-tauri/src/acp/session_state.rs
+++ b/src-tauri/src/acp/session_state.rs
@@ -916,9 +916,12 @@ impl SessionState {
             }
             AcpEvent::ClaudeSdkMessage { .. }
             | AcpEvent::SessionLoadFailed { .. }
+            | AcpEvent::TurnRetrying { .. }
             | AcpEvent::UserPromptSent { .. } => {
                 // 这些事件不直接修改 SessionState 的可见字段。
                 // UserPromptSent 是纯通知事件，仅供 chat-channel 推送消费。
+                // TurnRetrying 与 Claude 的 api_retry 一样是前端瞬态提示（重试横幅），
+                // 不进快照——回合边界会清除它。
             }
         }
         self.last_activity_at = Utc::now();
diff --git a/src-tauri/src/acp/types.rs b/src-tauri/src/acp/types.rs
index ce320f7e9..5e41e5508 100644
--- a/src-tauri/src/acp/types.rs
+++ b/src-tauri/src/acp/types.rs
@@ -200,6 +200,21 @@ pub enum AcpEvent {
         #[serde(skip, default)]
         terminal: bool,
     },
+    /// A retryable turn error that keeps the turn alive (codex-acp #289,
+    /// v1.1.3+). Codex reports a transient, auto-retried error as
+    /// `session_info_update._meta.codex.error` (only when `willRetry == true`)
+    /// and continues the turn rather than terminating it. Surfaced as a
+    /// transient "retrying" indicator on the active turn — it is NOT a turn
+    /// failure and must not be rendered as one. The frontend reuses the Claude
+    /// API-retry banner and clears it at the next turn boundary.
+    TurnRetrying {
+        /// Human-readable transient error (`_meta.codex.error.message`).
+        message: String,
+        /// HTTP status pulled from a `codexErrorInfo` object variant
+        /// (e.g. `responseStreamDisconnected.httpStatusCode`), when present.
+        #[serde(skip_serializing_if = "Option::is_none")]
+        error_status: Option<i64>,
+    },
     /// `session/load` failed in a non-recoverable way (e.g. the agent has no
     /// record of this `session_id`). Emitted instead of silently falling back
     /// to `session/new`, so the frontend can surface the failure with reload
diff --git a/src/components/message/content-parts-renderer.tsx b/src/components/message/content-parts-renderer.tsx
index 4276394c2..e33089866 100644
--- a/src/components/message/content-parts-renderer.tsx
+++ b/src/components/message/content-parts-renderer.tsx
@@ -42,6 +42,10 @@ import {
 import { AgentToolCallPart } from "./agent-tool-call"
 import { AskQuestionResultCard } from "./ask-question-result-card"
 import { CollabAgentCard } from "./collab-agent-card"
+import {
+  ContextCompactionCard,
+  isContextCompactionMeta,
+} from "./context-compaction-card"
 import { FeedbackCheckResultCard } from "./feedback-check-result-card"
 import { COLLAB_AGENT_TOOL_NAME } from "@/lib/collab-tool"
 import { DelegatedSubThread } from "./delegated-sub-thread"
@@ -2304,6 +2308,13 @@ const ToolCallPart = memo(function ToolCallPart({
       toolNameLower === "exitplanmode" ||
       isFileTool) &&
     !part.errorText
+  // codex-acp #288: the context-compaction lifecycle is a `tool_call` tagged
+  // with `_meta.contextCompaction` (not addressed by tool name) → a subtle
+  // status card instead of the generic tool shell.
+  if (isContextCompactionMeta(part.meta)) {
+    return <ContextCompactionCard state={part.state} />
+  }
+
   // Agent/subagent tools get a dedicated container rendering
   if (toolNameLower === "agent") {
     return (
diff --git a/src/components/message/context-compaction-card.tsx b/src/components/message/context-compaction-card.tsx
new file mode 100644
index 000000000..d3e968398
--- /dev/null
+++ b/src/components/message/context-compaction-card.tsx
@@ -0,0 +1,42 @@
+"use client"
+
+/**
+ * codex-acp #288 (v1.1.3+): the context-compaction lifecycle arrives as an ACP
+ * `tool_call` (kind "other") tagged with `_meta.contextCompaction = true` — NOT
+ * under the `codex` namespace, unlike codex's other `_meta` extensions. The pair
+ * is `Context compacting` (in_progress) → `Context compacted` (completed) sharing
+ * one `toolCallId`. Rendered as a subtle status row (not the generic tool shell)
+ * so a routine housekeeping event doesn't read as a real tool call. Recognition
+ * is by `_meta`, so it works for both the live stream and DB/snapshot reloads.
+ */
+
+import { useTranslations } from "next-intl"
+import { Archive } from "lucide-react"
+
+import type { ToolCallState } from "@/lib/adapters/ai-elements-adapter"
+
+/** True when a tool call's `_meta` marks it as the codex context-compaction item. */
+export function isContextCompactionMeta(meta: unknown): boolean {
+  return (
+    !!meta &&
+    typeof meta === "object" &&
+    (meta as Record<string, unknown>).contextCompaction === true
+  )
+}
+
+interface Props {
+  state?: ToolCallState
+}
+
+export function ContextCompactionCard({ state }: Props) {
+  const t = useTranslations("Folder.chat.contextCompaction")
+  const isRunning = state === "input-streaming" || state === "input-available"
+  return (
+    <div className="flex items-center gap-2 rounded-md border border-border/40 bg-muted/30 px-3 py-1.5 text-xs text-muted-foreground">
+      <Archive className="size-3.5 shrink-0" />
+      <span className={isRunning ? "animate-pulse" : undefined}>
+        {isRunning ? t("compacting") : t("compacted")}
+      </span>
+    </div>
+  )
+}
diff --git a/src/contexts/acp-connections-context.tsx b/src/contexts/acp-connections-context.tsx
index a87904fff..088eb6b65 100644
--- a/src/contexts/acp-connections-context.tsx
+++ b/src/contexts/acp-connections-context.tsx
@@ -3202,6 +3202,26 @@ export function AcpConnectionsProvider({ children }: { children: ReactNode }) {
             entries: e.entries,
           })
           break
+        case "turn_retrying": {
+          // codex-acp #289: a retryable turn error keeps the turn alive (codex
+          // auto-retries). Reuse the Claude API-retry banner — codex doesn't
+          // report attempt/limit/delay, so those stay null; the banner clears at
+          // the next turn boundary like the Claude path.
+          const retryConn = storeRef.current.connections.get(contextKey)
+          dispatch({
+            type: "CLAUDE_API_RETRY",
+            contextKey,
+            retry: {
+              sessionId: retryConn?.sessionId ?? "",
+              attempt: null,
+              maxRetries: null,
+              error: e.message,
+              errorStatus: e.error_status ?? null,
+              retryDelayMs: null,
+            },
+          })
+          break
+        }
         case "turn_complete": {
           flushStreamingQueue()
           flushPendingToolCallUpdates()
diff --git a/src/i18n/messages/ar.json b/src/i18n/messages/ar.json
index 18044c1da..b88f45744 100644
--- a/src/i18n/messages/ar.json
+++ b/src/i18n/messages/ar.json
@@ -2623,6 +2623,10 @@
         "opClose": "إغلاق الوكيل الفرعي",
         "opResume": "استئناف الوكيل الفرعي"
       },
+      "contextCompaction": {
+        "compacting": "جارٍ ضغط السياق…",
+        "compacted": "تم ضغط السياق"
+      },
       "backgroundTasks": {
         "running": "{count, plural, one {مهمة خلفية واحدة قيد التشغيل} two {مهمتا خلفية قيد التشغيل} few {# مهام خلفية قيد التشغيل} other {# مهمة خلفية قيد التشغيل}}",
         "settling": "جارٍ مزامنة نتائج الخلفية…",
diff --git a/src/i18n/messages/de.json b/src/i18n/messages/de.json
index 953805e00..ec91d09f2 100644
--- a/src/i18n/messages/de.json
+++ b/src/i18n/messages/de.json
@@ -2623,6 +2623,10 @@
         "opClose": "Sub-Agent wird geschlossen",
         "opResume": "Sub-Agent wird fortgesetzt"
       },
+      "contextCompaction": {
+        "compacting": "Kontext wird komprimiert…",
+        "compacted": "Kontext komprimiert"
+      },
       "backgroundTasks": {
         "running": "{count, plural, one {# Hintergrundaufgabe läuft} other {# Hintergrundaufgaben laufen}}",
         "settling": "Hintergrundergebnisse werden synchronisiert…",
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index 16cef83ec..73c6f0567 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -2623,6 +2623,10 @@
         "opClose": "Closing sub-agent",
         "opResume": "Resuming sub-agent"
       },
+      "contextCompaction": {
+        "compacting": "Compacting context…",
+        "compacted": "Context compacted"
+      },
       "backgroundTasks": {
         "running": "{count, plural, one {# background task running} other {# background tasks running}}",
         "settling": "Syncing background results…",
diff --git a/src/i18n/messages/es.json b/src/i18n/messages/es.json
index 1e946a224..d7efdb18e 100644
--- a/src/i18n/messages/es.json
+++ b/src/i18n/messages/es.json
@@ -2623,6 +2623,10 @@
         "opClose": "Cerrando subagente",
         "opResume": "Reanudando subagente"
       },
+      "contextCompaction": {
+        "compacting": "Compactando el contexto…",
+        "compacted": "Contexto compactado"
+      },
       "backgroundTasks": {
         "running": "{count, plural, one {# tarea en segundo plano en ejecución} other {# tareas en segundo plano en ejecución}}",
         "settling": "Sincronizando resultados en segundo plano…",
diff --git a/src/i18n/messages/fr.json b/src/i18n/messages/fr.json
index 8747ac281..b10a0141b 100644
--- a/src/i18n/messages/fr.json
+++ b/src/i18n/messages/fr.json
@@ -2623,6 +2623,10 @@
         "opClose": "Fermeture du sous-agent",
         "opResume": "Reprise du sous-agent"
       },
+      "contextCompaction": {
+        "compacting": "Compactage du contexte…",
+        "compacted": "Contexte compacté"
+      },
       "backgroundTasks": {
         "running": "{count, plural, one {# tâche en arrière-plan en cours} other {# tâches en arrière-plan en cours}}",
         "settling": "Synchronisation des résultats d'arrière-plan…",
diff --git a/src/i18n/messages/ja.json b/src/i18n/messages/ja.json
index e6e9a0d0e..d2ced7f9b 100644
--- a/src/i18n/messages/ja.json
+++ b/src/i18n/messages/ja.json
@@ -2623,6 +2623,10 @@
         "opClose": "サブエージェントを終了中",
         "opResume": "サブエージェントを再開中"
       },
+      "contextCompaction": {
+        "compacting": "コンテキストを圧縮しています…",
+        "compacted": "コンテキストを圧縮しました"
+      },
       "backgroundTasks": {
         "running": "{count} 件のバックグラウンドタスクを実行中",
         "settling": "バックグラウンド結果を同期中…",
diff --git a/src/i18n/messages/ko.json b/src/i18n/messages/ko.json
index 70e6c3844..d23c2d9e7 100644
--- a/src/i18n/messages/ko.json
+++ b/src/i18n/messages/ko.json
@@ -2623,6 +2623,10 @@
         "opClose": "서브 에이전트 종료 중",
         "opResume": "서브 에이전트 재개 중"
       },
+      "contextCompaction": {
+        "compacting": "컨텍스트 압축 중…",
+        "compacted": "컨텍스트 압축 완료"
+      },
       "backgroundTasks": {
         "running": "백그라운드 작업 {count}개 실행 중",
         "settling": "백그라운드 결과 동기화 중…",
diff --git a/src/i18n/messages/pt.json b/src/i18n/messages/pt.json
index 15941ece7..661896a3b 100644
--- a/src/i18n/messages/pt.json
+++ b/src/i18n/messages/pt.json
@@ -2623,6 +2623,10 @@
         "opClose": "Encerrando subagente",
         "opResume": "Retomando subagente"
       },
+      "contextCompaction": {
+        "compacting": "Compactando o contexto…",
+        "compacted": "Contexto compactado"
+      },
       "backgroundTasks": {
         "running": "{count, plural, one {# tarefa em segundo plano em execução} other {# tarefas em segundo plano em execução}}",
         "settling": "Sincronizando resultados em segundo plano…",
diff --git a/src/i18n/messages/zh-CN.json b/src/i18n/messages/zh-CN.json
index 656c04865..01c93960d 100644
--- a/src/i18n/messages/zh-CN.json
+++ b/src/i18n/messages/zh-CN.json
@@ -2623,6 +2623,10 @@
         "opClose": "结束子智能体",
         "opResume": "恢复子智能体"
       },
+      "contextCompaction": {
+        "compacting": "正在压缩上下文…",
+        "compacted": "上下文已压缩"
+      },
       "backgroundTasks": {
         "running": "{count} 个后台任务运行中",
         "settling": "正在同步后台结果…",
diff --git a/src/i18n/messages/zh-TW.json b/src/i18n/messages/zh-TW.json
index 34a7d3d2b..aaf9aa1fa 100644
--- a/src/i18n/messages/zh-TW.json
+++ b/src/i18n/messages/zh-TW.json
@@ -2623,6 +2623,10 @@
         "opClose": "結束子智能體",
         "opResume": "恢復子智能體"
       },
+      "contextCompaction": {
+        "compacting": "正在壓縮上下文…",
+        "compacted": "上下文已壓縮"
+      },
       "backgroundTasks": {
         "running": "{count} 個背景任務執行中",
         "settling": "正在同步背景結果…",
diff --git a/src/lib/types.ts b/src/lib/types.ts
index 058615442..45f4ee862 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -1204,6 +1204,16 @@ export type AcpEvent =
       /** Stable backend error identifier for localization (e.g. "initialize_timeout"). */
       code: string | null
     }
+  | {
+      // codex-acp #289: a retryable turn error that keeps the turn alive (codex
+      // auto-retries). NOT a turn failure — rendered as a transient retry
+      // indicator that reuses the Claude API-retry banner and clears at the
+      // next turn boundary. `error_status` is the HTTP status when codex's
+      // `codexErrorInfo` carried one.
+      type: "turn_retrying"
+      message: string
+      error_status?: number
+    }
   | {
       type: "session_load_failed"
       session_id: string

From de8ff77e4bd3d902472f2f729790f7553dfcf92f Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Thu, 16 Jul 2026 11:35:44 +0800
Subject: [PATCH 02/15] feat(codex): show sub-agent model and reasoning effort
 on live collab card
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Surface the sub-agent's model and reasoningEffort (codex-acp #304, top-level
in the collab tool-call rawInput) on the live execution capsule — info that
was previously visible only after a history reload. Gated to the spawn capsule
so the live and reconstructed wait capsules stay in parity.
---
 src-tauri/src/parsers/codex.rs                | 11 +++--
 .../message/collab-agent-card.test.tsx        | 39 +++++++++++++++++
 src/components/message/collab-agent-card.tsx  | 32 +++++++++++---
 src/lib/collab-collapse.test.ts               | 37 ++++++++++++++++
 src/lib/collab-tool.test.ts                   | 42 +++++++++++++++++--
 src/lib/collab-tool.ts                        | 28 ++++++++++---
 6 files changed, 171 insertions(+), 18 deletions(-)

diff --git a/src-tauri/src/parsers/codex.rs b/src-tauri/src/parsers/codex.rs
index 49abbdb6e..4d030b22e 100644
--- a/src-tauri/src/parsers/codex.rs
+++ b/src-tauri/src/parsers/codex.rs
@@ -894,10 +894,13 @@ impl CodexParser {
         //   - close_agent → folded into the execution capsule (no own capsule);
         //     its result is only a fallback for agents never waited on.
         // codex-acp 1.0.1 (#223) maps `collabAgentToolCall` onto live ACP
-        // `tool_call`s and still drops `subAgentActivity`, so the nested
-        // `agent-<id>.jsonl` stats only exist on history reload. Live and
-        // reconstructed capsules never double-render (live during streaming,
-        // this on reload).
+        // `tool_call`s; 1.1.3+ (#304) additionally emits `subAgentActivity` as a
+        // SEPARATE live `tool_call` (`_meta.codex.subagent`), but codeg
+        // suppresses it (redundant with the collab capsule — see
+        // `is_codex_subagent_activity`) and it carries no transcript content, so
+        // the nested `agent-<id>.jsonl` stats still only exist on history reload.
+        // Live and reconstructed capsules never double-render (live during
+        // streaming, this on reload).
         let mut spawn_agent_call_ids: HashSet<String> = HashSet::new();
         let mut agent_id_to_spawn_call_id: HashMap<String, String> = HashMap::new();
         // Result text used to FILL the execution capsule only as a fallback for
diff --git a/src/components/message/collab-agent-card.test.tsx b/src/components/message/collab-agent-card.test.tsx
index 36d09f8a6..7bebdeaaf 100644
--- a/src/components/message/collab-agent-card.test.tsx
+++ b/src/components/message/collab-agent-card.test.tsx
@@ -26,6 +26,8 @@ function collabInput(o: {
   op?: string
   agents?: Record<string, { status: string; message: string | null }>
   status?: string
+  model?: string
+  reasoningEffort?: string
 }) {
   return JSON.stringify({
     prompt: o.prompt ?? "",
@@ -33,6 +35,8 @@ function collabInput(o: {
     receiverThreadIds: Object.keys(o.agents ?? {}),
     agentsStates: o.agents ?? {},
     status: o.status ?? "inProgress",
+    ...(o.model ? { model: o.model } : {}),
+    ...(o.reasoningEffort ? { reasoningEffort: o.reasoningEffort } : {}),
     ...(o.op ? { [COLLAB_OP_KEY]: o.op } : {}),
   })
 }
@@ -62,6 +66,41 @@ describe("CollabAgentCard", () => {
     expect(screen.queryByText("Running")).not.toBeInTheDocument()
   })
 
+  it("shows the sub-agent model + reasoning effort on a spawn (codex-acp #304)", () => {
+    renderCard({
+      input: collabInput({
+        prompt: "Build the app",
+        op: "spawnAgent",
+        model: "gpt-5-codex",
+        reasoningEffort: "high",
+        agents: { "11110000-aaaa": { status: "running", message: null } },
+      }),
+      state: "input-available",
+    })
+    // Collapsed until expanded; run-meta lives in the body.
+    fireEvent.click(screen.getByRole("button"))
+    expect(screen.getByText("gpt-5-codex")).toBeInTheDocument()
+    expect(screen.getByText("high")).toBeInTheDocument()
+  })
+
+  it("does NOT show model/effort on a wait capsule (live/reload parity)", () => {
+    renderCard({
+      input: collabInput({
+        op: "wait",
+        status: "completed",
+        model: "gpt-5-codex",
+        reasoningEffort: "high",
+        agents: { "22220000-bbbb": { status: "completed", message: "done" } },
+      }),
+      state: "output-available",
+    })
+    fireEvent.click(screen.getByRole("button"))
+    // The reconstructed wait capsule carries no model/effort, so the live wait
+    // capsule must not render them either.
+    expect(screen.queryByText("gpt-5-codex")).not.toBeInTheDocument()
+    expect(screen.queryByText("high")).not.toBeInTheDocument()
+  })
+
   it("gives a wait op an op-aware title and badges the returned agent UUID", () => {
     renderCard({
       input: collabInput({
diff --git a/src/components/message/collab-agent-card.tsx b/src/components/message/collab-agent-card.tsx
index 59414c640..35545a03c 100644
--- a/src/components/message/collab-agent-card.tsx
+++ b/src/components/message/collab-agent-card.tsx
@@ -11,14 +11,16 @@
  * running, ✓/⚠ suffix, auto-open on error). The sub-agent UUID(s) are shown in
  * the pill via `idBadge` so execution and wait capsules read uniformly.
  *
- * The full sub-agent transcript is NOT available live — codex-acp drops
- * `subAgentActivity` and emits no `rawOutput` for collab calls; the richer
- * reconstructed capsule only appears on history reload. Detection, op-merge and
- * status classification live in `@/lib/collab-tool`.
+ * The full sub-agent transcript is NOT available live — codex-acp's separate
+ * `subAgentActivity` signal (codex-acp #304) is suppressed as redundant and
+ * carries no transcript content anyway; the richer reconstructed capsule only
+ * appears on history reload. The sub-agent's `model` / `reasoningEffort` (also
+ * #304) ARE available live and shown on the execution (spawn) capsule. Detection,
+ * op-merge and status classification live in `@/lib/collab-tool`.
  */
 
 import { useMemo } from "react"
-import { AlertTriangle, Check } from "lucide-react"
+import { AlertTriangle, Check, Cpu } from "lucide-react"
 import { useTranslations } from "next-intl"
 
 import {
@@ -48,6 +50,15 @@ export function CollabAgentCard({ input, errorText, state }: Props) {
   const agents = info?.agents ?? []
   const opStatus = info?.status ?? null
   const op = info?.op ?? null
+  const model = info?.model ?? null
+  const reasoningEffort = info?.reasoningEffort ?? null
+  // model/effort describe HOW the sub-agent runs — meaningful on the execution
+  // (spawn) capsule, the one collab card that survives live collapse as the
+  // sub-agent's definition. Gating to spawn also preserves live/reload parity:
+  // the reconstructed `wait` capsule (Rust `build_collab_wait_input`) carries no
+  // model/effort, so a live `wait` card must not show them either.
+  const showRunMeta =
+    classifyCollabOp(op) === "spawn" && (!!model || !!reasoningEffort)
 
   const hasErrorAgent = agents.some((a) =>
     isErrorCollabStatusKind(classifyCollabStatus(a.status))
@@ -108,6 +119,17 @@ export function CollabAgentCard({ input, errorText, state }: Props) {
       idBadge={idBadge}
       statusLabel={title}
     >
+      {/* Sub-agent model + reasoning effort (codex-acp #304), execution capsule
+          only. Live-side enrichment: previously visible only after reload. */}
+      {showRunMeta && (
+        <div className="flex items-center gap-1.5 text-[11px] text-muted-foreground">
+          <Cpu className="size-3 shrink-0" />
+          {model && <span className="font-mono">{model}</span>}
+          {model && reasoningEffort && <span aria-hidden>·</span>}
+          {reasoningEffort && <span>{reasoningEffort}</span>}
+        </div>
+      )}
+
       {/* Prompt — the execution capsule's task (spawn only; wait has none). */}
       {prompt && (
         <div className="space-y-1">
diff --git a/src/lib/collab-collapse.test.ts b/src/lib/collab-collapse.test.ts
index 95aa08822..f238c4170 100644
--- a/src/lib/collab-collapse.test.ts
+++ b/src/lib/collab-collapse.test.ts
@@ -11,6 +11,8 @@ function collabBlock(opts: {
   /** ACP tool-call status. */
   status?: string
   prompt?: string
+  model?: string
+  reasoningEffort?: string
   agents: Record<string, { status: string; message?: string | null }>
 }): LiveContentBlock {
   const agentsStates: Record<string, unknown> = {}
@@ -30,6 +32,10 @@ function collabBlock(opts: {
         senderThreadId: "main",
         receiverThreadIds: Object.keys(opts.agents),
         agentsStates,
+        ...(opts.model ? { model: opts.model } : {}),
+        ...(opts.reasoningEffort
+          ? { reasoningEffort: opts.reasoningEffort }
+          : {}),
         status: "inProgress",
       }),
       raw_output_chunks: [],
@@ -214,6 +220,37 @@ describe("collapseLiveCollabBlocks", () => {
     expect(agent?.message).toBe("boom")
   })
 
+  it("preserves top-level model/reasoningEffort on the execution capsule (codex-acp #304)", () => {
+    const input: LiveContentBlock[] = [
+      collabBlock({
+        id: "spawn",
+        title: "spawnAgent",
+        prompt: "go",
+        model: "gpt-5-codex",
+        reasoningEffort: "high",
+        agents: { A: { status: "pendingInit" } },
+      }),
+      collabBlock({
+        id: "wait",
+        title: "wait",
+        agents: { A: { status: "completed", message: "R" } },
+      }),
+    ]
+    const out = collapseLiveCollabBlocks(input)
+    const spawn = out.find(
+      (b) =>
+        b.type === "tool_call" && classifyCollabOp(b.info.title) === "spawn"
+    )
+    // The rewrite rebuilds agentsStates but must carry top-level fields through
+    // (it spreads `...parsed`), so model/effort survive onto the execution card.
+    const info =
+      spawn?.type === "tool_call"
+        ? parseCollabToolInput(spawn.info.raw_input)
+        : null
+    expect(info?.model).toBe("gpt-5-codex")
+    expect(info?.reasoningEffort).toBe("high")
+  })
+
   it("keeps an orphan close that has no spawn to fold into", () => {
     const input: LiveContentBlock[] = [
       collabBlock({
diff --git a/src/lib/collab-tool.test.ts b/src/lib/collab-tool.test.ts
index 244957849..995c169a7 100644
--- a/src/lib/collab-tool.test.ts
+++ b/src/lib/collab-tool.test.ts
@@ -15,6 +15,7 @@ import {
 
 // A realistic codex collab tool call rawInput (codex-acp 1.0.1 mapper shape):
 // agentsStates is a map keyed by sub-agent threadId → { status, message }.
+// model/reasoningEffort are top-level siblings (codex-acp #304).
 const collabRaw = JSON.stringify({
   prompt: "在 /Users/x/work/my-app 中运行 `pnpm build`。",
   senderThreadId: "019f06e2-aaaa",
@@ -22,6 +23,8 @@ const collabRaw = JSON.stringify({
   agentsStates: {
     "019f06e3-bbbb": { status: "running", message: "Checking weather" },
   },
+  model: "gpt-5-codex",
+  reasoningEffort: "high",
   status: "inProgress",
 })
 
@@ -62,11 +65,13 @@ describe("isCodexCollabInput", () => {
 })
 
 describe("parseCollabToolInput", () => {
-  it("extracts prompt, op status, op (null by default), and per-agent states", () => {
+  it("extracts prompt, op status, op (null by default), model/effort, and per-agent states", () => {
     expect(parseCollabToolInput(collabRaw)).toEqual({
       prompt: "在 /Users/x/work/my-app 中运行 `pnpm build`。",
       status: "inProgress",
       op: null,
+      model: "gpt-5-codex",
+      reasoningEffort: "high",
       agents: [
         {
           threadId: "019f06e3-bbbb",
@@ -77,6 +82,26 @@ describe("parseCollabToolInput", () => {
     })
   })
 
+  it("reads top-level model and reasoningEffort (codex-acp #304)", () => {
+    const info = parseCollabToolInput(collabRaw)
+    expect(info?.model).toBe("gpt-5-codex")
+    expect(info?.reasoningEffort).toBe("high")
+  })
+
+  it("treats absent or blank model/effort as null (not per-agent)", () => {
+    const info = parseCollabToolInput(
+      JSON.stringify({
+        senderThreadId: "t1",
+        receiverThreadIds: ["t2"],
+        // model/effort blank at top level; a per-agent field must NOT be read.
+        model: "   ",
+        agentsStates: { t2: { status: "running", model: "ignored-per-agent" } },
+      })
+    )
+    expect(info?.model).toBeNull()
+    expect(info?.reasoningEffort).toBeNull()
+  })
+
   it("reads the merged op key", () => {
     const withOp = JSON.stringify({
       prompt: "",
@@ -104,6 +129,8 @@ describe("parseCollabToolInput", () => {
       prompt: "do it",
       status: "completed",
       op: null,
+      model: null,
+      reasoningEffort: null,
       agents: [{ threadId: "t2", status: "completed", message: null }],
     })
   })
@@ -118,7 +145,14 @@ describe("parseCollabToolInput", () => {
           agentsStates: {},
         })
       )
-    ).toEqual({ prompt: null, status: null, op: null, agents: [] })
+    ).toEqual({
+      prompt: null,
+      status: null,
+      op: null,
+      model: null,
+      reasoningEffort: null,
+      agents: [],
+    })
   })
 
   it("yields no agent rows when agentsStates is missing, an array, or malformed", () => {
@@ -148,8 +182,10 @@ describe("mergeCollabOp", () => {
     expect(parsed[COLLAB_OP_KEY]).toBe("spawnAgent")
     // round-trips through the parser
     expect(parseCollabToolInput(merged)?.op).toBe("spawnAgent")
-    // original fields preserved
+    // original fields preserved (agents + #304 model/effort)
     expect(parseCollabToolInput(merged)?.agents).toHaveLength(1)
+    expect(parseCollabToolInput(merged)?.model).toBe("gpt-5-codex")
+    expect(parseCollabToolInput(merged)?.reasoningEffort).toBe("high")
   })
 
   it("returns null when there is no op or the input is not a JSON object", () => {
diff --git a/src/lib/collab-tool.ts b/src/lib/collab-tool.ts
index 344950fc0..b531aba60 100644
--- a/src/lib/collab-tool.ts
+++ b/src/lib/collab-tool.ts
@@ -15,12 +15,16 @@
  * so the live input shaper merges it back in under `COLLAB_OP_KEY` — see
  * `mergeCollabOp` and `resolveLiveToolInput`.
  *
- * Live ceiling: codex-acp drops `subAgentActivity` (the sub-agent's actual
- * streamed messages) and emits no `rawOutput` for collab calls, so the richest
- * live signal is `agentsStates[*].{status,message}` (on a `wait` completion the
- * `message` carries the sub-agent's full result). The full nested transcript
- * only exists on history reload, reconstructed by the Rust parser into the
- * richer "Agent" capsule from the on-disk `agent-<id>.jsonl`.
+ * Live ceiling: codex-acp 1.1.3+ (#304) additionally emits `subAgentActivity`
+ * as a SEPARATE live `tool_call` (`_meta.codex.subagent`), but codeg suppresses
+ * it (redundant with this collab capsule — see the Rust `is_codex_subagent_
+ * activity`), and it carries no transcript content anyway (only a
+ * started/interacted/interrupted lifecycle marker). #304 also adds top-level
+ * `model` / `reasoningEffort` to this collab `rawInput`, surfaced here. The
+ * richest live signal thus remains `agentsStates[*].{status,message}` (on a
+ * `wait` completion the `message` carries the sub-agent's full result); the full
+ * nested transcript only exists on history reload, reconstructed by the Rust
+ * parser into the richer "Agent" capsule from the on-disk `agent-<id>.jsonl`.
  */
 
 /** Canonical tool name the live collab path collapses to (see `inferLiveToolName`). */
@@ -50,6 +54,16 @@ export interface CollabToolInfo {
   status: string | null
   /** The collab op (`CollabAgentTool`: spawnAgent/wait/closeAgent/…), or null. */
   op: string | null
+  /**
+   * The sub-agent's model id (codex-acp #304), top-level in the collab
+   * `rawInput` (a sibling of `prompt`/`agentsStates`, NOT per-agent). May be null.
+   */
+  model: string | null
+  /**
+   * The sub-agent's reasoning effort (codex-acp #304), an unconstrained string
+   * such as "minimal" / "low" / "medium" / "high". Top-level, may be null.
+   */
+  reasoningEffort: string | null
   /** Per-sub-agent live states, in `agentsStates` insertion order. */
   agents: CollabAgentState[]
 }
@@ -242,6 +256,8 @@ export function parseCollabToolInput(
     prompt: asText(parsed.prompt),
     status: asText(parsed.status),
     op: asText(parsed[COLLAB_OP_KEY]),
+    model: asText(parsed.model),
+    reasoningEffort: asText(parsed.reasoningEffort),
     agents,
   }
 }

From 03fb30bc304d64b9eb329e06c5b0b570630358a4 Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Thu, 16 Jul 2026 12:18:20 +0800
Subject: [PATCH 03/15] feat(codex): suppress redundant /plan slash command in
 favor of mode selector
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

codex-acp 1.1.4 (#293) advertises `/plan` as an AvailableCommand tagged
`_meta.commandAction.kind = "setConfigOption"` (configId `collaboration_mode`,
presentation `state`) — codex's signal that the client should render it as
state, not an invokable command. codeg already surfaces that state through the
generic `collaboration_mode` config-option selector, so listing `/plan` in the
slash menu is redundant and its static description is wrong once plan mode is
already on. Drop config-option state toggles from the command list, gated on
Codex; commands with other action kinds (e.g. `/goal`'s `prefixPrompt`) stay.
---
 src-tauri/src/acp/connection.rs | 66 ++++++++++++++++++++++++++++++++-
 1 file changed, 65 insertions(+), 1 deletion(-)

diff --git a/src-tauri/src/acp/connection.rs b/src-tauri/src/acp/connection.rs
index 2a021325a..ad809fe62 100644
--- a/src-tauri/src/acp/connection.rs
+++ b/src-tauri/src/acp/connection.rs
@@ -5290,6 +5290,32 @@ fn codex_retry_indicator(
     Some((message.to_string(), http_status))
 }
 
+/// True when an available command is really a config-option state toggle rather
+/// than an invokable slash command (codex-acp #293, v1.1.4). codex advertises
+/// e.g. `/plan` as an `AvailableCommand` tagged
+/// `_meta.commandAction = {kind:"setConfigOption", configId:"collaboration_mode",
+/// value:"plan", resetValue:"default", presentation:"state"}` — codex's signal
+/// that the client should represent it as STATE. codeg already surfaces that
+/// state as the `collaboration_mode` config-option selector (the generic
+/// `SessionConfigOption` path), so also listing `/plan` as a slash command is
+/// redundant and its static "Turn plan mode on" description is wrong once plan
+/// mode is already on. Suppress these from the command list. Commands with any
+/// other action kind (e.g. `/goal`'s `prefixPrompt`, which takes an objective
+/// argument) are real commands and kept. Gated on Codex — `commandAction` is a
+/// codex-private `_meta` extension (the ACP schema has no such type).
+fn is_config_option_state_command(
+    agent_type: AgentType,
+    meta: Option<&serde_json::Map<String, serde_json::Value>>,
+) -> bool {
+    if agent_type != AgentType::Codex {
+        return false;
+    }
+    meta.and_then(|m| m.get("commandAction"))
+        .and_then(|action| action.get("kind"))
+        .and_then(|kind| kind.as_str())
+        == Some("setConfigOption")
+}
+
 /// True when a CodeBuddy sub-agent tool call's `_meta` marks it as a BACKGROUND
 /// sub-agent (`codebuddy.ai/isBackground == true`). A background sub-agent runs
 /// concurrently with the main agent, so the suppression-window invariant (parent
@@ -5937,7 +5963,10 @@ async fn emit_conversation_update(
                 .await;
         }
         SessionUpdate::AvailableCommandsUpdate(update) => {
-            // Some agents (e.g. Claude Code with overlapping user/project slash
+            // Drop config-option state toggles (codex `/plan` — see
+            // `is_config_option_state_command`): they're already the
+            // `collaboration_mode` selector, not invokable commands. Then dedup:
+            // some agents (e.g. Claude Code with overlapping user/project slash
             // commands) emit duplicate entries sharing the same name. Keep the
             // first occurrence so downstream consumers don't render duplicates;
             // the frontend reducer also dedupes as a defensive measure.
@@ -5945,6 +5974,7 @@ async fn emit_conversation_update(
             let commands: Vec<AvailableCommandInfo> = update
                 .available_commands
                 .iter()
+                .filter(|cmd| !is_config_option_state_command(agent_type, cmd.meta.as_ref()))
                 .filter(|cmd| seen.insert(cmd.name.clone()))
                 .map(|cmd| {
                     let input_hint = cmd.input.as_ref().map(|input| match input {
@@ -6075,6 +6105,40 @@ mod tests {
         assert!(!is_codex_subagent_activity(AgentType::Codex, Some(&collab)));
     }
 
+    #[test]
+    fn config_option_state_command_suppressed_only_for_codex_set_config_action() {
+        // codex-acp #293: `/plan` is a config-option state toggle (rendered as the
+        // `collaboration_mode` selector), not an invokable slash command.
+        let plan = meta_map(serde_json::json!({
+            "commandAction": {
+                "kind": "setConfigOption",
+                "configId": "collaboration_mode",
+                "value": "plan",
+                "resetValue": "default",
+                "presentation": "state"
+            }
+        }));
+        assert!(is_config_option_state_command(AgentType::Codex, Some(&plan)));
+        // Gated on Codex — the same meta never suppresses another agent's command.
+        assert!(!is_config_option_state_command(
+            AgentType::ClaudeCode,
+            Some(&plan)
+        ));
+        // `/goal` uses a `prefixPrompt` action (takes an objective argument) → a
+        // real command, kept.
+        let goal = meta_map(serde_json::json!({
+            "commandAction": { "kind": "prefixPrompt", "presentation": "state" }
+        }));
+        assert!(!is_config_option_state_command(AgentType::Codex, Some(&goal)));
+        // Ordinary commands (no `commandAction`) and absent meta are kept.
+        assert!(!is_config_option_state_command(AgentType::Codex, None));
+        let plain = meta_map(serde_json::json!({ "somethingElse": true }));
+        assert!(!is_config_option_state_command(
+            AgentType::Codex,
+            Some(&plain)
+        ));
+    }
+
     #[test]
     fn codex_retry_indicator_extracts_message_and_object_http_status() {
         // codex-acp #289: object-variant `codexErrorInfo` carries an inner

From c84f4a34d45fa19078a4f9f0d4752cb4104e66be Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Thu, 16 Jul 2026 13:10:40 +0800
Subject: [PATCH 04/15] feat(codex): add goal pause/clear control via
 _codex/session/goal_control

codex-acp 1.1.4 (#293) exposes a bespoke `_codex/session/goal_control` request
({sessionId, action: "pause"|"clear"}) to pause or clear the session's active
goal. Wire it end-to-end, mirroring set_config_option: a GoalControlAction enum
and ConnectionCommand::GoalControl, a UntypedMessage sender (the escape hatch
already used for set_config_option / fork), both connection dispatch arms, a
manager method, and the tauri command + HTTP endpoint. The backend sources the
sessionId from the live session, so the frontend only supplies connectionId.

On the card, GoalCard gains Pause/Clear buttons driven by a goal-control
context: the panel decides liveness + ownership once and passes a callback, so
the buttons hide on history reload, for viewers, and in the read-only sub-agent
dialog (which renders MessageListView with no provider). Pause shows for an
active goal, Clear for active or paused; resume is re-issuing the /goal prompt.

Also pin 1.1.4's slimmed goal snapshot: it drops tokensUsed and adds
createdAt / controlMethod, which pass through goal_marker unchanged while the
absent tokensUsed degrades to a hidden stat.
---
 src-tauri/src/acp/codex_goal.rs               |  30 ++++++
 src-tauri/src/acp/connection.rs               | 102 ++++++++++++++++++
 src-tauri/src/acp/manager.rs                  |  25 ++++-
 src-tauri/src/commands/acp.rs                 |  10 ++
 src-tauri/src/lib.rs                          |   1 +
 src-tauri/src/web/handlers/acp.rs             |  19 ++++
 src-tauri/src/web/router.rs                   |   4 +
 .../conversation-detail-panel.tsx             |  58 +++++++---
 .../message/goal-control-context.tsx          |  27 +++++
 .../message/goal-tool-call.test.tsx           |  67 ++++++++++++
 src/components/message/goal-tool-call.tsx     |  39 ++++++-
 src/contexts/acp-connections-context.tsx      |  23 ++++
 src/i18n/messages/ar.json                     |   2 +
 src/i18n/messages/de.json                     |   2 +
 src/i18n/messages/en.json                     |   2 +
 src/i18n/messages/es.json                     |   2 +
 src/i18n/messages/fr.json                     |   2 +
 src/i18n/messages/ja.json                     |   2 +
 src/i18n/messages/ko.json                     |   2 +
 src/i18n/messages/pt.json                     |   2 +
 src/i18n/messages/zh-CN.json                  |   2 +
 src/i18n/messages/zh-TW.json                  |   2 +
 src/lib/api.ts                                |  10 ++
 23 files changed, 417 insertions(+), 18 deletions(-)
 create mode 100644 src/components/message/goal-control-context.tsx

diff --git a/src-tauri/src/acp/codex_goal.rs b/src-tauri/src/acp/codex_goal.rs
index fd0361a48..4021402f5 100644
--- a/src-tauri/src/acp/codex_goal.rs
+++ b/src-tauri/src/acp/codex_goal.rs
@@ -248,6 +248,36 @@ mod tests {
         assert_eq!(input["objective"], "Fix the login bug");
     }
 
+    #[test]
+    fn preserves_v114_slimmed_snapshot_fields() {
+        // codex-acp v1.1.4 (#293) slimmed the goal snapshot: it dropped
+        // `tokensUsed` and added `createdAt` / `controlMethod` (alongside the
+        // existing `tokenBudget` / `timeUsedSeconds`). `goal_marker` clones the
+        // object through, so the new fields survive onto the card output and the
+        // absent `tokensUsed` is simply not present — `GoalCard` reads it as null
+        // and hides that stat, so no display breaks.
+        let goal = json!({
+            "objective": "  Ship the release  ",
+            "status": "active",
+            "tokenBudget": 200000,
+            "timeUsedSeconds": 42,
+            "createdAt": "2026-07-16T10:00:00Z",
+            "controlMethod": "_codex/session/goal_control",
+        });
+        let m = goal_marker(&goal).expect("goal marker");
+        assert_eq!(m.tool_name, "create_goal");
+        let out: Value = serde_json::from_str(&m.output_json).unwrap();
+        let g = &out["goal"];
+        assert_eq!(g["objective"], "Ship the release"); // trimmed
+        assert_eq!(g["status"], "active");
+        assert_eq!(g["tokenBudget"], 200000);
+        assert_eq!(g["timeUsedSeconds"], 42);
+        assert_eq!(g["createdAt"], "2026-07-16T10:00:00Z");
+        assert_eq!(g["controlMethod"], "_codex/session/goal_control");
+        // Slimmed snapshot carries no tokensUsed → the card hides that stat.
+        assert!(g.get("tokensUsed").is_none());
+    }
+
     #[test]
     fn goal_tool_call_id_is_occurrence_unique() {
         // Occurrence-addressed so two runs sharing an objective never collide.
diff --git a/src-tauri/src/acp/connection.rs b/src-tauri/src/acp/connection.rs
index ad809fe62..b813f4bec 100644
--- a/src-tauri/src/acp/connection.rs
+++ b/src-tauri/src/acp/connection.rs
@@ -143,6 +143,19 @@ fn prepend_officecli_path(env: &mut BTreeMap<String, String>) {
     }
 }
 
+/// The two actions codex's bespoke `_codex/session/goal_control` request
+/// accepts (codex-acp #293, v1.1.4). Start / resume / re-objective are NOT part
+/// of this method — those go through the `/goal` prompt (a real slash command;
+/// only `/plan`, a config-option state toggle, is suppressed). Serializes to the
+/// lowercase wire value codex expects (`"pause"` / `"clear"`) and deserializes
+/// from the same string coming off the tauri command / HTTP endpoint.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum GoalControlAction {
+    Pause,
+    Clear,
+}
+
 /// Commands sent from Tauri command handlers to the ACP connection loop.
 pub enum ConnectionCommand {
     Prompt {
@@ -163,6 +176,9 @@ pub enum ConnectionCommand {
         config_id: String,
         value_id: String,
     },
+    GoalControl {
+        action: GoalControlAction,
+    },
     Cancel,
     RespondPermission {
         request_id: String,
@@ -3180,6 +3196,34 @@ async fn set_session_config_option_inner(
     Ok(response.config_options)
 }
 
+/// Send codex's bespoke `_codex/session/goal_control` extension request to pause
+/// or clear the session's active goal (codex-acp #293, v1.1.4). Start / resume /
+/// re-objective are NOT this method — they go through the `/goal` prompt.
+///
+/// codex replies with an empty object and then pushes the resulting goal
+/// snapshot as a normal `session_info_update` (`_meta.codex.goal`, or `null` for
+/// a clear), which the existing goal-card path renders — so the response value
+/// carries nothing to parse and is intentionally discarded.
+///
+/// Sent via `UntypedMessage` because `_codex/…` is a codex-private extension
+/// method with no sacp typed variant — the same escape hatch used for
+/// `session/set_config_option` and `session/fork`.
+async fn send_goal_control(
+    cx: &ConnectionTo<Agent>,
+    session_id: &SessionId,
+    action: GoalControlAction,
+) -> Result<(), sacp::Error> {
+    let params = serde_json::json!({
+        "sessionId": session_id,
+        "action": action,
+    });
+    let untyped_req = UntypedMessage::new("_codex/session/goal_control", params).map_err(|e| {
+        sacp::util::internal_error(format!("Failed to build goal_control request: {e}"))
+    })?;
+    cx.send_request_to(Agent, untyped_req).block_task().await?;
+    Ok(())
+}
+
 /// Apply user-saved mode and config-option preferences to a freshly-attached
 /// session BEFORE the initial `session_modes` / `session_config_options`
 /// events are emitted to the frontend.
@@ -4521,6 +4565,22 @@ async fn run_conversation_loop<'a>(
                                         .await;
                                     }
                                 }
+                                Some(ConnectionCommand::GoalControl { action }) => {
+                                    if let Err(e) = send_goal_control(&cx, &sid, action).await {
+                                        emit_with_state(
+                                            state,
+                                            emitter,
+                                            AcpEvent::Error {
+                                                message: format!("Failed to control goal: {e}"),
+                                                agent_type: agent_type.to_string(),
+                                                code: None,
+                                                // Recoverable: a failed pause/clear leaves the turn alive.
+                                                terminal: false,
+                                            },
+                                        )
+                                        .await;
+                                    }
+                                }
                                 Some(ConnectionCommand::Cancel) => {
                                     // Send CancelNotification to agent to stop the current turn
                                     let _ = cx.send_notification_to(
@@ -4699,6 +4759,25 @@ async fn run_conversation_loop<'a>(
                     .await;
                 }
             }
+            Some(ConnectionCommand::GoalControl { action }) => {
+                let cx = session.connection();
+                let sid = session.session_id().clone();
+                if let Err(e) = send_goal_control(&cx, &sid, action).await {
+                    emit_with_state(
+                        state,
+                        emitter,
+                        AcpEvent::Error {
+                            message: format!("Failed to control goal: {e}"),
+                            agent_type: agent_type.to_string(),
+                            code: None,
+                            // Recoverable: an idle pause/clear failure leaves the
+                            // connection alive.
+                            terminal: false,
+                        },
+                    )
+                    .await;
+                }
+            }
             Some(ConnectionCommand::Cancel) => {
                 let cx = session.connection();
                 let sid = session.session_id().clone();
@@ -6139,6 +6218,29 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn goal_control_action_roundtrips_codex_wire_values() {
+        // codex-acp #293: `_codex/session/goal_control` expects lowercase
+        // "pause" / "clear" on the wire, and the same strings arrive from the
+        // tauri command / HTTP endpoint — both directions must match exactly.
+        assert_eq!(
+            serde_json::to_value(GoalControlAction::Pause).unwrap(),
+            serde_json::json!("pause")
+        );
+        assert_eq!(
+            serde_json::to_value(GoalControlAction::Clear).unwrap(),
+            serde_json::json!("clear")
+        );
+        assert_eq!(
+            serde_json::from_value::<GoalControlAction>(serde_json::json!("pause")).unwrap(),
+            GoalControlAction::Pause
+        );
+        assert_eq!(
+            serde_json::from_value::<GoalControlAction>(serde_json::json!("clear")).unwrap(),
+            GoalControlAction::Clear
+        );
+    }
+
     #[test]
     fn codex_retry_indicator_extracts_message_and_object_http_status() {
         // codex-acp #289: object-variant `codexErrorInfo` carries an inner
diff --git a/src-tauri/src/acp/manager.rs b/src-tauri/src/acp/manager.rs
index 86e866cd9..fa1cc2319 100644
--- a/src-tauri/src/acp/manager.rs
+++ b/src-tauri/src/acp/manager.rs
@@ -10,7 +10,9 @@ use sea_orm::{
     TransactionTrait,
 };
 
-use crate::acp::connection::{spawn_agent_connection, AgentConnection, ConnectionCommand};
+use crate::acp::connection::{
+    spawn_agent_connection, AgentConnection, ConnectionCommand, GoalControlAction,
+};
 use crate::acp::error::AcpError;
 use crate::acp::feedback::{
     bounded_feedback_batch, FeedbackItem, FeedbackStatus, PendingFeedback,
@@ -1157,6 +1159,27 @@ impl ConnectionManager {
             .map_err(|_| AcpError::ProcessExited)
     }
 
+    /// Pause or clear the session's active Codex goal via the connection loop
+    /// (codex-acp #293). Looked up by connectionId; the loop sources the
+    /// sessionId from the live session, so callers only supply the action.
+    pub async fn goal_control(
+        &self,
+        conn_id: &str,
+        action: GoalControlAction,
+    ) -> Result<(), AcpError> {
+        let cmd_tx = {
+            let connections = self.connections.lock().await;
+            let conn = connections
+                .get(conn_id)
+                .ok_or_else(|| AcpError::ConnectionNotFound(conn_id.into()))?;
+            conn.cmd_tx.clone()
+        };
+        cmd_tx
+            .send(ConnectionCommand::GoalControl { action })
+            .await
+            .map_err(|_| AcpError::ProcessExited)
+    }
+
     pub async fn cancel(&self, db: &DatabaseConnection, conn_id: &str) -> Result<(), AcpError> {
         let (cmd_tx, state_arc, emitter) = {
             let connections = self.connections.lock().await;
diff --git a/src-tauri/src/commands/acp.rs b/src-tauri/src/commands/acp.rs
index 3e02ca4ac..eb459feab 100644
--- a/src-tauri/src/commands/acp.rs
+++ b/src-tauri/src/commands/acp.rs
@@ -6068,6 +6068,16 @@ pub async fn acp_set_config_option(
         .await
 }
 
+#[cfg(feature = "tauri-runtime")]
+#[cfg_attr(feature = "tauri-runtime", tauri::command)]
+pub async fn acp_goal_control(
+    connection_id: String,
+    action: crate::acp::connection::GoalControlAction,
+    manager: State<'_, ConnectionManager>,
+) -> Result<(), AcpError> {
+    manager.goal_control(&connection_id, action).await
+}
+
 /// Spawn a transient ACP connection for `agent_type` with a silent emitter,
 /// read whatever `SessionConfigOptions` / `SessionModes` the agent advertises,
 /// and tear it down. The returned snapshot drives the delegation-settings UI
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index b8b5340d4..4bf99b575 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -1064,6 +1064,7 @@ mod tauri_app {
                 acp_commands::acp_prompt,
                 acp_commands::acp_set_mode,
                 acp_commands::acp_set_config_option,
+                acp_commands::acp_goal_control,
                 acp_commands::acp_describe_agent_options,
                 acp_commands::acp_cancel,
                 acp_commands::acp_fork,
diff --git a/src-tauri/src/web/handlers/acp.rs b/src-tauri/src/web/handlers/acp.rs
index 9b6248a3a..fd0d7daa1 100644
--- a/src-tauri/src/web/handlers/acp.rs
+++ b/src-tauri/src/web/handlers/acp.rs
@@ -347,6 +347,25 @@ pub async fn acp_set_config_option(
     Ok(Json(()))
 }
 
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AcpGoalControlParams {
+    pub connection_id: String,
+    pub action: crate::acp::connection::GoalControlAction,
+}
+
+pub async fn acp_goal_control(
+    Extension(state): Extension<Arc<AppState>>,
+    Json(params): Json<AcpGoalControlParams>,
+) -> Result<Json<()>, AppCommandError> {
+    let manager = &state.connection_manager;
+    manager
+        .goal_control(&params.connection_id, params.action)
+        .await
+        .map_err(|e| AppCommandError::task_execution_failed(e.to_string()))?;
+    Ok(Json(()))
+}
+
 #[derive(Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct AcpDescribeAgentOptionsParams {
diff --git a/src-tauri/src/web/router.rs b/src-tauri/src/web/router.rs
index 93c8b0d15..a76f1d434 100644
--- a/src-tauri/src/web/router.rs
+++ b/src-tauri/src/web/router.rs
@@ -580,6 +580,10 @@ pub fn build_router(
             "/acp_set_config_option",
             post(handlers::acp::acp_set_config_option),
         )
+        .route(
+            "/acp_goal_control",
+            post(handlers::acp::acp_goal_control),
+        )
         .route(
             "/acp_describe_agent_options",
             post(handlers::acp::acp_describe_agent_options),
diff --git a/src/components/conversations/conversation-detail-panel.tsx b/src/components/conversations/conversation-detail-panel.tsx
index 1e133208a..65171fa0c 100644
--- a/src/components/conversations/conversation-detail-panel.tsx
+++ b/src/components/conversations/conversation-detail-panel.tsx
@@ -32,6 +32,10 @@ import { cn, copyTextFromMenu, randomUUID } from "@/lib/utils"
 import { useConnectionLifecycle } from "@/hooks/use-connection-lifecycle"
 import { useMessageQueue, type QueuedMessage } from "@/hooks/use-message-queue"
 import { MessageListView } from "@/components/message/message-list-view"
+import {
+  GoalControlProvider,
+  type GoalControlValue,
+} from "@/components/message/goal-control-context"
 import { ConversationShell } from "@/components/chat/conversation-shell"
 import { SessionConfigStaleBanner } from "@/components/chat/session-config-stale-banner"
 import { BackgroundTasksChip } from "@/components/chat/background-tasks-chip"
@@ -1354,23 +1358,45 @@ const ConversationTabView = memo(function ConversationTabView({
     closeTab(tabId)
   }, [closeTab, folder, openNewConversationTab, tabId, workingDirForConnection])
 
+  // Goal pause/clear is a live, owner-only action, so decide availability once
+  // here (where the connection is owned) rather than in the deep goal card.
+  // `null` when the session isn't live or the user is a viewer → the card hides
+  // its buttons. Codex is the only agent that produces goal cards, so no
+  // agent-type gate is needed. Provided only around the main panel's list; the
+  // read-only sub-agent dialog renders its own MessageListView with no provider.
+  const goalControlValue = useMemo<GoalControlValue>(() => {
+    const live =
+      conn.connectionId !== null &&
+      (connStatus === "connected" || connStatus === "prompting") &&
+      !conn.isViewer
+    return {
+      onGoalControl: live
+        ? (action) => {
+            void acpActions.goalControl(tabId, action)
+          }
+        : null,
+    }
+  }, [conn.connectionId, conn.isViewer, connStatus, acpActions, tabId])
+
   const messageListNode = (
-    <MessageListView
-      conversationId={effectiveConversationId}
-      agentType={selectedAgent}
-      connStatus={connStatus}
-      isActive={isActive}
-      sendSignal={sendSignal}
-      sessionStats={effectiveSessionStats}
-      detailLoading={detailLoading}
-      detailError={detailError}
-      acpLoadError={acpLoadError}
-      hideEmptyState={!hasPersistedConversation || hasSentMessage}
-      onReload={canShowDetailErrorActions ? handleReloadDetail : undefined}
-      onNewSession={
-        canShowDetailErrorActions ? handleOpenNewSession : undefined
-      }
-    />
+    <GoalControlProvider value={goalControlValue}>
+      <MessageListView
+        conversationId={effectiveConversationId}
+        agentType={selectedAgent}
+        connStatus={connStatus}
+        isActive={isActive}
+        sendSignal={sendSignal}
+        sessionStats={effectiveSessionStats}
+        detailLoading={detailLoading}
+        detailError={detailError}
+        acpLoadError={acpLoadError}
+        hideEmptyState={!hasPersistedConversation || hasSentMessage}
+        onReload={canShowDetailErrorActions ? handleReloadDetail : undefined}
+        onNewSession={
+          canShowDetailErrorActions ? handleOpenNewSession : undefined
+        }
+      />
+    </GoalControlProvider>
   )
 
   // Live-feedback bar gating + the "agent never read your note" resend fallback.
diff --git a/src/components/message/goal-control-context.tsx b/src/components/message/goal-control-context.tsx
new file mode 100644
index 000000000..9fc048aed
--- /dev/null
+++ b/src/components/message/goal-control-context.tsx
@@ -0,0 +1,27 @@
+"use client"
+
+import { createContext, useContext } from "react"
+
+export type GoalControlAction = "pause" | "clear"
+
+export interface GoalControlValue {
+  /**
+   * Fire a pause/clear on the session's currently active Codex goal, or `null`
+   * when goal control isn't available for this surface — a history reload with
+   * no live connection, a read-only viewer, or the read-only sub-agent dialog
+   * (which renders its own `MessageListView` with no provider). The goal card
+   * hides its control buttons whenever this is `null`, so liveness/ownership are
+   * decided once at the panel where the connection is owned, not in the card.
+   */
+  onGoalControl: ((action: GoalControlAction) => void) | null
+}
+
+const GoalControlContext = createContext<GoalControlValue>({
+  onGoalControl: null,
+})
+
+export const GoalControlProvider = GoalControlContext.Provider
+
+export function useGoalControl(): GoalControlValue {
+  return useContext(GoalControlContext)
+}
diff --git a/src/components/message/goal-tool-call.test.tsx b/src/components/message/goal-tool-call.test.tsx
index 4f5d4f612..f8dd6408e 100644
--- a/src/components/message/goal-tool-call.test.tsx
+++ b/src/components/message/goal-tool-call.test.tsx
@@ -4,6 +4,7 @@ import { NextIntlClientProvider } from "next-intl"
 import { describe, expect, it } from "vitest"
 
 import { GoalRunPart, GoalToolCallPart } from "./goal-tool-call"
+import { GoalControlProvider } from "./goal-control-context"
 import enMessages from "@/i18n/messages/en.json"
 import zhMessages from "@/i18n/messages/zh-CN.json"
 
@@ -140,3 +141,69 @@ describe("GoalToolCallPart", () => {
     expect(screen.getByText("目标：分析 README 文件")).toBeInTheDocument()
   })
 })
+
+describe("GoalCard goal control (codex-acp #293)", () => {
+  function renderGoal(
+    ui: ReactElement,
+    onGoalControl: ((action: "pause" | "clear") => void) | null
+  ) {
+    return render(
+      <NextIntlClientProvider locale="en" messages={enMessages}>
+        <GoalControlProvider value={{ onGoalControl }}>
+          {ui}
+        </GoalControlProvider>
+      </NextIntlClientProvider>
+    )
+  }
+
+  function goalWith(status: string): ReactElement {
+    const toolName = status === "active" ? "create_goal" : "update_goal"
+    return (
+      <GoalToolCallPart
+        part={{
+          type: "tool-call",
+          toolCallId: `g-${status}`,
+          toolName,
+          input: JSON.stringify({ status }),
+          state: "output-available",
+          output: JSON.stringify({
+            goal: { objective: "Ship the release", status },
+          }),
+        }}
+      />
+    )
+  }
+
+  it("offers Pause + Clear on a live active goal and routes the action", () => {
+    const calls: string[] = []
+    renderGoal(goalWith("active"), (a) => calls.push(a))
+    // Controls live in the (collapsed) body — expand first.
+    fireEvent.click(screen.getByRole("button"))
+    fireEvent.click(screen.getByText("Pause"))
+    fireEvent.click(screen.getByText("Clear"))
+    expect(calls).toEqual(["pause", "clear"])
+  })
+
+  it("offers only Clear on a paused goal (codex has no resume control)", () => {
+    renderGoal(goalWith("paused"), () => {})
+    fireEvent.click(screen.getByRole("button"))
+    expect(screen.getByText("Clear")).toBeInTheDocument()
+    expect(screen.queryByText("Pause")).not.toBeInTheDocument()
+  })
+
+  it("shows no controls on a terminal goal", () => {
+    renderGoal(goalWith("complete"), () => {})
+    fireEvent.click(screen.getByRole("button"))
+    expect(screen.queryByText("Pause")).not.toBeInTheDocument()
+    expect(screen.queryByText("Clear")).not.toBeInTheDocument()
+  })
+
+  it("hides controls when the session isn't live (no provider callback)", () => {
+    // Reload / viewer / sub-agent dialog → onGoalControl null → no buttons even
+    // for an active goal.
+    renderGoal(goalWith("active"), null)
+    fireEvent.click(screen.getByRole("button"))
+    expect(screen.queryByText("Pause")).not.toBeInTheDocument()
+    expect(screen.queryByText("Clear")).not.toBeInTheDocument()
+  })
+})
diff --git a/src/components/message/goal-tool-call.tsx b/src/components/message/goal-tool-call.tsx
index 0841e09ee..e262c24f2 100644
--- a/src/components/message/goal-tool-call.tsx
+++ b/src/components/message/goal-tool-call.tsx
@@ -13,8 +13,9 @@ import {
 import { Shimmer } from "@/components/ai-elements/shimmer"
 import { normalizeToolName } from "@/lib/tool-call-normalization"
 import { cn } from "@/lib/utils"
-import { ChevronRightIcon } from "lucide-react"
+import { ChevronRightIcon, PauseIcon, XIcon } from "lucide-react"
 import { useTranslations } from "next-intl"
+import { useGoalControl } from "./goal-control-context"
 
 type GoalToolPart = Extract<AdaptedContentPart, { type: "tool-call" }>
 
@@ -236,6 +237,17 @@ function GoalCard({
 
   const errorText = endPart?.errorText ?? startPart.errorText
 
+  // Pause/Clear are only offered for a live, controllable goal (the provider
+  // supplies a callback only when the session is live and the user owns it; it
+  // is `null` on history reload / for viewers / in the read-only sub-agent
+  // dialog). Pause applies to an active goal; Clear to active OR paused. Codex
+  // exposes no "resume" control — resuming is re-issuing the `/goal` prompt.
+  const { onGoalControl } = useGoalControl()
+  const showPause = Boolean(onGoalControl) && normalizedStatus === "active"
+  const showClear =
+    Boolean(onGoalControl) &&
+    (normalizedStatus === "active" || normalizedStatus === "paused")
+
   return (
     <Collapsible open={bodyOpen} onOpenChange={setBodyOpen} className="w-full">
       <CollapsibleTrigger
@@ -346,6 +358,31 @@ function GoalCard({
               )}
             </div>
 
+            {(showPause || showClear) && (
+              <div className="flex flex-wrap items-center gap-2 pt-1">
+                {showPause && (
+                  <button
+                    type="button"
+                    onClick={() => onGoalControl?.("pause")}
+                    className="inline-flex items-center gap-1.5 rounded-md border border-border/60 px-2.5 py-1 text-xs font-medium text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
+                  >
+                    <PauseIcon aria-hidden="true" className="size-3" />
+                    {t("pause")}
+                  </button>
+                )}
+                {showClear && (
+                  <button
+                    type="button"
+                    onClick={() => onGoalControl?.("clear")}
+                    className="inline-flex items-center gap-1.5 rounded-md border border-border/60 px-2.5 py-1 text-xs font-medium text-muted-foreground transition-colors hover:bg-muted hover:text-foreground"
+                  >
+                    <XIcon aria-hidden="true" className="size-3" />
+                    {t("clear")}
+                  </button>
+                )}
+              </div>
+            )}
+
             {isError && errorText && (
               <pre className="max-h-64 overflow-auto whitespace-pre-wrap break-words rounded-md bg-destructive/10 p-3 text-xs text-destructive">
                 {errorText}
diff --git a/src/contexts/acp-connections-context.tsx b/src/contexts/acp-connections-context.tsx
index 088eb6b65..d1969114d 100644
--- a/src/contexts/acp-connections-context.tsx
+++ b/src/contexts/acp-connections-context.tsx
@@ -23,6 +23,7 @@ import {
   acpPrompt,
   acpSetMode,
   acpSetConfigOption,
+  acpGoalControl,
   acpCancel,
   acpRespondPermission,
   acpAnswerQuestion,
@@ -2273,6 +2274,8 @@ export interface AcpActionsValue {
     questionId: string,
     answer: QuestionAnswer
   ): Promise<void>
+  /** Pause or clear the session's active Codex goal (codex-acp #293). */
+  goalControl(contextKey: string, action: "pause" | "clear"): Promise<void>
   setActiveKey(key: string | null): void
   touchActivity(contextKey: string): void
   registerOpenTabKeys(keys: Set<string>): void
@@ -4444,6 +4447,24 @@ export function AcpConnectionsProvider({ children }: { children: ReactNode }) {
     await acpCancel(conn.connectionId)
   }, [])
 
+  const goalControl = useCallback(
+    async (contextKey: string, action: "pause" | "clear") => {
+      const conn = storeRef.current.connections.get(contextKey)
+      if (!conn) return
+      // Fire-and-forget: there is no in-flight card UI to settle (unlike
+      // answerQuestion). The resulting goal snapshot arrives as a normal
+      // session_info_update, and a wire failure is surfaced by the backend's
+      // recoverable Error event — so log here and don't rethrow.
+      try {
+        lastActivityRef.current.set(contextKey, Date.now())
+        await acpGoalControl(conn.connectionId, action)
+      } catch (e) {
+        console.error("[AcpConnections] goalControl failed:", e)
+      }
+    },
+    []
+  )
+
   const respondPermission = useCallback(
     async (contextKey: string, requestId: string, optionId: string) => {
       const conn = storeRef.current.connections.get(contextKey)
@@ -4571,6 +4592,7 @@ export function AcpConnectionsProvider({ children }: { children: ReactNode }) {
       setMode,
       setConfigOption,
       cancel,
+      goalControl,
       respondPermission,
       answerQuestion,
       setActiveKey,
@@ -4591,6 +4613,7 @@ export function AcpConnectionsProvider({ children }: { children: ReactNode }) {
       setMode,
       setConfigOption,
       cancel,
+      goalControl,
       respondPermission,
       answerQuestion,
       setActiveKey,
diff --git a/src/i18n/messages/ar.json b/src/i18n/messages/ar.json
index b88f45744..805dba528 100644
--- a/src/i18n/messages/ar.json
+++ b/src/i18n/messages/ar.json
@@ -2455,6 +2455,8 @@
           "remaining": "المتبقي",
           "elapsed": "المدة",
           "tokens": "tokens",
+          "pause": "إيقاف مؤقت",
+          "clear": "مسح",
           "status": {
             "active": "نشط",
             "paused": "متوقف مؤقتًا",
diff --git a/src/i18n/messages/de.json b/src/i18n/messages/de.json
index ec91d09f2..e2ddec68f 100644
--- a/src/i18n/messages/de.json
+++ b/src/i18n/messages/de.json
@@ -2455,6 +2455,8 @@
           "remaining": "Verbleibend",
           "elapsed": "Verstrichen",
           "tokens": "tokens",
+          "pause": "Pausieren",
+          "clear": "Löschen",
           "status": {
             "active": "aktiv",
             "paused": "pausiert",
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index 73c6f0567..6cd826c23 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -2455,6 +2455,8 @@
           "remaining": "Remaining",
           "elapsed": "Elapsed",
           "tokens": "tokens",
+          "pause": "Pause",
+          "clear": "Clear",
           "status": {
             "active": "active",
             "paused": "paused",
diff --git a/src/i18n/messages/es.json b/src/i18n/messages/es.json
index d7efdb18e..50b91aa2d 100644
--- a/src/i18n/messages/es.json
+++ b/src/i18n/messages/es.json
@@ -2455,6 +2455,8 @@
           "remaining": "Restante",
           "elapsed": "Transcurrido",
           "tokens": "tokens",
+          "pause": "Pausar",
+          "clear": "Borrar",
           "status": {
             "active": "activo",
             "paused": "pausado",
diff --git a/src/i18n/messages/fr.json b/src/i18n/messages/fr.json
index b10a0141b..ec89f6c77 100644
--- a/src/i18n/messages/fr.json
+++ b/src/i18n/messages/fr.json
@@ -2455,6 +2455,8 @@
           "remaining": "Restant",
           "elapsed": "Écoulé",
           "tokens": "tokens",
+          "pause": "Pause",
+          "clear": "Effacer",
           "status": {
             "active": "actif",
             "paused": "en pause",
diff --git a/src/i18n/messages/ja.json b/src/i18n/messages/ja.json
index d2ced7f9b..d657d14d7 100644
--- a/src/i18n/messages/ja.json
+++ b/src/i18n/messages/ja.json
@@ -2455,6 +2455,8 @@
           "remaining": "残り",
           "elapsed": "経過時間",
           "tokens": "tokens",
+          "pause": "一時停止",
+          "clear": "クリア",
           "status": {
             "active": "実行中",
             "paused": "一時停止",
diff --git a/src/i18n/messages/ko.json b/src/i18n/messages/ko.json
index d23c2d9e7..4241c3a16 100644
--- a/src/i18n/messages/ko.json
+++ b/src/i18n/messages/ko.json
@@ -2455,6 +2455,8 @@
           "remaining": "남음",
           "elapsed": "경과",
           "tokens": "tokens",
+          "pause": "일시정지",
+          "clear": "지우기",
           "status": {
             "active": "진행 중",
             "paused": "일시 중지",
diff --git a/src/i18n/messages/pt.json b/src/i18n/messages/pt.json
index 661896a3b..fe7cce905 100644
--- a/src/i18n/messages/pt.json
+++ b/src/i18n/messages/pt.json
@@ -2455,6 +2455,8 @@
           "remaining": "Restante",
           "elapsed": "Decorrido",
           "tokens": "tokens",
+          "pause": "Pausar",
+          "clear": "Limpar",
           "status": {
             "active": "ativo",
             "paused": "pausado",
diff --git a/src/i18n/messages/zh-CN.json b/src/i18n/messages/zh-CN.json
index 01c93960d..d97c7ae71 100644
--- a/src/i18n/messages/zh-CN.json
+++ b/src/i18n/messages/zh-CN.json
@@ -2455,6 +2455,8 @@
           "remaining": "剩余",
           "elapsed": "耗时",
           "tokens": "tokens",
+          "pause": "暂停",
+          "clear": "清除",
           "status": {
             "active": "进行中",
             "paused": "已暂停",
diff --git a/src/i18n/messages/zh-TW.json b/src/i18n/messages/zh-TW.json
index aaf9aa1fa..b15b1012b 100644
--- a/src/i18n/messages/zh-TW.json
+++ b/src/i18n/messages/zh-TW.json
@@ -2455,6 +2455,8 @@
           "remaining": "剩餘",
           "elapsed": "耗時",
           "tokens": "tokens",
+          "pause": "暫停",
+          "clear": "清除",
           "status": {
             "active": "進行中",
             "paused": "已暫停",
diff --git a/src/lib/api.ts b/src/lib/api.ts
index 88443b1bf..9b4583bc0 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -208,6 +208,16 @@ export async function acpSetConfigOption(
   })
 }
 
+/** Pause or clear the session's active Codex goal (codex-acp #293). The backend
+ *  sources the sessionId from the live session, so only the connection + action
+ *  are needed here. */
+export async function acpGoalControl(
+  connectionId: string,
+  action: "pause" | "clear"
+): Promise<void> {
+  return getTransport().call("acp_goal_control", { connectionId, action })
+}
+
 export async function acpCancel(connectionId: string): Promise<void> {
   return getTransport().call("acp_cancel", { connectionId })
 }

From c362a7c7f31aa51fee806c36d4c0f39e135a91c1 Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Thu, 16 Jul 2026 14:57:08 +0800
Subject: [PATCH 05/15] fix(codex): render a bodyless sub-agent capsule as a
 bare pill
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AgentCapsule always drew a bordered, scrollable body frame below the pill, so a
capsule whose conditional children were all absent rendered an empty "white
box". The newer codex triggers this on every wait_agent — its wait returns no
per-agent result, leaving the collab wait capsule with nothing to show.

Detect an empty body with Children.toArray (which drops the false/null entries
of the callers' conditional children) and, when there's nothing to show, render
just a bare, non-interactive pill — no chevron, no frame. Fixes the long-standing
sub-agent white box for both the live collab card and the history Agent capsule.
---
 src/components/message/agent-capsule.tsx      | 84 ++++++++++++-------
 .../message/collab-agent-card.test.tsx        | 17 ++++
 2 files changed, 72 insertions(+), 29 deletions(-)

diff --git a/src/components/message/agent-capsule.tsx b/src/components/message/agent-capsule.tsx
index 0e4fec71a..73d80ef53 100644
--- a/src/components/message/agent-capsule.tsx
+++ b/src/components/message/agent-capsule.tsx
@@ -10,7 +10,7 @@
  * data it actually has.
  */
 
-import { useState, type ReactNode } from "react"
+import { Children, useState, type ReactNode } from "react"
 import { ChevronRightIcon } from "lucide-react"
 
 import { Shimmer } from "@/components/ai-elements/shimmer"
@@ -52,6 +52,14 @@ export function AgentCapsule({
   defaultOpen,
   children,
 }: AgentCapsuleProps) {
+  // Whether there's any real body content. `Children.toArray` flattens the
+  // caller's conditional children (`{cond && <…/>}`, `.map(a => … ? <…/> : null)`)
+  // and drops the `false`/`null` entries, so an all-absent body yields length 0.
+  // A bodyless capsule then renders as a bare pill rather than an empty bordered
+  // frame — the long-standing sub-agent "white box", which the newer codex now
+  // triggers on every `wait_agent` (its wait carries no per-agent result).
+  const hasBody = Children.toArray(children).length > 0
+
   const [bodyOpen, setBodyOpen] = useState(defaultOpen ?? isError)
 
   // Respond to prop transitions with the canonical React tracked-previous-state
@@ -76,16 +84,15 @@ export function AgentCapsule({
     }
   }
 
-  return (
-    <Collapsible open={bodyOpen} onOpenChange={setBodyOpen} className="w-full">
-      {/* Pill trigger — matches ToolGroupPart structure with themed emphasis. */}
-      <CollapsibleTrigger
-        className={cn(
-          "group inline-flex max-w-full items-center gap-1.5 rounded-full bg-primary/10 px-3.5 py-2 text-xs font-medium text-foreground transition-colors hover:bg-primary/15",
-          isError && "text-destructive"
-        )}
-        aria-label={statusLabel}
-      >
+  const pillClass = cn(
+    "group inline-flex max-w-full items-center gap-1.5 rounded-full bg-primary/10 px-3.5 py-2 text-xs font-medium text-foreground transition-colors",
+    hasBody && "hover:bg-primary/15",
+    isError && "text-destructive"
+  )
+
+  const pillInner = (
+    <>
+      {hasBody && (
         <ChevronRightIcon
           aria-hidden="true"
           className={cn(
@@ -93,25 +100,44 @@ export function AgentCapsule({
             bodyOpen && "rotate-90"
           )}
         />
-        <span className="min-w-0 truncate">
-          {isRunning ? (
-            <Shimmer as="span" duration={1} shineColor="var(--primary)">
-              {title}
-            </Shimmer>
-          ) : (
-            title
-          )}
-        </span>
-        {idBadge != null && (
-          <span className="shrink-0 font-mono text-[10px] font-normal text-muted-foreground/70">
-            {idBadge}
-          </span>
-        )}
-        {rightSuffix != null && (
-          <span className="flex shrink-0 items-center text-muted-foreground/60">
-            {rightSuffix}
-          </span>
+      )}
+      <span className="min-w-0 truncate">
+        {isRunning ? (
+          <Shimmer as="span" duration={1} shineColor="var(--primary)">
+            {title}
+          </Shimmer>
+        ) : (
+          title
         )}
+      </span>
+      {idBadge != null && (
+        <span className="shrink-0 font-mono text-[10px] font-normal text-muted-foreground/70">
+          {idBadge}
+        </span>
+      )}
+      {rightSuffix != null && (
+        <span className="flex shrink-0 items-center text-muted-foreground/60">
+          {rightSuffix}
+        </span>
+      )}
+    </>
+  )
+
+  // Nothing to expand → a bare, non-interactive pill (no chevron, no bordered
+  // frame). This is the fix for the empty sub-agent "white box".
+  if (!hasBody) {
+    return (
+      <div className={pillClass} aria-label={statusLabel}>
+        {pillInner}
+      </div>
+    )
+  }
+
+  return (
+    <Collapsible open={bodyOpen} onOpenChange={setBodyOpen} className="w-full">
+      {/* Pill trigger — matches ToolGroupPart structure with themed emphasis. */}
+      <CollapsibleTrigger className={pillClass} aria-label={statusLabel}>
+        {pillInner}
       </CollapsibleTrigger>
 
       {/* Body — sits below the pill. Internal sections retain their own affordances. */}
diff --git a/src/components/message/collab-agent-card.test.tsx b/src/components/message/collab-agent-card.test.tsx
index 7bebdeaaf..7f5443a96 100644
--- a/src/components/message/collab-agent-card.test.tsx
+++ b/src/components/message/collab-agent-card.test.tsx
@@ -114,6 +114,23 @@ describe("CollabAgentCard", () => {
     expect(screen.getByText("22220000")).toBeInTheDocument()
   })
 
+  it("renders a resultless wait as a bare pill, not an empty box", () => {
+    // Newer codex `wait_agent` returns no per-agent message, so the capsule has
+    // nothing to show. It must render as a bare, non-expandable pill — NOT an
+    // empty bordered body frame (the sub-agent "white box" bug).
+    renderCard({
+      input: collabInput({
+        op: "wait",
+        status: "completed",
+        agents: { "22220000-bbbb": { status: "completed", message: null } },
+      }),
+      state: "output-available",
+    })
+    expect(screen.getByText("Fetching sub-agent result")).toBeInTheDocument()
+    // No collapsible trigger → bodyless capsule is a bare pill, not a button.
+    expect(screen.queryByRole("button")).not.toBeInTheDocument()
+  })
+
   it("op-aware titles survive snake_case op spellings", () => {
     renderCard({
       input: collabInput({

From a3607a24ada0749bb098d191bae5dc61e901c6ff Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Fri, 24 Jul 2026 15:09:40 +0800
Subject: [PATCH 06/15] feat(sidebar): hide completed sessions by default,
 import as pending review

The "Show completed" view toggle now defaults to off, so finished conversations are hidden until the user enables it. Imported local sessions are created with pending-review status instead of completed, keeping them visible under the new default and flagged for review.
---
 src-tauri/src/db/service/import_service.rs | 27 +++++++++++++++++++++-
 src/components/layout/sidebar.test.tsx     | 10 ++++----
 src/components/layout/sidebar.tsx          |  9 ++++----
 src/lib/sidebar-view-mode-storage.ts       |  9 ++++----
 4 files changed, 41 insertions(+), 14 deletions(-)

diff --git a/src-tauri/src/db/service/import_service.rs b/src-tauri/src/db/service/import_service.rs
index 476f751f6..7a7de8725 100644
--- a/src-tauri/src/db/service/import_service.rs
+++ b/src-tauri/src/db/service/import_service.rs
@@ -288,7 +288,10 @@ async fn import_one(
         title: Set(summary.title.clone()),
         title_locked: Set(false),
         agent_type: Set(at_str),
-        status: Set(conversation::ConversationStatus::Completed),
+        // Imported sessions land as `PendingReview` ("待审查"), not `Completed`:
+        // they are surfaced for the user to review and stay visible even when
+        // the sidebar's "show completed" filter is off (now its default).
+        status: Set(conversation::ConversationStatus::PendingReview),
         // Imports scan regular folders' session files; chat scratch dirs and
         // loop runs are never import targets, so every imported row is regular.
         kind: Set(conversation::ConversationKind::Regular),
@@ -368,6 +371,28 @@ mod tests {
         assert!(!got.title_locked, "auto refresh must not lock the title");
     }
 
+    #[tokio::test]
+    async fn import_inserts_a_pending_review_conversation() {
+        let db = fresh_in_memory_db().await;
+        let folder = seed_folder(&db, "/tmp/codeg-import-status").await;
+        let at = AgentType::ClaudeCode;
+
+        assert_eq!(
+            import_one(&db.conn, folder, &at, &summary("ext-1", Some("first prompt")))
+                .await
+                .expect("import"),
+            ImportOutcome::Imported
+        );
+
+        let id = find_id(&db.conn, "ext-1").await;
+        let got = conversation_service::get_by_id(&db.conn, id)
+            .await
+            .expect("get");
+        // Imported rows are surfaced for review, not marked done — so they stay
+        // visible even when the sidebar hides completed conversations.
+        assert_eq!(got.status, conversation::ConversationStatus::PendingReview);
+    }
+
     #[tokio::test]
     async fn reimport_skips_an_unchanged_title() {
         let db = fresh_in_memory_db().await;
diff --git a/src/components/layout/sidebar.test.tsx b/src/components/layout/sidebar.test.tsx
index 1c7be4fa4..528820e79 100644
--- a/src/components/layout/sidebar.test.tsx
+++ b/src/components/layout/sidebar.test.tsx
@@ -185,14 +185,14 @@ describe("Sidebar — Show completed default", () => {
     mockState.activeFolder = { id: 7, path: "/x" }
   })
 
-  it("defaults Show completed on and threads it to the conversation list", () => {
+  it("defaults Show completed off and threads it to the conversation list", () => {
     renderSidebar()
-    expect(spies.listProps?.showCompleted).toBe(true)
+    expect(spies.listProps?.showCompleted).toBe(false)
   })
 
-  it("respects an explicitly-stored 'false' from localStorage", () => {
-    localStorage.setItem("workspace:sidebar-show-completed", "false")
+  it("respects an explicitly-stored 'true' from localStorage", () => {
+    localStorage.setItem("workspace:sidebar-show-completed", "true")
     renderSidebar()
-    expect(spies.listProps?.showCompleted).toBe(false)
+    expect(spies.listProps?.showCompleted).toBe(true)
   })
 })
diff --git a/src/components/layout/sidebar.tsx b/src/components/layout/sidebar.tsx
index 52aa8edff..ed47d2533 100644
--- a/src/components/layout/sidebar.tsx
+++ b/src/components/layout/sidebar.tsx
@@ -132,10 +132,11 @@ export function Sidebar() {
   // rem-sized overlay buttons. Mobile has no overlay (the sidebar is a Sheet).
   const leftReserve = leftChromeReserve(platformIsMac && isDesktop(), zoomLevel)
 
-  // Both default ON (the mount effect below reconciles a persisted "false").
-  // The initial value matches that default so the pre-hydration render doesn't
-  // flash from off → on.
-  const [showCompleted, setShowCompleted] = useState(true)
+  // `showCompleted` defaults OFF and `showWorktrees` defaults ON (the mount
+  // effect below reconciles a persisted override). Each initial value matches
+  // its own default so the pre-hydration render doesn't flash as the stored
+  // preference is applied.
+  const [showCompleted, setShowCompleted] = useState(false)
   const [showWorktrees, setShowWorktrees] = useState(true)
   const [sortMode, setSortMode] = useState<SidebarSortMode>("created")
   const [sectionOrder, setSectionOrder] =
diff --git a/src/lib/sidebar-view-mode-storage.ts b/src/lib/sidebar-view-mode-storage.ts
index 40195110a..582079025 100644
--- a/src/lib/sidebar-view-mode-storage.ts
+++ b/src/lib/sidebar-view-mode-storage.ts
@@ -83,17 +83,18 @@ export function saveConversationExpanded(ids: number[]): void {
 }
 
 /** Whether completed conversations are shown in the sidebar list. Defaults to
- *  ON; only an explicitly-stored "false" (the user unchecked it) hides them. */
+ *  OFF so finished/imported sessions stay out of the way; only an
+ *  explicitly-stored "true" (the user turned it on) reveals them. */
 export function loadShowCompleted(): boolean {
-  if (typeof window === "undefined") return true
+  if (typeof window === "undefined") return false
   try {
     const raw = localStorage.getItem(SHOW_COMPLETED_KEY)
-    if (raw === "false") return false
     if (raw === "true") return true
+    if (raw === "false") return false
   } catch {
     /* ignore */
   }
-  return true
+  return false
 }
 
 export function saveShowCompleted(value: boolean): void {

From 47822d6fc0fa0862620057fbcb5155ac873c7741 Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Fri, 24 Jul 2026 16:28:03 +0800
Subject: [PATCH 07/15] feat(layout): rank branch selector search results by
 relevance, exact matches first

---
 src/lib/branch-selector-rows.test.ts | 85 ++++++++++++++++++++++++-
 src/lib/branch-selector-rows.ts      | 92 +++++++++++++++++++++++-----
 2 files changed, 160 insertions(+), 17 deletions(-)

diff --git a/src/lib/branch-selector-rows.test.ts b/src/lib/branch-selector-rows.test.ts
index a09b9ed2a..54bab5ac3 100644
--- a/src/lib/branch-selector-rows.test.ts
+++ b/src/lib/branch-selector-rows.test.ts
@@ -226,7 +226,9 @@ describe("buildBranchRows — search mode", () => {
     const rows = buildBranchRows(
       baseInput({ localNodes: localTree(LOCAL), localCount: 4, query: "e" })
     )
-    // "Pull code" matches "e"; "Push..." does not. "main" has no "e".
+    // "Pull code" matches "e"; "Push..." does not. "main" has no "e". All three
+    // branch hits are equal-tier substrings at the same position, so they keep a
+    // stable alphabetical order.
     expect(rows.map(summarize)).toEqual([
       "op:pull",
       "sep",
@@ -238,6 +240,87 @@ describe("buildBranchRows — search mode", () => {
   })
 })
 
+describe("buildBranchRows — search relevance ranking", () => {
+  it("orders exact > prefix > segment-boundary > substring", () => {
+    const rows = buildBranchRows(
+      baseInput({
+        // domain: mid-string "main"; maintenance: prefix; feature/main:
+        // "/"-segment boundary; main: exact.
+        localNodes: localTree([
+          "domain",
+          "maintenance",
+          "feature/main",
+          "main",
+        ]),
+        localCount: 4,
+        query: "main",
+      })
+    )
+    expect(rows.map(summarize)).toEqual([
+      "section:local(4)+",
+      "leaf:main@1",
+      "leaf:maintenance@1",
+      "leaf:feature/main@1",
+      "leaf:domain@1",
+    ])
+  })
+
+  it("ranks a prefix hit above a substring hit regardless of render order", () => {
+    const rows = buildBranchRows(
+      baseInput({
+        // Alphabetically "prerelease" (substring) sorts before "release/api"
+        // (prefix); relevance ranking must flip them.
+        localNodes: localTree(["prerelease", "release/api"]),
+        localCount: 2,
+        query: "release",
+      })
+    )
+    expect(rows.map(summarize)).toEqual([
+      "section:local(2)+",
+      "leaf:release/api@1",
+      "leaf:prerelease@1",
+    ])
+  })
+
+  it("breaks equal-tier ties alphabetically by full ref", () => {
+    const rows = buildBranchRows(
+      baseInput({
+        localNodes: localTree(["feature/beta", "feature/alpha"]),
+        localCount: 2,
+        query: "feature",
+      })
+    )
+    expect(rows.map(summarize)).toEqual([
+      "section:local(2)+",
+      "leaf:feature/alpha@1",
+      "leaf:feature/beta@1",
+    ])
+  })
+
+  it("scores the collapsed leaf label, so an exact label hit ranks first", () => {
+    const remoteSections = buildRemoteBranchSections([
+      "origin/main-old",
+      "origin/main",
+    ])
+    const rows = buildBranchRows(
+      baseInput({
+        operations: [],
+        remoteSections,
+        remoteCount: 2,
+        query: "main",
+      })
+    )
+    // Both refs contain "main", but "origin/main"'s display label is exactly
+    // "main" (exact) while "main-old" is only a prefix. In search mode an empty
+    // local side emits no section, so the remote section leads.
+    expect(rows.map(summarize)).toEqual([
+      "section:remote(2)+",
+      "leaf:origin/main@1",
+      "leaf:origin/main-old@1",
+    ])
+  })
+})
+
 describe("buildBranchRows — multiple remotes", () => {
   it("nests each remote as a wrapper group one level deeper", () => {
     const remoteSections = buildRemoteBranchSections([
diff --git a/src/lib/branch-selector-rows.ts b/src/lib/branch-selector-rows.ts
index 51ae02f83..39020c1f3 100644
--- a/src/lib/branch-selector-rows.ts
+++ b/src/lib/branch-selector-rows.ts
@@ -178,11 +178,70 @@ function collectLeaves(nodes: BranchTreeNode[]): BranchTreeLeaf[] {
   return leaves
 }
 
-function matchesLeaf(leaf: BranchTreeLeaf, q: string): boolean {
-  return (
-    leaf.fullName.toLowerCase().includes(q) ||
-    leaf.label.toLowerCase().includes(q)
-  )
+// How strongly a text matches the query, higher = stronger. This is the "match
+// degree" the search results sort by: an exact hit outranks a prefix hit, a
+// prefix outranks a match that begins right after a "/" segment boundary, and
+// those all outrank a plain mid-string substring hit.
+const MATCH_NONE = 0
+const MATCH_SUBSTRING = 1
+const MATCH_SEGMENT = 2
+const MATCH_PREFIX = 3
+const MATCH_EXACT = 4
+
+interface MatchRank {
+  /** One of the MATCH_* tiers; MATCH_NONE means the query isn't present. */
+  tier: number
+  /** Index of the first hit in the text (earlier = better); -1 when absent. */
+  index: number
+}
+
+/** Rank a single already-lowercased query `q` against `text`. */
+function scoreText(text: string, q: string): MatchRank {
+  const lower = text.toLowerCase()
+  const index = lower.indexOf(q)
+  if (index === -1) return { tier: MATCH_NONE, index }
+  let tier: number
+  if (lower === q) tier = MATCH_EXACT
+  else if (index === 0) tier = MATCH_PREFIX
+  else if (lower[index - 1] === "/") tier = MATCH_SEGMENT
+  else tier = MATCH_SUBSTRING
+  return { tier, index }
+}
+
+/**
+ * Best rank of a leaf, scoring both its full ref AND its (possibly collapsed)
+ * display label and keeping the stronger — so searching "login" treats a leaf
+ * whose visible label is exactly "login" as an exact hit even though its full
+ * ref is "feature/auth/login".
+ */
+function rankLeaf(leaf: BranchTreeLeaf, q: string): MatchRank {
+  const full = scoreText(leaf.fullName, q)
+  const label = scoreText(leaf.label, q)
+  if (full.tier !== label.tier) return full.tier > label.tier ? full : label
+  // Same tier: prefer the earlier hit position.
+  return full.index <= label.index ? full : label
+}
+
+/**
+ * Keep the leaves matching `q`, ordered by relevance: exact hits first, then
+ * prefix, then segment-boundary, then substring; within a tier, an earlier
+ * match position wins, then the ref name breaks ties for a stable order.
+ */
+function matchAndRankLeaves(
+  leaves: BranchTreeLeaf[],
+  q: string
+): BranchTreeLeaf[] {
+  return leaves
+    .map((leaf) => ({ leaf, rank: rankLeaf(leaf, q) }))
+    .filter((entry) => entry.rank.tier > MATCH_NONE)
+    .sort((a, b) => {
+      if (a.rank.tier !== b.rank.tier) return b.rank.tier - a.rank.tier
+      if (a.rank.index !== b.rank.index) return a.rank.index - b.rank.index
+      return a.leaf.fullName.localeCompare(b.leaf.fullName, undefined, {
+        sensitivity: "base",
+      })
+    })
+    .map((entry) => entry.leaf)
 }
 
 /**
@@ -192,8 +251,10 @@ function matchesLeaf(leaf: BranchTreeLeaf, q: string): boolean {
  *   descending only expanded groups) → Remote section (single-remote strips the
  *   wrapper; multi-remote nests each remote as a group). Sections default open.
  * - Non-empty query: operations whose label matches → separator → matched local
- *   leaves and matched remote leaves, flat under their section headers (groups
- *   dropped, collapse state ignored); empty sections omitted.
+ *   leaves then matched remote leaves, flat under their section headers and
+ *   ranked by relevance (exact > prefix > "/"-segment boundary > substring, ties
+ *   broken by earlier match position then name); groups dropped, collapse state
+ *   ignored, empty sections omitted.
  *
  * Indentation depth: operations flat; a section header is depth 0; its children
  * are depth 1 (and deeper per nesting).
@@ -243,9 +304,7 @@ export function buildBranchRows(input: BuildBranchRowsInput): BranchRow[] {
   const branchRows: BranchRow[] = []
 
   if (searching) {
-    const localMatches = collectLeaves(localNodes).filter((l) =>
-      matchesLeaf(l, q)
-    )
+    const localMatches = matchAndRankLeaves(collectLeaves(localNodes), q)
     if (localMatches.length > 0) {
       branchRows.push({
         kind: "section",
@@ -257,12 +316,13 @@ export function buildBranchRows(input: BuildBranchRowsInput): BranchRow[] {
       for (const leaf of localMatches) emitLeaf(branchRows, leaf, 1, false, ctx)
     }
 
-    const remoteMatches: BranchTreeLeaf[] = []
-    for (const section of remoteSections) {
-      for (const leaf of collectLeaves(section.nodes)) {
-        if (matchesLeaf(leaf, q)) remoteMatches.push(leaf)
-      }
-    }
+    // Rank every remote's leaves together so a strong hit under the second
+    // remote still outranks a weak hit under the first (the per-remote wrapper
+    // groups are already dropped in search mode, so the list is flat anyway).
+    const remoteMatches = matchAndRankLeaves(
+      remoteSections.flatMap((section) => collectLeaves(section.nodes)),
+      q
+    )
     if (remoteMatches.length > 0) {
       branchRows.push({
         kind: "section",

From ec3df83fff5a81ad075807ff40e560fd1ef2aaae Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Fri, 24 Jul 2026 18:10:42 +0800
Subject: [PATCH 08/15] feat(settings): add Claude Code toggles for attribution
 header and telemetry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add two switches below the reasoning settings on the Claude Code config
page that control native config env vars in ~/.claude/settings.json:

- Send attribution/billing identifier to the API
  (CLAUDE_CODE_ATTRIBUTION_HEADER) — default off
- Disable telemetry or redundant network requests
  (CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC) — default on

Each toggle writes an explicit value to both the native config env and the
DB env overlay, and the defaults are materialized on save. Labels are
localized across all supported locales.
---
 .../settings/acp-agent-settings.test.tsx      | 159 +++++++++
 .../settings/acp-agent-settings.tsx           | 314 ++++++++++++++++--
 src/i18n/messages/ar.json                     |   6 +-
 src/i18n/messages/de.json                     |   6 +-
 src/i18n/messages/en.json                     |   6 +-
 src/i18n/messages/es.json                     |   6 +-
 src/i18n/messages/fr.json                     |   6 +-
 src/i18n/messages/ja.json                     |   6 +-
 src/i18n/messages/ko.json                     |   6 +-
 src/i18n/messages/pt.json                     |   6 +-
 src/i18n/messages/zh-CN.json                  |   6 +-
 src/i18n/messages/zh-TW.json                  |   6 +-
 12 files changed, 496 insertions(+), 37 deletions(-)

diff --git a/src/components/settings/acp-agent-settings.test.tsx b/src/components/settings/acp-agent-settings.test.tsx
index e07050e53..264cbc799 100644
--- a/src/components/settings/acp-agent-settings.test.tsx
+++ b/src/components/settings/acp-agent-settings.test.tsx
@@ -4,11 +4,14 @@ import {
   applyClaudeProviderToConfigText,
   buildGrokSaveOptions,
   buildGrokStructuredConfig,
+  buildMergeConfigPayload,
   buildVersionCheck,
   configTextForClaudeSave,
   getAgentChecks,
   inferGrokMode,
+  materializeClaudeHardeningFlags,
   patchImportantConfigText,
+  setClaudeEnvFlagInConfigText,
 } from "./acp-agent-settings"
 import type { AcpAgentInfo, AgentType, PreflightResult } from "@/lib/types"
 
@@ -572,6 +575,25 @@ describe("applyClaudeProviderToConfigText — provider-bound stale config", () =
     expect(env.ANTHROPIC_CUSTOM_MODEL_OPTION_NAME).toBe("GW Opus")
     expect(env.ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION).toBe("via gateway")
   })
+
+  // The hardening toggles are not provider-controlled, so a provider-authoritative
+  // rewrite must leave them intact while it overwrites the model keys.
+  it("preserves a hardening env flag through the provider rewrite", () => {
+    const withFlag = JSON.stringify({
+      env: {
+        CLAUDE_CODE_ATTRIBUTION_HEADER: "0",
+        ANTHROPIC_MODEL: "old-main",
+      },
+    })
+    const next = applyClaudeProviderToConfigText(withFlag, {
+      api_url: "https://gw.example/v1",
+      api_key: "sk-x",
+      model: JSON.stringify({ main: "prov-main" }),
+    })
+    const env = envOf(next)
+    expect(env.CLAUDE_CODE_ATTRIBUTION_HEADER).toBe("0")
+    expect(env.ANTHROPIC_MODEL).toBe("prov-main")
+  })
 })
 
 describe("configTextForClaudeSave — bound-Claude save payload", () => {
@@ -623,3 +645,140 @@ describe("configTextForClaudeSave — bound-Claude save payload", () => {
     ).toBe(cfg)
   })
 })
+
+describe("setClaudeEnvFlagInConfigText — Claude hardening toggles", () => {
+  const KEY = "CLAUDE_CODE_ATTRIBUTION_HEADER"
+
+  function envOf(configText: string): Record<string, string> {
+    const parsed = JSON.parse(configText) as { env?: Record<string, string> }
+    return parsed.env ?? {}
+  }
+
+  it("sets the flag value while preserving other env + root keys", () => {
+    const base = JSON.stringify({
+      model: "opus",
+      env: { ANTHROPIC_BASE_URL: "https://gw" },
+    })
+    const next = setClaudeEnvFlagInConfigText(base, KEY, "1")
+    expect(next.recoveredFromInvalid).toBe(false)
+    const parsed = JSON.parse(next.configText) as {
+      model?: string
+      env?: Record<string, string>
+    }
+    expect(parsed.model).toBe("opus")
+    expect(parsed.env?.[KEY]).toBe("1")
+    expect(parsed.env?.ANTHROPIC_BASE_URL).toBe("https://gw")
+  })
+
+  it("creates the env when the config has none", () => {
+    const next = setClaudeEnvFlagInConfigText("", KEY, "0")
+    expect(next.recoveredFromInvalid).toBe(false)
+    expect(envOf(next.configText)[KEY]).toBe("0")
+  })
+
+  it("overwrites an existing value (off → on) and keeps siblings", () => {
+    const base = JSON.stringify({
+      env: { [KEY]: "0", ANTHROPIC_MODEL: "keep" },
+    })
+    const next = setClaudeEnvFlagInConfigText(base, KEY, "1")
+    const env = envOf(next.configText)
+    expect(env[KEY]).toBe("1")
+    expect(env.ANTHROPIC_MODEL).toBe("keep")
+  })
+
+  it("recovers from invalid JSON and writes a fresh config", () => {
+    const next = setClaudeEnvFlagInConfigText("{ not json", KEY, "1")
+    expect(next.recoveredFromInvalid).toBe(true)
+    expect(envOf(next.configText)[KEY]).toBe("1")
+  })
+})
+
+describe("buildMergeConfigPayload — merge-strategy save diff", () => {
+  const KEY = "CLAUDE_CODE_ATTRIBUTION_HEADER"
+
+  // Toggling off the only flag empties configText; the diff against the original
+  // must still emit env: null so the backend merge deletes it from disk.
+  it("nulls a removed env key when the config emptied out", () => {
+    const original = JSON.stringify({ env: { [KEY]: "0" } })
+    const payload = buildMergeConfigPayload("", original)
+    expect(payload).not.toBeNull()
+    expect(JSON.parse(payload as string)).toEqual({ env: null })
+  })
+
+  it("returns null when both current and original are empty", () => {
+    expect(buildMergeConfigPayload("", null)).toBeNull()
+    expect(buildMergeConfigPayload("", "")).toBeNull()
+  })
+
+  it("nulls only the removed key when siblings remain", () => {
+    const original = JSON.stringify({ env: { [KEY]: "0", OTHER: "x" } })
+    const current = JSON.stringify({ env: { OTHER: "x" } })
+    const payload = buildMergeConfigPayload(current, original)
+    expect(JSON.parse(payload as string)).toEqual({
+      env: { OTHER: "x", [KEY]: null },
+    })
+  })
+
+  it("passes a fresh config through with no null patches", () => {
+    const current = JSON.stringify({ env: { [KEY]: "0" } })
+    const payload = buildMergeConfigPayload(current, null)
+    expect(JSON.parse(payload as string)).toEqual({ env: { [KEY]: "0" } })
+  })
+})
+
+describe("materializeClaudeHardeningFlags — save-time toggle defaults", () => {
+  const ATTR = "CLAUDE_CODE_ATTRIBUTION_HEADER"
+  const TRAFFIC = "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"
+
+  function envOf(configText: string): Record<string, string> {
+    const parsed = JSON.parse(configText) as { env?: Record<string, string> }
+    return parsed.env ?? {}
+  }
+
+  // Fresh config + the intended defaults: don't send the header ("0"), disable
+  // telemetry ("1") — written into BOTH the native config env and envText.
+  it("writes both flags per the defaults into config env and envText", () => {
+    const { configText, envText } = materializeClaudeHardeningFlags("", "", {
+      sendAttributionHeader: false,
+      disableNonessentialTraffic: true,
+    })
+    const env = envOf(configText)
+    expect(env[ATTR]).toBe("0")
+    expect(env[TRAFFIC]).toBe("1")
+    expect(envText).toContain(`${ATTR}=0`)
+    expect(envText).toContain(`${TRAFFIC}=1`)
+  })
+
+  it("writes both on when both toggles are enabled, preserving other keys", () => {
+    const base = JSON.stringify({ model: "opus", env: { KEEP: "y" } })
+    const { configText, envText } = materializeClaudeHardeningFlags(
+      base,
+      "KEEP=y",
+      { sendAttributionHeader: true, disableNonessentialTraffic: true }
+    )
+    const parsed = JSON.parse(configText) as {
+      model?: string
+      env?: Record<string, string>
+    }
+    expect(parsed.model).toBe("opus")
+    expect(parsed.env?.[ATTR]).toBe("1")
+    expect(parsed.env?.[TRAFFIC]).toBe("1")
+    expect(parsed.env?.KEEP).toBe("y")
+    expect(envText).toContain("KEEP=y")
+    expect(envText).toContain(`${ATTR}=1`)
+  })
+
+  // Regression: invalid JSON must be returned UNCHANGED (never recovered to a
+  // minimal {env}), so persistConfig rejects it instead of the merge diff
+  // deleting every other on-disk key.
+  it("leaves invalid config JSON untouched (no recovery, no data loss)", () => {
+    const invalid = "{ not valid json"
+    const { configText, envText } = materializeClaudeHardeningFlags(
+      invalid,
+      "EXISTING=1",
+      { sendAttributionHeader: false, disableNonessentialTraffic: true }
+    )
+    expect(configText).toBe(invalid)
+    expect(envText).toBe("EXISTING=1")
+  })
+})
diff --git a/src/components/settings/acp-agent-settings.tsx b/src/components/settings/acp-agent-settings.tsx
index a268b1bb7..ce29468b0 100644
--- a/src/components/settings/acp-agent-settings.tsx
+++ b/src/components/settings/acp-agent-settings.tsx
@@ -184,6 +184,12 @@ interface AgentDraft {
   claudeCustomModelOptionName: string
   claudeCustomModelOptionDescription: string
   claudeEffortLevel: ClaudeEffortLevel
+  // Claude Code hardening toggles (native config `env`). `claudeSendAttributionHeader`
+  // → CLAUDE_CODE_ATTRIBUTION_HEADER (on="1"/off="0"), default off (don't send).
+  // `claudeDisableNonessentialTraffic` → CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC,
+  // default on (disabled).
+  claudeSendAttributionHeader: boolean
+  claudeDisableNonessentialTraffic: boolean
   codexAuthJsonText: string
   codexConfigTomlText: string
   /** Structured codex custom-model list (mirrors the catalog source sidecar).
@@ -346,6 +352,22 @@ const CLAUDE_MODEL_ENV_KEYS = {
     "ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION",
 } as const
 
+// Claude Code hardening flags surfaced as toggles below the reasoning settings.
+// Each maps to a boolean env var in the native config's `env` (on = "1", off =
+// "0"). Because Claude Code's own defaults are the opposite of what we want, the
+// toggle values are materialized on save (see the config-save handler) so the
+// shown default positions are actually applied — not left implicit/absent.
+const CLAUDE_ATTRIBUTION_HEADER_ENV_KEY = "CLAUDE_CODE_ATTRIBUTION_HEADER"
+const CLAUDE_NONESSENTIAL_TRAFFIC_ENV_KEY =
+  "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"
+const CLAUDE_ENV_FLAG_ON = "1"
+const CLAUDE_ENV_FLAG_OFF = "0"
+// `CLAUDE_CODE_ATTRIBUTION_HEADER` = "send the attribution/billing header" →
+// default OFF (don't send). `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` = "disable
+// telemetry / redundant pings" → default ON (disabled).
+const CLAUDE_SEND_ATTRIBUTION_HEADER_DEFAULT = false
+const CLAUDE_DISABLE_NONESSENTIAL_TRAFFIC_DEFAULT = true
+
 const CLAUDE_EFFORT_LEVEL_CONFIG_KEY = "effortLevel"
 
 type ClaudeEffortLevel = "" | "low" | "medium" | "high" | "xhigh"
@@ -666,6 +688,8 @@ function extractImportantConfigValues(
   claudeCustomModelOptionName: string
   claudeCustomModelOptionDescription: string
   claudeEffortLevel: ClaudeEffortLevel
+  claudeSendAttributionHeader: boolean
+  claudeDisableNonessentialTraffic: boolean
   configError: string | null
 } {
   const parseResult = parseConfigJsonText(configText)
@@ -714,6 +738,26 @@ function extractImportantConfigValues(
       ? normalizeClaudeEffortLevel(config[CLAUDE_EFFORT_LEVEL_CONFIG_KEY])
       : ""
 
+  // Present in env → on iff value is "1"; absent → the toggle's default.
+  const attributionRaw = findEnvValue(mergedEnv, [
+    CLAUDE_ATTRIBUTION_HEADER_ENV_KEY,
+  ])
+  const claudeSendAttributionHeader =
+    agentType === "claude_code"
+      ? attributionRaw
+        ? attributionRaw === CLAUDE_ENV_FLAG_ON
+        : CLAUDE_SEND_ATTRIBUTION_HEADER_DEFAULT
+      : false
+  const nonessentialRaw = findEnvValue(mergedEnv, [
+    CLAUDE_NONESSENTIAL_TRAFFIC_ENV_KEY,
+  ])
+  const claudeDisableNonessentialTraffic =
+    agentType === "claude_code"
+      ? nonessentialRaw
+        ? nonessentialRaw === CLAUDE_ENV_FLAG_ON
+        : CLAUDE_DISABLE_NONESSENTIAL_TRAFFIC_DEFAULT
+      : false
+
   return {
     apiBaseUrl: apiBaseUrl ?? "",
     apiKey: apiKey ?? "",
@@ -734,6 +778,8 @@ function extractImportantConfigValues(
     claudeCustomModelOptionDescription:
       agentType === "claude_code" ? claudeCustomModelOptionDescription : "",
     claudeEffortLevel,
+    claudeSendAttributionHeader,
+    claudeDisableNonessentialTraffic,
     configError: parseResult.error,
   }
 }
@@ -1123,6 +1169,36 @@ function markRemovedKeysNull(
   return result
 }
 
+/**
+ * Build the `config_json` payload for a merge-strategy agent save (Claude Code /
+ * Gemini / OpenClaw). Diffs the current config against the original so removed
+ * keys become explicit `null`s the backend merge deletes from disk — crucially
+ * even when the current config emptied to "" (e.g. the last env flag toggled
+ * off), which would otherwise serialize to a null `config_json` no-op and leave
+ * the stale key on disk. Returns `null` when both sides are empty (nothing to
+ * write, no empty file created). Pure — shared by `persistConfig` and tests.
+ */
+export function buildMergeConfigPayload(
+  currentConfigText: string,
+  originalConfigText: string | null | undefined
+): string | null {
+  const currentConfig = parseConfigJsonText(currentConfigText).config
+  const originalConfig = originalConfigText
+    ? parseConfigJsonText(originalConfigText).config
+    : {}
+  if (
+    Object.keys(currentConfig).length === 0 &&
+    Object.keys(originalConfig).length === 0
+  ) {
+    return null
+  }
+  return JSON.stringify(
+    markRemovedKeysNull(originalConfig, currentConfig),
+    null,
+    2
+  )
+}
+
 function normalizeConfigText(configText: string): string {
   const parseResult = parseConfigJsonText(configText)
   if (parseResult.error) return configText.trim()
@@ -2615,6 +2691,64 @@ export function configTextForClaudeSave(
   return configText
 }
 
+/**
+ * Set a Claude Code env flag to an explicit value inside the native config's
+ * `env` (creating `env` if needed), preserving all other keys. Used by the
+ * hardening toggles and their save-time materialization so the flag is always
+ * written explicitly ("1"/"0") rather than left implicit/absent. Pure — shared
+ * by the toggle handler, the save path, and tests.
+ */
+export function setClaudeEnvFlagInConfigText(
+  configText: string,
+  envKey: string,
+  value: string
+): { configText: string; recoveredFromInvalid: boolean } {
+  const parseResult = parseConfigJsonText(configText)
+  const config: Record<string, unknown> = parseResult.error
+    ? {}
+    : { ...parseResult.config }
+  const env =
+    typeof config.env === "object" && config.env && !Array.isArray(config.env)
+      ? { ...(config.env as Record<string, unknown>) }
+      : {}
+  env[envKey] = value
+  config.env = env
+  return {
+    configText: JSON.stringify(config, null, 2),
+    recoveredFromInvalid: Boolean(parseResult.error),
+  }
+}
+
+/**
+ * Materialize both Claude hardening toggles into the native config `env` AND the
+ * DB env overlay (envText), writing the explicit "1"/"0" per toggle so the shown
+ * default positions are actually applied on save. Returns the inputs UNCHANGED
+ * when `configText` is invalid JSON — never recover it here, or the caller's
+ * merge diff would treat the recovered minimal config as authoritative and
+ * delete every other on-disk key. Pure — shared by the save handler and tests.
+ */
+export function materializeClaudeHardeningFlags(
+  configText: string,
+  envText: string,
+  flags: { sendAttributionHeader: boolean; disableNonessentialTraffic: boolean }
+): { configText: string; envText: string } {
+  if (parseConfigJsonText(configText).error) {
+    return { configText, envText }
+  }
+  const entries: Array<[string, boolean]> = [
+    [CLAUDE_ATTRIBUTION_HEADER_ENV_KEY, flags.sendAttributionHeader],
+    [CLAUDE_NONESSENTIAL_TRAFFIC_ENV_KEY, flags.disableNonessentialTraffic],
+  ]
+  let nextConfig = configText
+  let nextEnv = envText
+  for (const [key, on] of entries) {
+    const value = on ? CLAUDE_ENV_FLAG_ON : CLAUDE_ENV_FLAG_OFF
+    nextConfig = setClaudeEnvFlagInConfigText(nextConfig, key, value).configText
+    nextEnv = patchEnvText(nextEnv, { [key]: value })
+  }
+  return { configText: nextConfig, envText: nextEnv }
+}
+
 function patchEnvByImportantKey(
   agentType: AgentType,
   envText: string,
@@ -2850,6 +2984,9 @@ function buildAgentDraft(agent: AcpAgentInfo): AgentDraft {
     claudeCustomModelOptionDescription:
       important.claudeCustomModelOptionDescription,
     claudeEffortLevel: important.claudeEffortLevel,
+    claudeSendAttributionHeader: important.claudeSendAttributionHeader,
+    claudeDisableNonessentialTraffic:
+      important.claudeDisableNonessentialTraffic,
     codexAuthJsonText,
     codexConfigTomlText,
     codexModelList: parseCodexModelConfig(agent.codex_model_catalog ?? null),
@@ -4344,17 +4481,13 @@ export function AcpAgentSettings() {
         agentType === "claude_code" ||
         agentType === "gemini" ||
         agentType === "open_claw"
-      if (usesMerge && configForPersist) {
+      if (usesMerge) {
         const originalAgent = agents.find((a) => a.agent_type === agentType)
-        const originalConfig = originalAgent?.config_json
-          ? parseConfigJsonText(originalAgent.config_json).config
-          : {}
-        const currentConfig = parsedConfig.config
-        configForPersist = JSON.stringify(
-          markRemovedKeysNull(originalConfig, currentConfig),
-          null,
-          2
-        )
+        // Diff even when the current config emptied to "" so removed keys still
+        // produce null-deletion patches (`configForPersist` would otherwise be
+        // "" → a null config_json no-op that leaves the stale key on disk).
+        configForPersist =
+          buildMergeConfigPayload(configText, originalAgent?.config_json) ?? ""
       }
       setSavingConfig((prev) => ({ ...prev, [agentType]: true }))
       try {
@@ -5263,6 +5396,9 @@ export function AcpAgentSettings() {
         claudeCustomModelOptionDescription:
           important.claudeCustomModelOptionDescription,
         claudeEffortLevel: important.claudeEffortLevel,
+        claudeSendAttributionHeader: important.claudeSendAttributionHeader,
+        claudeDisableNonessentialTraffic:
+          important.claudeDisableNonessentialTraffic,
       }))
     },
     [selectedAgent, selectedDraft, updateSelectedDraft]
@@ -5336,6 +5472,47 @@ export function AcpAgentSettings() {
     [selectedAgent, selectedDraft, t, updateSelectedDraft]
   )
 
+  // Toggle a Claude Code hardening flag: write the explicit "1"/"0" value into
+  // the native config's `env` (and the DB env overlay in lockstep).
+  const handleClaudeEnvFlagChange = useCallback(
+    (
+      field: "claudeSendAttributionHeader" | "claudeDisableNonessentialTraffic",
+      envKey: string,
+      enabled: boolean
+    ) => {
+      if (
+        !selectedAgent ||
+        !selectedDraft ||
+        selectedAgent.agent_type !== "claude_code"
+      )
+        return
+      const value = enabled ? CLAUDE_ENV_FLAG_ON : CLAUDE_ENV_FLAG_OFF
+      const next = setClaudeEnvFlagInConfigText(
+        selectedDraft.configText,
+        envKey,
+        value
+      )
+      if (next.recoveredFromInvalid) {
+        toast.warning(t("warnings.nativeJsonRecoveredStructured"))
+      }
+      setConfigErrors((prev) => ({
+        ...prev,
+        [selectedAgent.agent_type]: null,
+      }))
+      updateSelectedDraft((current) => ({
+        ...current,
+        [field]: enabled,
+        // The backend folds native `config.env` into `agent.env`, so keep the
+        // DB env overlay (envText) in lockstep — otherwise persistEnv would
+        // re-persist a stale value from the overlay. Mirrors
+        // handleImportantConfigChange's dual configText + envText write.
+        envText: patchEnvText(current.envText, { [envKey]: value }),
+        configText: next.configText,
+      }))
+    },
+    [selectedAgent, selectedDraft, t, updateSelectedDraft]
+  )
+
   const handleGrokAuthModeChange = useCallback(
     (nextMode: GrokAuthMethod) => {
       if (
@@ -10679,6 +10856,48 @@ supports_websockets = true`}
                             </SelectContent>
                           </Select>
                         </div>
+                        <div className="space-y-1.5">
+                          <div className="flex items-center justify-between rounded-md border px-3 py-2">
+                            <label className="text-[11px] text-muted-foreground">
+                              {t("claude.sendAttributionHeader")}
+                            </label>
+                            <Switch
+                              checked={
+                                selectedDraft.claudeSendAttributionHeader
+                              }
+                              onCheckedChange={(checked) => {
+                                handleClaudeEnvFlagChange(
+                                  "claudeSendAttributionHeader",
+                                  CLAUDE_ATTRIBUTION_HEADER_ENV_KEY,
+                                  checked
+                                )
+                              }}
+                              aria-label={t("claude.sendAttributionHeaderAria")}
+                            />
+                          </div>
+                        </div>
+                        <div className="space-y-1.5">
+                          <div className="flex items-center justify-between rounded-md border px-3 py-2">
+                            <label className="text-[11px] text-muted-foreground">
+                              {t("claude.disableNonessentialTraffic")}
+                            </label>
+                            <Switch
+                              checked={
+                                selectedDraft.claudeDisableNonessentialTraffic
+                              }
+                              onCheckedChange={(checked) => {
+                                handleClaudeEnvFlagChange(
+                                  "claudeDisableNonessentialTraffic",
+                                  CLAUDE_NONESSENTIAL_TRAFFIC_ENV_KEY,
+                                  checked
+                                )
+                              }}
+                              aria-label={t(
+                                "claude.disableNonessentialTrafficAria"
+                              )}
+                            />
+                          </div>
+                        </div>
                       </div>
                     ) : (
                       <div className="space-y-1.5">
@@ -10743,7 +10962,7 @@ supports_websockets = true`}
                           // env→config (never parallel): persistEnv also rewrites
                           // config.env on the backend, so concurrent writes would
                           // interleave two writers of ~/.claude/settings.json.
-                          const configToSave = configTextForClaudeSave(
+                          let configToSave = configTextForClaudeSave(
                             selectedDraft.configText,
                             selectedAgent.agent_type,
                             selectedDraft.modelProviderId,
@@ -10751,10 +10970,32 @@ supports_websockets = true`}
                               (p) => p.id === selectedDraft.modelProviderId
                             )
                           )
+                          // Materialize the Claude hardening toggles so the shown
+                          // default positions are actually applied on save —
+                          // writing the explicit "1"/"0" into both the native
+                          // config `env` and the DB env overlay — regardless of
+                          // whether the user touched the switches. Invalid JSON is
+                          // left untouched so persistConfig surfaces the error.
+                          let envToSave = selectedDraft.envText
+                          if (selectedAgent.agent_type === "claude_code") {
+                            const materialized =
+                              materializeClaudeHardeningFlags(
+                                configToSave,
+                                envToSave,
+                                {
+                                  sendAttributionHeader:
+                                    selectedDraft.claudeSendAttributionHeader,
+                                  disableNonessentialTraffic:
+                                    selectedDraft.claudeDisableNonessentialTraffic,
+                                }
+                              )
+                            configToSave = materialized.configText
+                            envToSave = materialized.envText
+                          }
                           persistEnv(
                             selectedAgent.agent_type,
                             selectedDraft.enabled,
-                            selectedDraft.envText,
+                            envToSave,
                             selectedDraft.modelProviderId
                           )
                             .then(() =>
@@ -10764,21 +11005,40 @@ supports_websockets = true`}
                               )
                             )
                             .then(() => {
-                              // Reflect the provider-authoritative rewrite in the
-                              // editor so the textarea doesn't keep showing a
-                              // stale value (e.g. a cleared custom model option)
-                              // until reload — only when the rewrite changed it.
-                              // The inner guard preserves any edit the user typed
-                              // into the still-editable textarea while the save
-                              // was in flight (don't clobber a newer draft).
-                              if (configToSave !== selectedDraft.configText) {
-                                const synced = normalizeConfigText(configToSave)
-                                updateSelectedDraft((current) =>
-                                  current.configText ===
-                                  selectedDraft.configText
-                                    ? { ...current, configText: synced }
-                                    : current
-                                )
+                              // Reflect the provider-authoritative rewrite AND the
+                              // materialized hardening flags in the editors so the
+                              // textareas don't show stale values until reload —
+                              // and so a later env-only save doesn't persist a
+                              // stale envText that drops the flags from the DB
+                              // overlay. Each inner guard preserves an edit the
+                              // user typed while the save was in flight.
+                              const syncedConfig =
+                                configToSave !== selectedDraft.configText
+                                  ? normalizeConfigText(configToSave)
+                                  : null
+                              const syncEnv =
+                                envToSave !== selectedDraft.envText
+                              if (syncedConfig !== null || syncEnv) {
+                                updateSelectedDraft((current) => {
+                                  let next = current
+                                  if (
+                                    syncedConfig !== null &&
+                                    current.configText ===
+                                      selectedDraft.configText
+                                  ) {
+                                    next = {
+                                      ...next,
+                                      configText: syncedConfig,
+                                    }
+                                  }
+                                  if (
+                                    syncEnv &&
+                                    current.envText === selectedDraft.envText
+                                  ) {
+                                    next = { ...next, envText: envToSave }
+                                  }
+                                  return next
+                                })
                               }
                               toast.success(t("toasts.configSaved"), {
                                 description: t("toasts.configSavedHint"),
diff --git a/src/i18n/messages/ar.json b/src/i18n/messages/ar.json
index 414dac485..71d7ed193 100644
--- a/src/i18n/messages/ar.json
+++ b/src/i18n/messages/ar.json
@@ -950,7 +950,11 @@
       "effortLevel_low": "منخفض",
       "effortLevel_medium": "متوسط",
       "effortLevel_high": "مرتفع",
-      "effortLevel_xhigh": "مرتفع جداً"
+      "effortLevel_xhigh": "مرتفع جداً",
+      "sendAttributionHeader": "إرسال معرّف الإسناد/الفوترة إلى الواجهة",
+      "sendAttributionHeaderAria": "إرسال معرّف الإسناد/الفوترة الخاص بـ Claude Code إلى الواجهة",
+      "disableNonessentialTraffic": "تعطيل القياس عن بُعد أو طلبات الشبكة غير الضرورية",
+      "disableNonessentialTrafficAria": "تعطيل القياس عن بُعد أو طلبات الشبكة غير الضرورية في Claude Code"
     },
     "dialogs": {
       "confirmDeleteProvider": "حذف المزود {providerId}؟",
diff --git a/src/i18n/messages/de.json b/src/i18n/messages/de.json
index ad467e1f6..33a9803db 100644
--- a/src/i18n/messages/de.json
+++ b/src/i18n/messages/de.json
@@ -950,7 +950,11 @@
       "effortLevel_low": "Niedrig",
       "effortLevel_medium": "Mittel",
       "effortLevel_high": "Hoch",
-      "effortLevel_xhigh": "Sehr Hoch"
+      "effortLevel_xhigh": "Sehr Hoch",
+      "sendAttributionHeader": "Attributions-/Abrechnungskennung an die API senden",
+      "sendAttributionHeaderAria": "Attributions-/Abrechnungskennung von Claude Code an die API senden",
+      "disableNonessentialTraffic": "Telemetrie oder überflüssige Netzwerkanfragen deaktivieren",
+      "disableNonessentialTrafficAria": "Telemetrie oder überflüssige Netzwerkanfragen von Claude Code deaktivieren"
     },
     "dialogs": {
       "confirmDeleteProvider": "Provider {providerId} löschen?",
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index bdfd937f5..b34011730 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -950,7 +950,11 @@
       "effortLevel_low": "Low",
       "effortLevel_medium": "Medium",
       "effortLevel_high": "High",
-      "effortLevel_xhigh": "Extra High"
+      "effortLevel_xhigh": "Extra High",
+      "sendAttributionHeader": "Send attribution/billing identifier to the API",
+      "sendAttributionHeaderAria": "Send Claude Code attribution/billing identifier to the API",
+      "disableNonessentialTraffic": "Disable telemetry or redundant network requests",
+      "disableNonessentialTrafficAria": "Disable Claude Code telemetry or redundant network requests"
     },
     "dialogs": {
       "confirmDeleteProvider": "Delete Provider {providerId}?",
diff --git a/src/i18n/messages/es.json b/src/i18n/messages/es.json
index 26f871e11..d6f51d694 100644
--- a/src/i18n/messages/es.json
+++ b/src/i18n/messages/es.json
@@ -950,7 +950,11 @@
       "effortLevel_low": "Bajo",
       "effortLevel_medium": "Medio",
       "effortLevel_high": "Alto",
-      "effortLevel_xhigh": "Extra Alto"
+      "effortLevel_xhigh": "Extra Alto",
+      "sendAttributionHeader": "Enviar identificador de atribución/facturación a la API",
+      "sendAttributionHeaderAria": "Enviar el identificador de atribución/facturación de Claude Code a la API",
+      "disableNonessentialTraffic": "Desactivar la telemetría o las solicitudes de red innecesarias",
+      "disableNonessentialTrafficAria": "Desactivar la telemetría o las solicitudes de red innecesarias de Claude Code"
     },
     "dialogs": {
       "confirmDeleteProvider": "¿Eliminar proveedor {providerId}?",
diff --git a/src/i18n/messages/fr.json b/src/i18n/messages/fr.json
index 8b615adab..2f4872d2d 100644
--- a/src/i18n/messages/fr.json
+++ b/src/i18n/messages/fr.json
@@ -950,7 +950,11 @@
       "effortLevel_low": "Bas",
       "effortLevel_medium": "Moyen",
       "effortLevel_high": "Élevé",
-      "effortLevel_xhigh": "Très Élevé"
+      "effortLevel_xhigh": "Très Élevé",
+      "sendAttributionHeader": "Envoyer l'identifiant d'attribution/facturation à l'API",
+      "sendAttributionHeaderAria": "Envoyer l'identifiant d'attribution/facturation de Claude Code à l'API",
+      "disableNonessentialTraffic": "Désactiver la télémétrie ou les requêtes réseau superflues",
+      "disableNonessentialTrafficAria": "Désactiver la télémétrie ou les requêtes réseau superflues de Claude Code"
     },
     "dialogs": {
       "confirmDeleteProvider": "Supprimer le provider {providerId} ?",
diff --git a/src/i18n/messages/ja.json b/src/i18n/messages/ja.json
index a4ff328ae..b967e41b7 100644
--- a/src/i18n/messages/ja.json
+++ b/src/i18n/messages/ja.json
@@ -950,7 +950,11 @@
       "effortLevel_low": "低",
       "effortLevel_medium": "中",
       "effortLevel_high": "高",
-      "effortLevel_xhigh": "超高"
+      "effortLevel_xhigh": "超高",
+      "sendAttributionHeader": "API に帰属/課金識別子を送信",
+      "sendAttributionHeaderAria": "API に Claude Code の帰属/課金識別子を送信",
+      "disableNonessentialTraffic": "テレメトリや不要なネットワークリクエストを無効化",
+      "disableNonessentialTrafficAria": "Claude Code のテレメトリや不要なネットワークリクエストを無効化"
     },
     "dialogs": {
       "confirmDeleteProvider": "Provider {providerId} を削除しますか？",
diff --git a/src/i18n/messages/ko.json b/src/i18n/messages/ko.json
index b99b77753..8afa5f450 100644
--- a/src/i18n/messages/ko.json
+++ b/src/i18n/messages/ko.json
@@ -950,7 +950,11 @@
       "effortLevel_low": "낮음",
       "effortLevel_medium": "중간",
       "effortLevel_high": "높음",
-      "effortLevel_xhigh": "매우 높음"
+      "effortLevel_xhigh": "매우 높음",
+      "sendAttributionHeader": "API에 속성/청구 식별자 전송",
+      "sendAttributionHeaderAria": "API에 Claude Code 속성/청구 식별자 전송",
+      "disableNonessentialTraffic": "텔레메트리 또는 불필요한 네트워크 요청 비활성화",
+      "disableNonessentialTrafficAria": "Claude Code 텔레메트리 또는 불필요한 네트워크 요청 비활성화"
     },
     "dialogs": {
       "confirmDeleteProvider": "Provider {providerId}를 삭제하시겠습니까?",
diff --git a/src/i18n/messages/pt.json b/src/i18n/messages/pt.json
index 572880228..ec305ac09 100644
--- a/src/i18n/messages/pt.json
+++ b/src/i18n/messages/pt.json
@@ -950,7 +950,11 @@
       "effortLevel_low": "Baixo",
       "effortLevel_medium": "Médio",
       "effortLevel_high": "Alto",
-      "effortLevel_xhigh": "Extra Alto"
+      "effortLevel_xhigh": "Extra Alto",
+      "sendAttributionHeader": "Enviar identificador de atribuição/cobrança para a API",
+      "sendAttributionHeaderAria": "Enviar o identificador de atribuição/cobrança do Claude Code para a API",
+      "disableNonessentialTraffic": "Desativar a telemetria ou solicitações de rede desnecessárias",
+      "disableNonessentialTrafficAria": "Desativar a telemetria ou solicitações de rede desnecessárias do Claude Code"
     },
     "dialogs": {
       "confirmDeleteProvider": "Excluir o provedor {providerId}?",
diff --git a/src/i18n/messages/zh-CN.json b/src/i18n/messages/zh-CN.json
index f96243f57..63bc86ff5 100644
--- a/src/i18n/messages/zh-CN.json
+++ b/src/i18n/messages/zh-CN.json
@@ -950,7 +950,11 @@
       "effortLevel_low": "低",
       "effortLevel_medium": "中",
       "effortLevel_high": "高",
-      "effortLevel_xhigh": "超高"
+      "effortLevel_xhigh": "超高",
+      "sendAttributionHeader": "向接口发送归属/计费标识",
+      "sendAttributionHeaderAria": "向接口发送 Claude Code 归属/计费标识",
+      "disableNonessentialTraffic": "禁用遥测或多余的网络请求",
+      "disableNonessentialTrafficAria": "禁用 Claude Code 遥测或多余的网络请求"
     },
     "dialogs": {
       "confirmDeleteProvider": "确认删除 Provider {providerId}？",
diff --git a/src/i18n/messages/zh-TW.json b/src/i18n/messages/zh-TW.json
index 16b45e45e..fa41e0178 100644
--- a/src/i18n/messages/zh-TW.json
+++ b/src/i18n/messages/zh-TW.json
@@ -950,7 +950,11 @@
       "effortLevel_low": "低",
       "effortLevel_medium": "中",
       "effortLevel_high": "高",
-      "effortLevel_xhigh": "超高"
+      "effortLevel_xhigh": "超高",
+      "sendAttributionHeader": "向介面傳送歸屬/計費識別碼",
+      "sendAttributionHeaderAria": "向介面傳送 Claude Code 歸屬/計費識別碼",
+      "disableNonessentialTraffic": "停用遙測或多餘的網路請求",
+      "disableNonessentialTrafficAria": "停用 Claude Code 遙測或多餘的網路請求"
     },
     "dialogs": {
       "confirmDeleteProvider": "確認刪除 Provider {providerId}？",

From f11735b896ea4497d072fc6ecb1b389d55026d7b Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Fri, 24 Jul 2026 19:24:46 +0800
Subject: [PATCH 09/15] feat(acp): render Grok plan-mode approval card for
 exit_plan_mode

Grok's native exit_plan_mode sends a blocking _x.ai/exit_plan_mode request to get the user's decision before leaving plan mode. codeg had no handler, so the turn stalled with nothing rendered. Bridge it to an interactive approval card (approve / request changes / abandon), shown in both the main conversation and the delegated sub-agent dialog and carried on the session snapshot so a mid-turn attach recovers it. Cancelling a turn now reclaims the pending question and plan-approval registries so the next request still renders.

Also fix a pre-existing test that asserted a conversation status against the enum variant instead of its serialized string.
---
 src-tauri/src/acp/connection.rs               | 158 +++++++++
 src-tauri/src/acp/manager.rs                  | 302 +++++++++++++++++
 src-tauri/src/acp/mod.rs                      |   1 +
 src-tauri/src/acp/plan_approval.rs            | 306 ++++++++++++++++++
 src-tauri/src/acp/session_state.rs            | 117 +++++++
 src-tauri/src/acp/types.rs                    |  17 +
 src-tauri/src/app_state.rs                    |   5 +
 src-tauri/src/commands/acp.rs                 |  13 +
 src-tauri/src/db/service/import_service.rs    |   4 +-
 src-tauri/src/lib.rs                          |   1 +
 src-tauri/src/web/handlers/acp.rs             |  20 ++
 src-tauri/src/web/router.rs                   |   4 +
 src/components/chat/conversation-shell.tsx    |  22 ++
 .../chat/plan-approval-card.test.tsx          | 106 ++++++
 src/components/chat/plan-approval-card.tsx    | 146 +++++++++
 .../conversation-detail-panel.tsx             |  11 +
 .../message/delegated-sub-thread.test.tsx     |   1 +
 .../message/sub-agent-session-dialog.test.tsx |   1 +
 .../message/sub-agent-session-dialog.tsx      |  33 +-
 src/contexts/acp-connections-context.tsx      | 114 +++++++
 src/hooks/use-connection.ts                   |   5 +
 src/i18n/messages/ar.json                     |  11 +
 src/i18n/messages/de.json                     |  11 +
 src/i18n/messages/en.json                     |  11 +
 src/i18n/messages/es.json                     |  11 +
 src/i18n/messages/fr.json                     |  11 +
 src/i18n/messages/ja.json                     |  11 +
 src/i18n/messages/ko.json                     |  11 +
 src/i18n/messages/pt.json                     |  11 +
 src/i18n/messages/zh-CN.json                  |  11 +
 src/i18n/messages/zh-TW.json                  |  11 +
 src/lib/api.ts                                |  20 ++
 src/lib/snapshot-denormalize.ts               |   7 +
 src/lib/types.ts                              |  45 +++
 34 files changed, 1566 insertions(+), 3 deletions(-)
 create mode 100644 src-tauri/src/acp/plan_approval.rs
 create mode 100644 src/components/chat/plan-approval-card.test.tsx
 create mode 100644 src/components/chat/plan-approval-card.tsx

diff --git a/src-tauri/src/acp/connection.rs b/src-tauri/src/acp/connection.rs
index 5a52fda29..b142e845b 100644
--- a/src-tauri/src/acp/connection.rs
+++ b/src-tauri/src/acp/connection.rs
@@ -892,6 +892,11 @@ pub async fn spawn_agent_connection(
             // companion's ask socket to close (which a reparented/hard-killed
             // agent may never do); the dropped sender declines the tool cleanly.
             inj.questions.cancel_questions_by_parent(&conn_id).await;
+            // Likewise reclaim a parked Grok `exit_plan_mode` approval; the
+            // dropped sender replies disconnect so grok keeps plan mode active.
+            inj.plan_approvals
+                .cancel_plan_approvals_by_parent(&conn_id)
+                .await;
         }
 
         if let Err(e) = result {
@@ -2015,6 +2020,14 @@ pub struct DelegationInjection {
     /// the delegation `broker.cancel_by_parent` cleanup. Shares the same backing
     /// `ConnectionManager` as the listener's question lookup.
     pub questions: Arc<dyn crate::acp::question::SessionQuestionAccess>,
+    /// Plan-approval registry handle for Grok's `exit_plan_mode` ext bridge.
+    /// Unlike delegation / ask / feedback this is NOT a codeg-mcp feature — it is
+    /// Grok's native plan mode — so it has no runtime on/off flag and is always
+    /// wired. Shares the same backing `ConnectionManager` as the question lookup.
+    /// The `run_connection` handler registers approvals + parks on the reply
+    /// through this, and the cleanup guard calls `cancel_plan_approvals_by_parent`
+    /// on disconnect (mirroring the question teardown cascade).
+    pub plan_approvals: Arc<dyn crate::acp::plan_approval::SessionPlanApprovalAccess>,
 }
 
 /// Locate the `codeg-mcp` companion binary across the supported deployment
@@ -2352,6 +2365,14 @@ async fn run_connection(
         .as_ref()
         .map(|inj| (Arc::clone(&inj.questions), inj.ask.clone()));
     let grok_ask_conn_id = connection_id.clone();
+    // Grok `exit_plan_mode` bridge access — always wired in production (native
+    // plan mode, no feature flag). `None` only on the test paths that spin up
+    // `run_connection` without a delegation stack; the handler then replies
+    // disconnect and grok keeps plan mode active.
+    let grok_plan_access = delegation_injection
+        .as_ref()
+        .map(|inj| Arc::clone(&inj.plan_approvals));
+    let grok_plan_conn_id = connection_id.clone();
     // The ext handler emits the answered in-stream card (`AskQuestionResultCard`)
     // itself once the user submits — grok never emits a completed tool result into
     // the ACP stream — so it needs this connection's session state + emitter.
@@ -2515,6 +2536,19 @@ async fn run_connection(
             },
             on_receive_request!(),
         )
+        .on_receive_request(
+            {
+                let access = grok_plan_access.clone();
+                let conn_id = grok_plan_conn_id.clone();
+                async move |req: GrokExitPlanModeRequest,
+                            responder: Responder<serde_json::Value>,
+                            _cx: ConnectionTo<Agent>| {
+                    handle_grok_exit_plan_mode(&access, &conn_id, req, responder).await;
+                    Ok(())
+                }
+            },
+            on_receive_request!(),
+        )
         .connect_with(agent, async move |cx| -> Result<(), sacp::Error> {
             let state = state_outer;
             let agent_name_for_log = registry::get_agent_meta(agent_type).name;
@@ -3190,6 +3224,18 @@ async fn run_connection(
 #[serde(transparent)]
 struct GrokAskUserQuestionRequest(serde_json::Value);
 
+/// Store the plan-approval responder and render the approval card. Grok's native
+/// `exit_plan_mode` tool issues this ACP ext request (`_x.ai/exit_plan_mode`) and
+/// BLOCKS on the reply — the agent won't leave plan mode until the user acts.
+/// Transparent over the raw params object (`{sessionId, toolCallId, planContent}`);
+/// the fields codeg needs are read by
+/// [`crate::acp::plan_approval::parse_grok_exit_plan_request`]. sacp routes typed
+/// handlers on the RAW wire method, so the derive keeps the leading `_`.
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, JsonRpcRequest)]
+#[request(method = "_x.ai/exit_plan_mode", response = serde_json::Value)]
+#[serde(transparent)]
+struct GrokExitPlanModeRequest(serde_json::Value);
+
 /// Bridge grok's native `_x.ai/ask_user_question` ext request into codeg's
 /// interactive question card. Grok blocks on the reply, so codeg registers the
 /// questions through the shared [`crate::acp::question::SessionQuestionAccess`] —
@@ -3295,6 +3341,83 @@ async fn handle_grok_ask_user_question(
     });
 }
 
+/// Bridge grok's native `_x.ai/exit_plan_mode` ext request into codeg's
+/// interactive plan-approval card. Grok BLOCKS on the reply — it won't leave plan
+/// mode until the user acts — so codeg registers the approval through the shared
+/// [`crate::acp::plan_approval::SessionPlanApprovalAccess`] (which sets
+/// `pending_plan_approval`, broadcasts `PlanApprovalRequest`, and renders the card
+/// above the composer), then answers the ext request with the user's decision once
+/// they submit. Unlike the ask bridge there is no synthesized in-stream card:
+/// grok's own `exit_plan_mode` tool_call renders the plan in the transcript (via
+/// `PlanModeCard`), mirroring how the permission dialog coexists with the tool
+/// call. Every early return replies with the disconnect-shaped response so grok
+/// keeps plan mode active — it can never be read as a silent approval.
+async fn handle_grok_exit_plan_mode(
+    access: &Option<Arc<dyn crate::acp::plan_approval::SessionPlanApprovalAccess>>,
+    connection_id: &str,
+    req: GrokExitPlanModeRequest,
+    responder: Responder<serde_json::Value>,
+) {
+    // Log the wire SHAPE (top-level field names), not the raw request — the plan
+    // body can be large and carry file paths / source. The keys are what
+    // wire-format verification needs (confirm `sessionId`/`toolCallId`/`planContent`
+    // on the first real run); the malformed path below logs more if parsing fails.
+    tracing::info!(
+        "[grok exit_plan] received _x.ai/exit_plan_mode ext request: keys={:?}",
+        req.0
+            .as_object()
+            .map(|o| o.keys().map(String::as_str).collect::<Vec<_>>())
+    );
+    let Some(access) = access else {
+        let _ =
+            responder.respond(crate::acp::plan_approval::grok_exit_plan_disconnect_response());
+        return;
+    };
+    let (plan_markdown, tool_call_id) =
+        match crate::acp::plan_approval::parse_grok_exit_plan_request(&req.0) {
+            Ok(parsed) => parsed,
+            Err(e) => {
+                tracing::warn!("[grok exit_plan] rejecting malformed ext request: {e}");
+                let _ = responder
+                    .respond(crate::acp::plan_approval::grok_exit_plan_disconnect_response());
+                return;
+            }
+        };
+    tracing::info!(
+        "[grok exit_plan] toolCallId={tool_call_id:?} plan_chars={}",
+        plan_markdown.chars().count()
+    );
+    let Some(registered) = access
+        .register_plan_approval(connection_id, tool_call_id, plan_markdown)
+        .await
+    else {
+        // Connection gone, or an approval is already pending on this connection.
+        let _ =
+            responder.respond(crate::acp::plan_approval::grok_exit_plan_disconnect_response());
+        return;
+    };
+    // The user answers out-of-band (the HTTP `answer_plan_approval` endpoint
+    // resolves the one-shot below), so await it on a task — keeping the ACP
+    // dispatch loop free — then reply to grok's blocked ext request. The manager's
+    // `answer_plan_approval` / teardown emit `PlanApprovalResolved` to clear the
+    // card; this task only unblocks grok.
+    tokio::spawn(async move {
+        match registered.answer_rx.await {
+            Ok(answer) => {
+                let _ = responder.respond(
+                    crate::acp::plan_approval::build_grok_exit_plan_response(&answer),
+                );
+            }
+            // Sender dropped: the approval was canceled or the connection tore
+            // down — reply disconnect so grok keeps plan mode active.
+            Err(_) => {
+                let _ = responder
+                    .respond(crate::acp::plan_approval::grok_exit_plan_disconnect_response());
+            }
+        }
+    });
+}
+
 async fn handle_permission_request(
     state: &Arc<RwLock<SessionState>>,
     emitter: &EventEmitter,
@@ -4952,6 +5075,26 @@ async fn run_conversation_loop<'a>(
                                     // DelegationCompleted emit.
                                     if let Some(inj) = delegation_injection {
                                         inj.broker.cancel_by_parent_turn(conn_id).await;
+                                        // Reclaim any parked `ask_user_question` /
+                                        // Grok `exit_plan_mode` approval owned by this
+                                        // connection. Unlike `perms` (drained inline
+                                        // above), these registries live on the manager
+                                        // and are otherwise only drained on full
+                                        // connection teardown -- but a turn-scoped
+                                        // Cancel keeps the connection alive. Without
+                                        // this the entry lingers, and the
+                                        // one-pending-per-connection guard in
+                                        // `register_{question,plan_approval}` then
+                                        // silently rejects the NEXT one on this
+                                        // connection (its card never shows). Idempotent
+                                        // with the cleanup-guard drain (empty map ->
+                                        // no-op); the dropped sender declines the tool /
+                                        // replies disconnect, exactly like the
+                                        // permission drain above.
+                                        inj.questions.cancel_questions_by_parent(conn_id).await;
+                                        inj.plan_approvals
+                                            .cancel_plan_approvals_by_parent(conn_id)
+                                            .await;
                                     }
                                     // Drain the prompt response in the background so
                                     // the SACP library doesn't log "receiver dropped"
@@ -8688,6 +8831,19 @@ mod tests {
             async fn cancel_question(&self, _parent_connection_id: &str, _question_id: &str) {}
             async fn cancel_questions_by_parent(&self, _parent_connection_id: &str) {}
         }
+        struct NoPlanApprovals;
+        #[async_trait::async_trait]
+        impl crate::acp::plan_approval::SessionPlanApprovalAccess for NoPlanApprovals {
+            async fn register_plan_approval(
+                &self,
+                _parent_connection_id: &str,
+                _tool_call_id: String,
+                _plan_markdown: String,
+            ) -> Option<crate::acp::plan_approval::RegisteredPlanApproval> {
+                None
+            }
+            async fn cancel_plan_approvals_by_parent(&self, _parent_connection_id: &str) {}
+        }
         let injection = DelegationInjection {
             broker,
             tokens: Arc::new(TokenRegistry::default()),
@@ -8697,6 +8853,8 @@ mod tests {
             sessions: crate::acp::session_info::SessionInfoRuntimeConfig::new(),
             questions: Arc::new(NoQuestions)
                 as Arc<dyn crate::acp::question::SessionQuestionAccess>,
+            plan_approvals: Arc::new(NoPlanApprovals)
+                as Arc<dyn crate::acp::plan_approval::SessionPlanApprovalAccess>,
         };
 
         let mut servers: Vec<McpServer> = Vec::new();
diff --git a/src-tauri/src/acp/manager.rs b/src-tauri/src/acp/manager.rs
index 86e866cd9..1b2074155 100644
--- a/src-tauri/src/acp/manager.rs
+++ b/src-tauri/src/acp/manager.rs
@@ -16,6 +16,9 @@ use crate::acp::feedback::{
     bounded_feedback_batch, FeedbackItem, FeedbackStatus, PendingFeedback,
     SessionFeedbackAccess, MAX_FEEDBACK_CHARS, MAX_FEEDBACK_RESPONSE_BYTES,
 };
+use crate::acp::plan_approval::{
+    PlanApprovalAnswer, RegisteredPlanApproval, SessionPlanApprovalAccess,
+};
 use crate::acp::question::{
     build_outcome, QuestionAnswer, QuestionOutcome, QuestionSpec, RegisteredQuestion,
     SessionQuestionAccess,
@@ -210,6 +213,14 @@ pub struct ConnectionManager {
     /// no cap, no cumulative growth; entries are removed on answer / cancel /
     /// connection teardown.
     pending_questions: Arc<Mutex<HashMap<String, PendingQuestionEntry>>>,
+    /// In-flight Grok `exit_plan_mode` approvals awaiting the user's decision,
+    /// keyed by the globally-unique `approval_id`. The connection's ext handler
+    /// parks on the receiver; the answer / cancel path resolves (and removes) the
+    /// matching sender. Shared across `clone_ref` clones so the connection-facing
+    /// `register_plan_approval` and the command-facing `answer_plan_approval`
+    /// touch the same map. At most one per connection (the agent is blocked in
+    /// its `exit_plan_mode` call) — no cap, no cumulative growth.
+    pending_plan_approvals: Arc<Mutex<HashMap<String, PendingPlanApprovalEntry>>>,
 }
 
 /// A parked `ask_user_question` awaiting its answer. The `sender` resolves the
@@ -221,6 +232,14 @@ struct PendingQuestionEntry {
     sender: tokio::sync::oneshot::Sender<QuestionOutcome>,
 }
 
+/// A parked Grok `exit_plan_mode` approval awaiting the user's decision. The
+/// `sender` resolves the blocked ext-request round-trip in the connection's
+/// handler. `parent_connection_id` routes the resolved event + answer.
+struct PendingPlanApprovalEntry {
+    parent_connection_id: String,
+    sender: tokio::sync::oneshot::Sender<PlanApprovalAnswer>,
+}
+
 impl Default for ConnectionManager {
     fn default() -> Self {
         Self::new()
@@ -236,6 +255,7 @@ impl ConnectionManager {
             delegation_injection: Arc::new(std::sync::OnceLock::new()),
             probe_locks: Arc::new(Mutex::new(HashMap::new())),
             pending_questions: Arc::new(Mutex::new(HashMap::new())),
+            pending_plan_approvals: Arc::new(Mutex::new(HashMap::new())),
         }
     }
 
@@ -248,6 +268,7 @@ impl ConnectionManager {
             delegation_injection: self.delegation_injection.clone(),
             probe_locks: self.probe_locks.clone(),
             pending_questions: self.pending_questions.clone(),
+            pending_plan_approvals: self.pending_plan_approvals.clone(),
         }
     }
 
@@ -273,6 +294,7 @@ impl ConnectionManager {
             delegation_injection: Arc::new(std::sync::OnceLock::new()),
             probe_locks: Arc::new(Mutex::new(HashMap::new())),
             pending_questions: Arc::new(Mutex::new(HashMap::new())),
+            pending_plan_approvals: Arc::new(Mutex::new(HashMap::new())),
         }
     }
 
@@ -2220,6 +2242,159 @@ impl ConnectionManager {
         }
     }
 
+    /// Register a pending Grok `exit_plan_mode` approval on `conn_id`, broadcast
+    /// `PlanApprovalRequest` (so every attached client renders the card and a
+    /// mid-turn attach recovers it from the snapshot), and return the receiver
+    /// the connection's ext handler awaits. `None` when the connection is gone
+    /// (nothing to approve) OR when one is already pending on it (the agent is
+    /// blocked in a single `exit_plan_mode` call; a second would orphan the
+    /// first). Mirrors [`Self::register_question`].
+    pub async fn register_plan_approval(
+        &self,
+        conn_id: &str,
+        tool_call_id: String,
+        plan_markdown: String,
+    ) -> Option<RegisteredPlanApproval> {
+        let (state, emitter) = self.get_state_and_emitter(conn_id).await?;
+        let approval_id = uuid::Uuid::new_v4().to_string();
+        let (tx, rx) = tokio::sync::oneshot::channel();
+        {
+            let mut reg = self.pending_plan_approvals.lock().await;
+            if reg.values().any(|e| e.parent_connection_id == conn_id) {
+                return None;
+            }
+            reg.insert(
+                approval_id.clone(),
+                PendingPlanApprovalEntry {
+                    parent_connection_id: conn_id.to_string(),
+                    sender: tx,
+                },
+            );
+        }
+        // Ungated emit: the agent is blocked in the tool call, so the card must
+        // show regardless of any turn-flag timing.
+        emit_with_state(
+            &state,
+            &emitter,
+            AcpEvent::PlanApprovalRequest {
+                approval_id: approval_id.clone(),
+                tool_call_id,
+                plan_markdown,
+            },
+        )
+        .await;
+        // Teardown event-ordering race (mirrors `register_question`): the
+        // cleanup guard's `cancel_plan_approvals_by_parent` may have drained this
+        // entry between the insert above and the emit just now — its
+        // `PlanApprovalResolved` could then have raced ahead of our
+        // `PlanApprovalRequest`, leaving a card up with no live backend waiter.
+        // Emit a compensating `PlanApprovalResolved` (ordered after our request)
+        // and decline.
+        if self
+            .compensate_if_plan_approval_drained(&approval_id, &state, &emitter)
+            .await
+        {
+            return None;
+        }
+        Some(RegisteredPlanApproval {
+            approval_id,
+            answer_rx: rx,
+        })
+    }
+
+    /// Returns `true` — after emitting a clearing `PlanApprovalResolved` — when
+    /// `approval_id` is no longer pending, i.e. a teardown sweep drained it in the
+    /// window after its `PlanApprovalRequest` was broadcast. Mirrors
+    /// [`Self::compensate_if_question_drained`].
+    async fn compensate_if_plan_approval_drained(
+        &self,
+        approval_id: &str,
+        state: &std::sync::Arc<tokio::sync::RwLock<crate::acp::SessionState>>,
+        emitter: &EventEmitter,
+    ) -> bool {
+        if self.pending_plan_approvals.lock().await.contains_key(approval_id) {
+            return false;
+        }
+        emit_with_state(
+            state,
+            emitter,
+            AcpEvent::PlanApprovalResolved {
+                approval_id: approval_id.to_string(),
+            },
+        )
+        .await;
+        true
+    }
+
+    /// Resolve a pending plan approval with the user's decision (from any
+    /// client). Removes the one-shot atomically (first answer wins; a duplicate /
+    /// already-resolved id is an idempotent no-op), sends the decision to the
+    /// blocked ext handler, and broadcasts `PlanApprovalResolved` so the card
+    /// clears on every client. Routing uses the entry's stored parent connection
+    /// (the `approval_id` is the authoritative key), so a stale `conn_id` from the
+    /// caller can't misroute. Mirrors [`Self::answer_question`].
+    pub async fn answer_plan_approval(
+        &self,
+        conn_id: &str,
+        approval_id: &str,
+        answer: PlanApprovalAnswer,
+    ) -> Result<(), AcpError> {
+        let _ = conn_id;
+        let entry = self.pending_plan_approvals.lock().await.remove(approval_id);
+        let Some(entry) = entry else {
+            // Already answered / canceled / gone elsewhere — idempotent success.
+            return Ok(());
+        };
+        // Ignore a dropped receiver: the handler may have abandoned the wait
+        // (teardown) at the same instant; the resolved event below still clears
+        // the card.
+        let _ = entry.sender.send(answer);
+        if let Some((state, emitter)) =
+            self.get_state_and_emitter(&entry.parent_connection_id).await
+        {
+            emit_with_state(
+                &state,
+                &emitter,
+                AcpEvent::PlanApprovalResolved {
+                    approval_id: approval_id.to_string(),
+                },
+            )
+            .await;
+        }
+        Ok(())
+    }
+
+    /// Cancel every pending plan approval parked on a connection that is tearing
+    /// down (the `run_connection` cleanup guard calls this). Dropping each
+    /// entry's sender resolves the handler's await as a disconnect (Grok keeps
+    /// plan mode active, re-surfaces on reconnect); the `PlanApprovalResolved`
+    /// broadcast clears the card. Mirrors [`Self::cancel_questions_by_parent`].
+    pub async fn cancel_plan_approvals_by_parent(&self, conn_id: &str) {
+        let drained: Vec<String> = {
+            let mut reg = self.pending_plan_approvals.lock().await;
+            let ids: Vec<String> = reg
+                .iter()
+                .filter(|(_, e)| e.parent_connection_id == conn_id)
+                .map(|(id, _)| id.clone())
+                .collect();
+            for id in &ids {
+                reg.remove(id);
+            }
+            ids
+        };
+        if drained.is_empty() {
+            return;
+        }
+        // Best-effort card clear: the connection may already be out of the map
+        // (disconnect removes it before this sweep), so tolerate `None`.
+        if let Some((state, emitter)) = self.get_state_and_emitter(conn_id).await {
+            for approval_id in drained {
+                emit_with_state(&state, &emitter, AcpEvent::PlanApprovalResolved { approval_id })
+                    .await;
+            }
+        }
+    }
+
     /// Resolve a conversation_id to its currently-active connection id, if any.
     /// Used by the by-conversation snapshot endpoint and the LifecycleSubscriber.
     /// Per-session state is acquired via `read().await` to avoid the
@@ -2538,6 +2713,35 @@ impl SessionQuestionAccess for ConnectionManagerQuestionLookup {
     }
 }
 
+/// Production impl of [`SessionPlanApprovalAccess`] for the Grok `exit_plan_mode`
+/// ext bridge. Registers / cancels the parent connection's pending plan approval
+/// by delegating to `ConnectionManager`. Mirrors `ConnectionManagerQuestionLookup`
+/// so the connection handler stays unit-testable with an in-memory stub.
+#[derive(Clone)]
+pub struct ConnectionManagerPlanApprovalLookup {
+    pub manager: Arc<ConnectionManager>,
+}
+
+#[async_trait::async_trait]
+impl SessionPlanApprovalAccess for ConnectionManagerPlanApprovalLookup {
+    async fn register_plan_approval(
+        &self,
+        parent_connection_id: &str,
+        tool_call_id: String,
+        plan_markdown: String,
+    ) -> Option<RegisteredPlanApproval> {
+        self.manager
+            .register_plan_approval(parent_connection_id, tool_call_id, plan_markdown)
+            .await
+    }
+
+    async fn cancel_plan_approvals_by_parent(&self, parent_connection_id: &str) {
+        self.manager
+            .cancel_plan_approvals_by_parent(parent_connection_id)
+            .await
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -5509,6 +5713,104 @@ mod tests {
         assert!(reg_b.answer_rx.await.is_ok());
     }
 
+    #[tokio::test]
+    async fn register_then_answer_plan_approval_resolves_and_clears() {
+        let mgr = ConnectionManager::new();
+        mgr.insert_test_connection("pa", AgentType::Grok, None, EventEmitter::Noop)
+            .await;
+        let reg = mgr
+            .register_plan_approval("pa", "call-1".into(), "# Plan\n- step".into())
+            .await
+            .expect("registered");
+        // SessionState reflects the pending approval for snapshot recovery.
+        {
+            let state = mgr.get_state("pa").await.unwrap();
+            let guard = state.read().await;
+            let pending = guard.pending_plan_approval.as_ref().expect("pending set");
+            assert_eq!(pending.plan_markdown, "# Plan\n- step");
+            assert_eq!(pending.tool_call_id, "call-1");
+        }
+
+        mgr.answer_plan_approval(
+            "pa",
+            &reg.approval_id,
+            crate::acp::plan_approval::PlanApprovalAnswer {
+                decision: crate::acp::plan_approval::PlanApprovalDecision::RequestChanges,
+                feedback: Some("use SSE".into()),
+            },
+        )
+        .await
+        .unwrap();
+
+        // The blocked ext handler's receiver resolves with the user's decision.
+        let got = reg.answer_rx.await.expect("answer delivered");
+        assert_eq!(
+            got.decision,
+            crate::acp::plan_approval::PlanApprovalDecision::RequestChanges
+        );
+        assert_eq!(got.feedback.as_deref(), Some("use SSE"));
+        // pending_plan_approval cleared after resolve.
+        assert!(mgr
+            .get_state("pa")
+            .await
+            .unwrap()
+            .read()
+            .await
+            .pending_plan_approval
+            .is_none());
+
+        // Idempotent: answering an already-resolved id is a no-op success.
+        mgr.answer_plan_approval(
+            "pa",
+            &reg.approval_id,
+            crate::acp::plan_approval::PlanApprovalAnswer {
+                decision: crate::acp::plan_approval::PlanApprovalDecision::Approve,
+                feedback: None,
+            },
+        )
+        .await
+        .unwrap();
+    }
+
+    #[tokio::test]
+    async fn register_plan_approval_refuses_second_pending_on_same_connection() {
+        // At most one approval per connection (the agent is blocked in exit_plan_mode).
+        let mgr = ConnectionManager::new();
+        mgr.insert_test_connection("pa2", AgentType::Grok, None, EventEmitter::Noop)
+            .await;
+        let _reg = mgr
+            .register_plan_approval("pa2", "c1".into(), "plan".into())
+            .await
+            .expect("first registers");
+        assert!(mgr
+            .register_plan_approval("pa2", "c2".into(), "plan2".into())
+            .await
+            .is_none());
+    }
+
+    #[tokio::test]
+    async fn cancel_plan_approvals_by_parent_drops_sender_and_clears() {
+        let mgr = ConnectionManager::new();
+        mgr.insert_test_connection("pax", AgentType::Grok, None, EventEmitter::Noop)
+            .await;
+        let reg = mgr
+            .register_plan_approval("pax", "c".into(), "plan".into())
+            .await
+            .unwrap();
+        mgr.cancel_plan_approvals_by_parent("pax").await;
+        // Dropping the sender surfaces to the parked handler as a recv error
+        // (which it renders as a disconnect reply — plan mode stays active).
+        assert!(reg.answer_rx.await.is_err());
+        assert!(mgr
+            .get_state("pax")
+            .await
+            .unwrap()
+            .read()
+            .await
+            .pending_plan_approval
+            .is_none());
+    }
+
     #[tokio::test]
     async fn compensate_clears_card_when_entry_drained_before_request_emit() {
         // Regression for the teardown event-ordering race: register inserts, the
diff --git a/src-tauri/src/acp/mod.rs b/src-tauri/src/acp/mod.rs
index e2565f193..25007023b 100644
--- a/src-tauri/src/acp/mod.rs
+++ b/src-tauri/src/acp/mod.rs
@@ -16,6 +16,7 @@ pub mod lifecycle;
 pub mod manager;
 pub mod opencode_catalog;
 pub mod opencode_plugins;
+pub mod plan_approval;
 pub mod preflight;
 pub mod question;
 pub mod registry;
diff --git a/src-tauri/src/acp/plan_approval.rs b/src-tauri/src/acp/plan_approval.rs
new file mode 100644
index 000000000..87726e1a7
--- /dev/null
+++ b/src-tauri/src/acp/plan_approval.rs
@@ -0,0 +1,306 @@
+//! Grok plan-mode approval ("exit plan mode") domain types.
+//!
+//! When a Grok session is in **plan mode** and the agent finishes planning, it
+//! calls its native `exit_plan_mode` tool. That tool reads `plan.md` from disk
+//! and issues a BLOCKING ACP ext request (`_x.ai/exit_plan_mode`,
+//! `ExitPlanModeExtRequest { sessionId, toolCallId, planContent }`) to the client
+//! to get the user's approval before leaving plan mode. Grok waits for the reply.
+//!
+//! Codeg bridges that ext request into an interactive **plan-approval card**
+//! rendered above the composer — the SAME shape as the `ask_user_question` bridge
+//! ([`crate::acp::question`]) and the permission dialog: a pending request is
+//! captured onto [`crate::acp::session_state::SessionState`] (in-memory, turn
+//! scoped, carried on `to_snapshot()` so a mid-turn attach re-renders the card),
+//! and the blocked ext request is answered once the user picks an action.
+//!
+//! Three outcomes exist (per Grok's binary + `~/.grok/docs/user-guide/19-plan-mode.md`):
+//!   * **Approve** — leave plan mode and start implementing.
+//!   * **Request changes** — freeform revision notes; the agent revises and plan
+//!     mode stays active (the user can iterate).
+//!   * **Abandon** — abandon the plan and turn plan mode off.
+//!
+//! ## Wire-format note
+//!
+//! The request shape (`planContent` / `toolCallId`) is high-confidence. The
+//! reply `ExitPlanModeExtResponse` is a 2-field struct (a decision + optional
+//! feedback) whose exact serde encoding is INFERRED from binary analysis, not yet
+//! captured from a live run (the same state `ask_user_question` was in before it
+//! was confirmed against Grok 0.2.101). [`build_grok_exit_plan_response`] is the
+//! single isolated function to correct once the first real run confirms the shape;
+//! a wrong reply only fails Grok's tool (plan mode stays active, reappears on
+//! reconnect) — strictly better and recoverable versus the current silent stall.
+
+use async_trait::async_trait;
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use tokio::sync::oneshot;
+
+/// Per-field sanity bound (characters) for the plan markdown carried in the
+/// request event + snapshot. The plan rides the broadcast `PlanApprovalRequest`
+/// and every snapshot, so this caps the blast radius of a pathological payload.
+/// Generous — a real `plan.md` is far smaller.
+pub const MAX_PLAN_MARKDOWN_CHARS: usize = 262_144;
+/// Per-field sanity bound (characters) for the user's freeform "request changes"
+/// feedback, echoed back to Grok. Generous enough for real revision notes.
+pub const MAX_FEEDBACK_CHARS: usize = 16_384;
+
+/// The pending (awaiting-decision) plan approval stored on
+/// `SessionState.pending_plan_approval` and carried on `to_snapshot()` so a
+/// client attaching mid-turn (cold attach, reconnect, another window) re-renders
+/// the approval card even though the one-shot `PlanApprovalRequest` event won't
+/// replay for it. At most one is pending per connection (the agent is blocked in
+/// its `exit_plan_mode` tool call).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PendingPlanApprovalState {
+    /// Backend-minted correlation key for the answer (NOT Grok's toolCallId).
+    pub approval_id: String,
+    /// Grok's `toolCallId` for the `exit_plan_mode` call, so the synthesized
+    /// in-stream result card can key on the same id as the (suppressed) native
+    /// tool call. Empty when the request omitted it.
+    pub tool_call_id: String,
+    /// The plan markdown read from `plan.md` (Grok's `planContent`). May be empty
+    /// — an empty/missing plan still opens the approval surface with an
+    /// empty-state notice (per Grok's plan-mode doc).
+    pub plan_markdown: String,
+    pub created_at: DateTime<Utc>,
+}
+
+/// Which action the user took on the plan-approval card. `snake_case` on the
+/// wire (`approve` / `request_changes` / `abandon`) — constructed by the frontend.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PlanApprovalDecision {
+    /// Approve the plan → Grok leaves plan mode and starts implementing.
+    Approve,
+    /// Request changes → Grok revises the plan; plan mode stays active.
+    RequestChanges,
+    /// Abandon the plan → plan mode is turned off.
+    Abandon,
+}
+
+/// The user's submission for a pending plan approval (frontend → backend → the
+/// blocked ext request). `feedback` carries the freeform revision notes for
+/// `RequestChanges` (ignored / empty for the other decisions). camelCase on the
+/// wire — this is constructed by the frontend, not read from an event payload.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PlanApprovalAnswer {
+    pub decision: PlanApprovalDecision,
+    #[serde(default)]
+    pub feedback: Option<String>,
+}
+
+impl PlanApprovalAnswer {
+    /// The trimmed, length-bounded feedback text (empty when none / whitespace).
+    /// Applied on the answer side so a hand-rolled client hitting the plain
+    /// `acp_answer_plan_approval` endpoint directly can't ride an unbounded blob
+    /// back to Grok.
+    pub fn normalized_feedback(&self) -> String {
+        self.feedback
+            .as_deref()
+            .unwrap_or("")
+            .trim()
+            .chars()
+            .take(MAX_FEEDBACK_CHARS)
+            .collect()
+    }
+}
+
+/// What [`SessionPlanApprovalAccess::register_plan_approval`] hands back to the
+/// connection's `exit_plan_mode` ext handler: the new approval id plus the
+/// receiver to await the user's decision on. Mirrors
+/// [`crate::acp::question::RegisteredQuestion`].
+pub struct RegisteredPlanApproval {
+    pub approval_id: String,
+    pub answer_rx: oneshot::Receiver<PlanApprovalAnswer>,
+}
+
+/// Connection-facing access to register / cancel a pending plan approval on a
+/// parent connection. The production impl
+/// (`crate::acp::manager::ConnectionManagerPlanApprovalLookup`) wraps the
+/// `ConnectionManager`; tests use an in-memory stub. Mirrors
+/// [`crate::acp::question::SessionQuestionAccess`] — kept in this neutral module
+/// so `connection.rs` depends only on the trait, not on `manager.rs`.
+#[async_trait]
+pub trait SessionPlanApprovalAccess: Send + Sync {
+    /// Register a pending plan approval on the parent connection (resolved from
+    /// the connection id), broadcast `PlanApprovalRequest` to every attached
+    /// client, and return a receiver that resolves when the user picks an action
+    /// (or the approval is canceled). `None` when the connection is gone or one
+    /// is already pending on it — the ext handler then declines to Grok, which
+    /// keeps plan mode active.
+    async fn register_plan_approval(
+        &self,
+        parent_connection_id: &str,
+        tool_call_id: String,
+        plan_markdown: String,
+    ) -> Option<RegisteredPlanApproval>;
+
+    /// Cancel every pending plan approval parked on a connection that is tearing
+    /// down. Called from the `run_connection` cleanup guard so a pending approval
+    /// — and the ext handler task parked on it — is reclaimed synchronously on
+    /// disconnect. Dropping the sender resolves the handler's await as a
+    /// disconnect (Grok keeps plan mode active, re-surfaces on reconnect).
+    async fn cancel_plan_approvals_by_parent(&self, parent_connection_id: &str);
+}
+
+/// Parse Grok's `_x.ai/exit_plan_mode` ext-request params into the plan markdown
+/// and `toolCallId` codeg needs to render the approval card. Grok's wire shape is
+/// `{ sessionId, toolCallId, planContent }`. Lenient: an empty / missing
+/// `planContent` is valid (the empty-plan approval surface), so the only hard
+/// error is a non-object payload. The markdown is length-bounded to
+/// [`MAX_PLAN_MARKDOWN_CHARS`].
+pub fn parse_grok_exit_plan_request(params: &Value) -> Result<(String, String), String> {
+    let obj = params
+        .as_object()
+        .ok_or_else(|| "exit_plan_mode ext request params is not an object".to_string())?;
+    let plan_markdown: String = obj
+        .get("planContent")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .chars()
+        .take(MAX_PLAN_MARKDOWN_CHARS)
+        .collect();
+    let tool_call_id = obj
+        .get("toolCallId")
+        .and_then(|v| v.as_str())
+        .unwrap_or("")
+        .to_string();
+    Ok((plan_markdown, tool_call_id))
+}
+
+/// Serialize the user's decision into Grok's `ExitPlanModeExtResponse` — the
+/// reply to a blocked `_x.ai/exit_plan_mode` ext request.
+///
+/// **Verify-on-real-run function.** The reply is a 2-field struct; the exact
+/// serde field names/variant strings are inferred (`{ decision, feedback }` with
+/// `approve` / `request_changes` / `abandon`) and should be confirmed against the
+/// `[grok exit_plan]` request log on the first real run, then corrected HERE if
+/// Grok rejects the shape. Everything else in the pipeline is shape-agnostic, so
+/// this is the only place to touch. A wrong reply fails Grok's tool (plan mode
+/// stays active) rather than corrupting state.
+pub fn build_grok_exit_plan_response(answer: &PlanApprovalAnswer) -> Value {
+    let decision = match answer.decision {
+        PlanApprovalDecision::Approve => "approve",
+        PlanApprovalDecision::RequestChanges => "request_changes",
+        PlanApprovalDecision::Abandon => "abandon",
+    };
+    serde_json::json!({
+        "decision": decision,
+        "feedback": answer.normalized_feedback(),
+    })
+}
+
+/// The `_x.ai/exit_plan_mode` reply for a connection tearing down mid-approval
+/// (the parked responder is drained without a user decision). Mirrors Grok's own
+/// "client disconnected mid-approval; plan mode stays active" behavior: report an
+/// error-shaped reply so Grok keeps plan mode active and re-surfaces the approval
+/// on reconnect, rather than silently proceeding as if approved.
+pub fn grok_exit_plan_disconnect_response() -> Value {
+    serde_json::json!({ "decision": "cancelled", "feedback": "" })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    fn grok_params(plan: &str) -> Value {
+        json!({
+            "sessionId": "s-1",
+            "toolCallId": "call-42",
+            "planContent": plan,
+        })
+    }
+
+    #[test]
+    fn parse_reads_plan_and_tool_call_id() {
+        let (plan, tc) = parse_grok_exit_plan_request(&grok_params("# Plan\n- step")).unwrap();
+        assert_eq!(plan, "# Plan\n- step");
+        assert_eq!(tc, "call-42");
+    }
+
+    #[test]
+    fn parse_accepts_empty_or_missing_plan() {
+        let (plan, tc) = parse_grok_exit_plan_request(&grok_params("")).unwrap();
+        assert_eq!(plan, "");
+        assert_eq!(tc, "call-42");
+        // Missing planContent + toolCallId → empty strings, still Ok.
+        let (plan, tc) =
+            parse_grok_exit_plan_request(&json!({ "sessionId": "s-1" })).unwrap();
+        assert!(plan.is_empty());
+        assert!(tc.is_empty());
+    }
+
+    #[test]
+    fn parse_rejects_non_object() {
+        assert!(parse_grok_exit_plan_request(&json!("nope")).is_err());
+        assert!(parse_grok_exit_plan_request(&json!([1, 2, 3])).is_err());
+    }
+
+    #[test]
+    fn parse_bounds_plan_markdown() {
+        let huge = "x".repeat(MAX_PLAN_MARKDOWN_CHARS + 500);
+        let (plan, _) = parse_grok_exit_plan_request(&grok_params(&huge)).unwrap();
+        assert_eq!(plan.chars().count(), MAX_PLAN_MARKDOWN_CHARS);
+    }
+
+    #[test]
+    fn build_response_maps_each_decision() {
+        let approve = PlanApprovalAnswer {
+            decision: PlanApprovalDecision::Approve,
+            feedback: None,
+        };
+        assert_eq!(build_grok_exit_plan_response(&approve)["decision"], "approve");
+        assert_eq!(build_grok_exit_plan_response(&approve)["feedback"], "");
+
+        let changes = PlanApprovalAnswer {
+            decision: PlanApprovalDecision::RequestChanges,
+            feedback: Some("  use SSE instead  ".into()),
+        };
+        let v = build_grok_exit_plan_response(&changes);
+        assert_eq!(v["decision"], "request_changes");
+        // Feedback is trimmed.
+        assert_eq!(v["feedback"], "use SSE instead");
+
+        let abandon = PlanApprovalAnswer {
+            decision: PlanApprovalDecision::Abandon,
+            feedback: None,
+        };
+        assert_eq!(build_grok_exit_plan_response(&abandon)["decision"], "abandon");
+    }
+
+    #[test]
+    fn feedback_is_bounded() {
+        let huge = "y".repeat(MAX_FEEDBACK_CHARS + 100);
+        let answer = PlanApprovalAnswer {
+            decision: PlanApprovalDecision::RequestChanges,
+            feedback: Some(huge),
+        };
+        assert_eq!(
+            answer.normalized_feedback().chars().count(),
+            MAX_FEEDBACK_CHARS
+        );
+    }
+
+    #[test]
+    fn answer_deserializes_from_camel_case_wire() {
+        let a: PlanApprovalAnswer =
+            serde_json::from_value(json!({ "decision": "request_changes", "feedback": "x" }))
+                .unwrap();
+        assert_eq!(a.decision, PlanApprovalDecision::RequestChanges);
+        assert_eq!(a.feedback.as_deref(), Some("x"));
+        // feedback optional.
+        let a: PlanApprovalAnswer =
+            serde_json::from_value(json!({ "decision": "approve" })).unwrap();
+        assert_eq!(a.decision, PlanApprovalDecision::Approve);
+        assert!(a.feedback.is_none());
+    }
+
+    #[test]
+    fn disconnect_response_is_not_an_approval() {
+        let v = grok_exit_plan_disconnect_response();
+        assert_ne!(v["decision"], "approve");
+    }
+}
diff --git a/src-tauri/src/acp/session_state.rs b/src-tauri/src/acp/session_state.rs
index 449bd6e96..bc3ddc53f 100644
--- a/src-tauri/src/acp/session_state.rs
+++ b/src-tauri/src/acp/session_state.rs
@@ -10,6 +10,7 @@ use serde::{Deserialize, Serialize};
 
 use crate::acp::event_stream::{ConnectionEventStream, RecentEventsBuffer};
 use crate::acp::feedback::{FeedbackItem, FeedbackStatus};
+use crate::acp::plan_approval::PendingPlanApprovalState;
 use crate::acp::question::PendingQuestionState;
 use crate::acp::types::{
     AcpEvent, AvailableCommandInfo, ConfigStaleKind, ConnectionStatus, EventEnvelope,
@@ -247,6 +248,16 @@ pub struct SessionState {
     /// the backend's `pending_questions` registry keys the answer one-shot.
     pub pending_question: Option<PendingQuestionState>,
 
+    /// The agent's in-flight Grok `exit_plan_mode` approval (the plan awaiting the
+    /// user's Approve / Request-changes / Abandon decision). Set by
+    /// `PlanApprovalRequest`, cleared by a matching `PlanApprovalResolved` (and
+    /// defensively on `TurnComplete`). Carried on `to_snapshot()` so a client
+    /// attaching mid-turn re-renders the approval card the one-shot event won't
+    /// replay for it. At most one is pending (the agent is blocked in its
+    /// `exit_plan_mode` tool call); the connection parks the ext responder keyed
+    /// by `approval_id`.
+    pub pending_plan_approval: Option<PendingPlanApprovalState>,
+
     /// In-flight (running) sub-agent delegations keyed by `parent_tool_use_id`.
     /// `DelegationStarted` inserts; `DelegationCompleted` removes. UNLIKE
     /// `active_tool_calls`, NOT cleared on `TurnComplete` (an async delegation
@@ -446,6 +457,7 @@ impl SessionState {
             active_tool_calls: BTreeMap::new(),
             pending_permission: None,
             pending_question: None,
+            pending_plan_approval: None,
             active_delegations: BTreeMap::new(),
             feedback: Vec::new(),
             background_outstanding: 0,
@@ -713,6 +725,29 @@ impl SessionState {
                     self.pending_question = None;
                 }
             }
+            AcpEvent::PlanApprovalRequest {
+                approval_id,
+                tool_call_id,
+                plan_markdown,
+            } => {
+                self.pending_plan_approval = Some(PendingPlanApprovalState {
+                    approval_id: approval_id.clone(),
+                    tool_call_id: tool_call_id.clone(),
+                    plan_markdown: plan_markdown.clone(),
+                    created_at: Utc::now(),
+                });
+            }
+            AcpEvent::PlanApprovalResolved { approval_id } => {
+                // Mirror `QuestionResolved`: only clear when the resolved id
+                // matches the current one, so a late event for an already-
+                // replaced approval can't wipe a live card from under the user.
+                if matches!(
+                    &self.pending_plan_approval,
+                    Some(p) if p.approval_id == *approval_id,
+                ) {
+                    self.pending_plan_approval = None;
+                }
+            }
             AcpEvent::TurnComplete { stop_reason, .. } => {
                 // Diagnostic only (no behavior change): pairs with the
                 // StatusChanged log above. This is the ACTUAL point the turn
@@ -788,6 +823,10 @@ impl SessionState {
                 // answer one-shot is cleaned via the listener's peer-close race;
                 // this just keeps the snapshot honest.
                 self.pending_question = None;
+                // Likewise a blocked `exit_plan_mode` approval: the parked ext
+                // responder is drained by the connection's teardown/cancel path;
+                // this just keeps the snapshot honest if the turn settles first.
+                self.pending_plan_approval = None;
                 self.status = ConnectionStatus::Connected;
             }
             AcpEvent::UserMessage { message_id, blocks } => {
@@ -820,6 +859,11 @@ impl SessionState {
                 self.feedback.clear();
                 // A new user turn supersedes any stale pending question.
                 self.pending_question = None;
+                // Likewise a stale plan approval: a new turn started without a
+                // clean TurnComplete (fork/resume re-prompt, error recovery, or a
+                // queued prompt sent instead of answering) must not leave a dead
+                // approval in the snapshot for a mid-turn attach to render.
+                self.pending_plan_approval = None;
             }
             AcpEvent::ConversationLinked {
                 conversation_id,
@@ -1214,6 +1258,7 @@ impl SessionState {
             active_tool_calls: self.active_tool_calls.values().cloned().collect(),
             pending_permission: self.pending_permission.clone(),
             pending_question: self.pending_question.clone(),
+            pending_plan_approval: self.pending_plan_approval.clone(),
             pending_user_message: self.pending_user_message.clone(),
             active_delegations: self.active_delegations.values().cloned().collect(),
             feedback: self.feedback.clone(),
@@ -1269,6 +1314,13 @@ pub struct LiveSessionSnapshot {
     /// the wire so every snapshot stays byte-identical with the pre-feature shape.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub pending_question: Option<PendingQuestionState>,
+    /// The agent's in-flight Grok `exit_plan_mode` approval (see
+    /// `SessionState.pending_plan_approval`). `#[serde(default)]` so older
+    /// payloads deserialize; `skip_serializing_if` keeps the common no-approval
+    /// case off the wire so every snapshot stays byte-identical with the
+    /// pre-feature shape.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub pending_plan_approval: Option<PendingPlanApprovalState>,
     /// The in-flight user prompt for the current turn (see
     /// `SessionState.pending_user_message`). `#[serde(default)]` so older
     /// payloads still deserialize; `skip_serializing_if` so the no-pending case
@@ -1433,6 +1485,71 @@ mod tests {
         )
     }
 
+    #[test]
+    fn plan_approval_applies_clears_by_id_and_survives_snapshot() {
+        let mut s = fresh_state();
+        // Request → pending set + carried on the snapshot for mid-turn attach.
+        s.apply_event(&AcpEvent::PlanApprovalRequest {
+            approval_id: "ap-1".into(),
+            tool_call_id: "call-1".into(),
+            plan_markdown: "# Plan".into(),
+        });
+        let pending = s.pending_plan_approval.clone().expect("pending set");
+        assert_eq!(pending.approval_id, "ap-1");
+        assert_eq!(pending.tool_call_id, "call-1");
+        assert_eq!(pending.plan_markdown, "# Plan");
+        assert!(s.to_snapshot().pending_plan_approval.is_some());
+
+        // A resolve for a DIFFERENT id must not wipe the live approval.
+        s.apply_event(&AcpEvent::PlanApprovalResolved {
+            approval_id: "other".into(),
+        });
+        assert!(s.pending_plan_approval.is_some());
+
+        // Matching resolve clears it (and the snapshot).
+        s.apply_event(&AcpEvent::PlanApprovalResolved {
+            approval_id: "ap-1".into(),
+        });
+        assert!(s.pending_plan_approval.is_none());
+        assert!(s.to_snapshot().pending_plan_approval.is_none());
+    }
+
+    #[test]
+    fn turn_complete_clears_pending_plan_approval() {
+        let mut s = fresh_state();
+        s.apply_event(&AcpEvent::PlanApprovalRequest {
+            approval_id: "ap-1".into(),
+            tool_call_id: "c".into(),
+            plan_markdown: String::new(),
+        });
+        assert!(s.pending_plan_approval.is_some());
+        s.apply_event(&AcpEvent::TurnComplete {
+            session_id: "sid".into(),
+            stop_reason: "end_turn".into(),
+            agent_type: "grok".into(),
+        });
+        assert!(s.pending_plan_approval.is_none());
+    }
+
+    #[test]
+    fn user_message_supersedes_stale_pending_plan_approval() {
+        // A new turn starting without a clean TurnComplete (fork/resume re-prompt,
+        // queued prompt sent instead of answering) must not leave a dead approval
+        // in the snapshot for a mid-turn attach to render.
+        let mut s = fresh_state();
+        s.apply_event(&AcpEvent::PlanApprovalRequest {
+            approval_id: "ap-1".into(),
+            tool_call_id: "c".into(),
+            plan_markdown: "# plan".into(),
+        });
+        assert!(s.pending_plan_approval.is_some());
+        s.apply_event(&AcpEvent::UserMessage {
+            message_id: "m1".into(),
+            blocks: vec![],
+        });
+        assert!(s.pending_plan_approval.is_none());
+    }
+
     #[test]
     fn background_activity_mirrors_outstanding_and_gates_keepalive() {
         let mut s = fresh_state();
diff --git a/src-tauri/src/acp/types.rs b/src-tauri/src/acp/types.rs
index 925220f18..282ff42f3 100644
--- a/src-tauri/src/acp/types.rs
+++ b/src-tauri/src/acp/types.rs
@@ -331,6 +331,23 @@ pub enum AcpEvent {
     /// (the tool call was aborted / the connection drained). Carries only the
     /// `question_id`; clients clear the matching card. Idempotent on apply.
     QuestionResolved { question_id: String },
+    /// A Grok `exit_plan_mode` call: the agent finished planning and is BLOCKED
+    /// on the user's approval of the plan before it leaves plan mode and starts
+    /// implementing (Grok's native `_x.ai/exit_plan_mode` ext request). Broadcast
+    /// so every client viewing this conversation renders the interactive
+    /// plan-approval card above the input box, and captured into
+    /// `SessionState.pending_plan_approval` so a client attaching mid-turn (cold
+    /// attach, reconnect, another window) recovers it from the snapshot. The
+    /// backend parks the blocked ext-request responder keyed by `approval_id`.
+    PlanApprovalRequest {
+        approval_id: String,
+        tool_call_id: String,
+        plan_markdown: String,
+    },
+    /// A previously-pending plan approval was answered (from any client) or
+    /// canceled (the connection drained). Carries only the `approval_id`; clients
+    /// clear the matching card. Idempotent on apply.
+    PlanApprovalResolved { approval_id: String },
     /// The agent's effective settings (env vars / model provider / native config
     /// files) changed AFTER this connection was spawned, so the running process
     /// is still using its launch-time config. Emitted by
diff --git a/src-tauri/src/app_state.rs b/src-tauri/src/app_state.rs
index 7d43d873e..dea9673b0 100644
--- a/src-tauri/src/app_state.rs
+++ b/src-tauri/src/app_state.rs
@@ -170,6 +170,11 @@ pub fn build_delegation_stack(
         questions: Arc::new(crate::acp::manager::ConnectionManagerQuestionLookup {
             manager: Arc::new(connection_manager.clone_ref()),
         }) as Arc<dyn crate::acp::question::SessionQuestionAccess>,
+        // Grok `exit_plan_mode` bridge — always wired (native plan mode, no
+        // feature flag), same backing manager as the question lookup.
+        plan_approvals: Arc::new(crate::acp::manager::ConnectionManagerPlanApprovalLookup {
+            manager: Arc::new(connection_manager.clone_ref()),
+        }) as Arc<dyn crate::acp::plan_approval::SessionPlanApprovalAccess>,
     });
 
     (broker, tokens, socket_path, feedback, ask, sessions)
diff --git a/src-tauri/src/commands/acp.rs b/src-tauri/src/commands/acp.rs
index ca58260d0..5f711fd3b 100644
--- a/src-tauri/src/commands/acp.rs
+++ b/src-tauri/src/commands/acp.rs
@@ -7702,6 +7702,19 @@ pub async fn acp_answer_question(
         .await
 }
 
+#[cfg(feature = "tauri-runtime")]
+#[cfg_attr(feature = "tauri-runtime", tauri::command)]
+pub async fn acp_answer_plan_approval(
+    connection_id: String,
+    approval_id: String,
+    answer: crate::acp::plan_approval::PlanApprovalAnswer,
+    manager: State<'_, ConnectionManager>,
+) -> Result<(), AcpError> {
+    manager
+        .answer_plan_approval(&connection_id, &approval_id, answer)
+        .await
+}
+
 #[cfg(feature = "tauri-runtime")]
 #[cfg_attr(feature = "tauri-runtime", tauri::command)]
 pub async fn acp_disconnect(
diff --git a/src-tauri/src/db/service/import_service.rs b/src-tauri/src/db/service/import_service.rs
index 7a7de8725..bba9510f3 100644
--- a/src-tauri/src/db/service/import_service.rs
+++ b/src-tauri/src/db/service/import_service.rs
@@ -390,7 +390,9 @@ mod tests {
             .expect("get");
         // Imported rows are surfaced for review, not marked done — so they stay
         // visible even when the sidebar hides completed conversations.
-        assert_eq!(got.status, conversation::ConversationStatus::PendingReview);
+        // `DbConversationSummary.status` is the serde-serialized string
+        // (`rename_all = "snake_case"`), not the enum.
+        assert_eq!(got.status, "pending_review");
     }
 
     #[tokio::test]
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 9e48efa3c..d811eace8 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -1093,6 +1093,7 @@ mod tauri_app {
                 acp_commands::acp_fork,
                 acp_commands::acp_respond_permission,
                 acp_commands::acp_answer_question,
+                acp_commands::acp_answer_plan_approval,
                 acp_commands::acp_disconnect,
                 acp_commands::acp_touch_connection,
                 acp_commands::acp_list_connections,
diff --git a/src-tauri/src/web/handlers/acp.rs b/src-tauri/src/web/handlers/acp.rs
index 2a536b992..3b5592fd8 100644
--- a/src-tauri/src/web/handlers/acp.rs
+++ b/src-tauri/src/web/handlers/acp.rs
@@ -469,6 +469,26 @@ pub async fn acp_answer_question(
     Ok(Json(()))
 }
 
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct AcpAnswerPlanApprovalParams {
+    pub connection_id: String,
+    pub approval_id: String,
+    pub answer: crate::acp::plan_approval::PlanApprovalAnswer,
+}
+
+pub async fn acp_answer_plan_approval(
+    Extension(state): Extension<Arc<AppState>>,
+    Json(params): Json<AcpAnswerPlanApprovalParams>,
+) -> Result<Json<()>, AppCommandError> {
+    let manager = &state.connection_manager;
+    manager
+        .answer_plan_approval(&params.connection_id, &params.approval_id, params.answer)
+        .await
+        .map_err(|e| AppCommandError::task_execution_failed(e.to_string()))?;
+    Ok(Json(()))
+}
+
 pub async fn acp_list_connections(
     Extension(state): Extension<Arc<AppState>>,
 ) -> Result<Json<Vec<ConnectionInfo>>, AppCommandError> {
diff --git a/src-tauri/src/web/router.rs b/src-tauri/src/web/router.rs
index 249d1b17f..d79d188d9 100644
--- a/src-tauri/src/web/router.rs
+++ b/src-tauri/src/web/router.rs
@@ -628,6 +628,10 @@ pub fn build_router(
             "/acp_answer_question",
             post(handlers::acp::acp_answer_question),
         )
+        .route(
+            "/acp_answer_plan_approval",
+            post(handlers::acp::acp_answer_plan_approval),
+        )
         .route(
             "/acp_list_connections",
             post(handlers::acp::acp_list_connections),
diff --git a/src/components/chat/conversation-shell.tsx b/src/components/chat/conversation-shell.tsx
index c976af0bf..2ccf9775a 100644
--- a/src/components/chat/conversation-shell.tsx
+++ b/src/components/chat/conversation-shell.tsx
@@ -3,7 +3,9 @@ import { useTranslations } from "next-intl"
 import type {
   AgentType,
   ConnectionStatus,
+  PendingPlanApprovalState,
   PendingQuestionState,
+  PlanApprovalAnswer,
   PromptCapabilitiesInfo,
   PromptDraft,
   PromptInputBlock,
@@ -23,6 +25,7 @@ import { ChatInput } from "@/components/chat/chat-input"
 import { PermissionDialog } from "@/components/chat/permission-dialog"
 import { QuestionDialog } from "@/components/chat/question-dialog"
 import { AskQuestionCard } from "@/components/chat/ask-question-card"
+import { PlanApprovalCard } from "@/components/chat/plan-approval-card"
 
 interface ConversationShellProps {
   status: ConnectionStatus | null
@@ -35,6 +38,8 @@ interface ConversationShellProps {
   pendingQuestion: PendingQuestion | null
   /** Awaiting-answer multiple-choice `ask_user_question`. */
   pendingAskQuestion: PendingQuestionState | null
+  /** Awaiting-decision Grok `exit_plan_mode` approval. */
+  pendingPlanApproval: PendingPlanApprovalState | null
   onFocus: () => void
   onSend: (draft: PromptDraft, modeId?: string | null) => void
   onCancel: () => void
@@ -44,6 +49,10 @@ interface ConversationShellProps {
     questionId: string,
     answer: QuestionAnswer
   ) => void | Promise<void>
+  onAnswerPlanApproval: (
+    approvalId: string,
+    answer: PlanApprovalAnswer
+  ) => void | Promise<void>
   children: ReactNode
   modes?: SessionModeInfo[]
   configOptions?: SessionConfigOptionInfo[]
@@ -99,12 +108,14 @@ export function ConversationShell({
   pendingPermission,
   pendingQuestion,
   pendingAskQuestion,
+  pendingPlanApproval,
   onFocus,
   onSend,
   onCancel,
   onRespondPermission,
   onAnswerQuestion,
   onAnswerAskQuestion,
+  onAnswerPlanApproval,
   children,
   modes,
   configOptions,
@@ -219,6 +230,17 @@ export function ConversationShell({
             />
           </div>
         )}
+        {pendingPlanApproval && (
+          <div className="mx-auto w-full max-w-3xl px-4">
+            {/* key on approval_id so the card always remounts (fresh in-flight /
+                feedback state) if the slot is ever reused for a new approval. */}
+            <PlanApprovalCard
+              key={pendingPlanApproval.approval_id}
+              approval={pendingPlanApproval}
+              onAnswer={onAnswerPlanApproval}
+            />
+          </div>
+        )}
 
         {!hideInput && feedbackList && (
           <div className="mx-auto w-full max-w-3xl px-4">{feedbackList}</div>
diff --git a/src/components/chat/plan-approval-card.test.tsx b/src/components/chat/plan-approval-card.test.tsx
new file mode 100644
index 000000000..085c1904a
--- /dev/null
+++ b/src/components/chat/plan-approval-card.test.tsx
@@ -0,0 +1,106 @@
+import { fireEvent, render, screen, waitFor } from "@testing-library/react"
+import { NextIntlClientProvider } from "next-intl"
+import { describe, expect, it, vi } from "vitest"
+
+// Exercise the real Streamdown pipeline for the plan markdown; only the
+// link-safety hook is stubbed (no bearing on plan rendering), mirroring
+// plan-mode-card.test.tsx.
+vi.mock("@/components/ai-elements/link-safety", () => ({
+  useStreamdownLinkSafety: () => ({ enabled: false }),
+}))
+
+import { PlanApprovalCard } from "./plan-approval-card"
+import enMessages from "@/i18n/messages/en.json"
+import type { PendingPlanApprovalState, PlanApprovalAnswer } from "@/lib/types"
+
+function make(plan: string): PendingPlanApprovalState {
+  return {
+    approval_id: "ap-1",
+    tool_call_id: "call-1",
+    plan_markdown: plan,
+    created_at: "2026-01-01T00:00:00Z",
+  }
+}
+
+function renderCard(
+  approval: PendingPlanApprovalState,
+  onAnswer: (
+    approvalId: string,
+    answer: PlanApprovalAnswer
+  ) => void | Promise<void> = vi.fn()
+) {
+  render(
+    <NextIntlClientProvider locale="en" messages={enMessages}>
+      <PlanApprovalCard approval={approval} onAnswer={onAnswer} />
+    </NextIntlClientProvider>
+  )
+  return onAnswer
+}
+
+describe("PlanApprovalCard", () => {
+  it("renders the plan markdown and the three actions", async () => {
+    renderCard(make("# Migration plan\n\n- step one"))
+    await waitFor(() =>
+      expect(screen.getByText("Migration plan")).toBeInTheDocument()
+    )
+    expect(
+      screen.getByRole("button", { name: "Approve & build" })
+    ).toBeInTheDocument()
+    expect(
+      screen.getByRole("button", { name: "Request changes" })
+    ).toBeInTheDocument()
+    expect(screen.getByRole("button", { name: "Abandon" })).toBeInTheDocument()
+  })
+
+  it("approves with an approve decision", () => {
+    const onAnswer = renderCard(make("plan"))
+    fireEvent.click(screen.getByRole("button", { name: "Approve & build" }))
+    expect(onAnswer).toHaveBeenCalledWith("ap-1", {
+      decision: "approve",
+      feedback: null,
+    })
+  })
+
+  it("abandons with an abandon decision", () => {
+    const onAnswer = renderCard(make("plan"))
+    fireEvent.click(screen.getByRole("button", { name: "Abandon" }))
+    expect(onAnswer).toHaveBeenCalledWith("ap-1", {
+      decision: "abandon",
+      feedback: null,
+    })
+  })
+
+  it("request-changes reveals a textarea and submits the trimmed feedback", () => {
+    const onAnswer = renderCard(make("plan"))
+    // Not requested yet: no feedback textarea.
+    expect(screen.queryByPlaceholderText("What should change?")).toBeNull()
+
+    fireEvent.click(screen.getByRole("button", { name: "Request changes" }))
+    const textarea = screen.getByPlaceholderText("What should change?")
+
+    // Send stays disabled until non-empty feedback is typed.
+    const send = screen.getByRole("button", { name: "Send" })
+    expect(send).toBeDisabled()
+
+    fireEvent.change(textarea, { target: { value: "  use SSE  " } })
+    expect(send).not.toBeDisabled()
+    fireEvent.click(send)
+    expect(onAnswer).toHaveBeenCalledWith("ap-1", {
+      decision: "request_changes",
+      feedback: "use SSE",
+    })
+  })
+
+  it("shows the empty-plan notice when no plan was written", () => {
+    renderCard(make("   "))
+    expect(
+      screen.getByText(
+        "The agent didn't write a plan. Approve to start building, or request changes."
+      )
+    ).toBeInTheDocument()
+    // Actions still available so the user can approve or push back.
+    expect(
+      screen.getByRole("button", { name: "Approve & build" })
+    ).toBeInTheDocument()
+  })
+})
diff --git a/src/components/chat/plan-approval-card.tsx b/src/components/chat/plan-approval-card.tsx
new file mode 100644
index 000000000..ba3bc3f4d
--- /dev/null
+++ b/src/components/chat/plan-approval-card.tsx
@@ -0,0 +1,146 @@
+"use client"
+
+import { useRef, useState } from "react"
+import { useTranslations } from "next-intl"
+import { ListTodoIcon, Loader2 } from "lucide-react"
+
+import { Button } from "@/components/ui/button"
+import { Textarea } from "@/components/ui/textarea"
+import { MessageResponse } from "@/components/ai-elements/message"
+import type {
+  PendingPlanApprovalState,
+  PlanApprovalAnswer,
+  PlanApprovalDecision,
+} from "@/lib/types"
+
+interface PlanApprovalCardProps {
+  /** The awaiting-decision plan approval. The shell renders this card only when
+   *  an approval is pending, so the prop is always present. */
+  approval: PendingPlanApprovalState
+  /** Resolves the parked `exit_plan_mode` ext request. Returns a promise so the
+   *  card can hold an in-flight state and surface a retryable error on failure. */
+  onAnswer: (
+    approvalId: string,
+    answer: PlanApprovalAnswer
+  ) => void | Promise<void>
+}
+
+/**
+ * Grok plan-mode approval card. When the agent finishes planning it calls
+ * `exit_plan_mode` and BLOCKS on the user's decision; this renders the plan above
+ * the composer with Approve / Request-changes / Abandon actions (mirroring Grok's
+ * own TUI approval bar). "Request changes" reveals a textarea for freeform
+ * revision notes. Modeled on `AskQuestionCard`'s in-flight/disable pattern: on
+ * success the backend's `plan_approval_resolved` clears `pendingPlanApproval` and
+ * unmounts this card, so controls stay disabled rather than flashing back on.
+ */
+export function PlanApprovalCard({
+  approval,
+  onAnswer,
+}: PlanApprovalCardProps) {
+  const t = useTranslations("Folder.chat.planApproval")
+  const [submitting, setSubmitting] = useState(false)
+  const [error, setError] = useState(false)
+  const [changesOpen, setChangesOpen] = useState(false)
+  const [feedback, setFeedback] = useState("")
+  const inFlight = useRef(false)
+
+  const plan = approval.plan_markdown.trim()
+
+  // Run a decision round-trip, holding the card in an in-flight state until it
+  // resolves. On failure re-enable and surface a retryable error.
+  const run = async (answer: PlanApprovalAnswer) => {
+    if (inFlight.current) return
+    inFlight.current = true
+    setSubmitting(true)
+    setError(false)
+    try {
+      await onAnswer(approval.approval_id, answer)
+      inFlight.current = false
+    } catch {
+      setError(true)
+      setSubmitting(false)
+      inFlight.current = false
+    }
+  }
+
+  const decide = (decision: PlanApprovalDecision, fb?: string) =>
+    void run({ decision, feedback: fb ?? null })
+
+  const locked = submitting
+
+  return (
+    <div className="w-full space-y-3 rounded-lg border border-border/60 bg-card/60 p-4">
+      <div className="flex items-center gap-1.5 text-sm font-medium text-foreground">
+        <ListTodoIcon className="size-4 shrink-0 text-muted-foreground" />
+        {t("title")}
+      </div>
+
+      {plan ? (
+        <div className="prose prose-sm max-h-80 max-w-none overflow-auto rounded-md border border-border/60 bg-muted/30 px-3.5 py-3 text-sm dark:prose-invert [&_ol]:list-inside [&_ul]:list-inside">
+          <MessageResponse>{plan}</MessageResponse>
+        </div>
+      ) : (
+        <p className="rounded-md border border-dashed border-border/60 px-3 py-4 text-sm text-muted-foreground">
+          {t("emptyPlan")}
+        </p>
+      )}
+
+      {changesOpen ? (
+        <div className="space-y-2">
+          <Textarea
+            value={feedback}
+            onChange={(e) => setFeedback(e.target.value)}
+            placeholder={t("feedbackPlaceholder")}
+            disabled={locked}
+            rows={3}
+            autoFocus
+          />
+          <div className="flex items-center justify-end gap-2">
+            <Button
+              variant="ghost"
+              size="sm"
+              disabled={locked}
+              onClick={() => setChangesOpen(false)}
+            >
+              {t("cancel")}
+            </Button>
+            <Button
+              size="sm"
+              disabled={locked || !feedback.trim()}
+              onClick={() => decide("request_changes", feedback.trim())}
+            >
+              {submitting && <Loader2 className="size-3.5 animate-spin" />}
+              {t("sendChanges")}
+            </Button>
+          </div>
+        </div>
+      ) : (
+        <div className="flex flex-wrap items-center gap-2">
+          <Button size="sm" disabled={locked} onClick={() => decide("approve")}>
+            {submitting && <Loader2 className="size-3.5 animate-spin" />}
+            {t("approve")}
+          </Button>
+          <Button
+            variant="outline"
+            size="sm"
+            disabled={locked}
+            onClick={() => setChangesOpen(true)}
+          >
+            {t("requestChanges")}
+          </Button>
+          <Button
+            variant="destructive"
+            size="sm"
+            disabled={locked}
+            onClick={() => decide("abandon")}
+          >
+            {t("abandon")}
+          </Button>
+        </div>
+      )}
+
+      {error && <p className="text-xs text-destructive">{t("submitError")}</p>}
+    </div>
+  )
+}
diff --git a/src/components/conversations/conversation-detail-panel.tsx b/src/components/conversations/conversation-detail-panel.tsx
index db2e299eb..d1afe73a5 100644
--- a/src/components/conversations/conversation-detail-panel.tsx
+++ b/src/components/conversations/conversation-detail-panel.tsx
@@ -84,6 +84,7 @@ import {
   type ConversationStatus,
   type EventEnvelope,
   type MessageTurn,
+  type PlanApprovalAnswer,
   type PromptDraft,
   type QuestionAnswer,
   type UserMessageBlock,
@@ -1336,6 +1337,14 @@ const ConversationTabView = memo(function ConversationTabView({
     [acpActions, tabId]
   )
 
+  // Grok `exit_plan_mode` approval: resolve the blocked ext request. The backend
+  // broadcasts `plan_approval_resolved` to clear the card on every client.
+  const handleAnswerPlanApproval = useCallback(
+    (approvalId: string, answer: PlanApprovalAnswer) =>
+      acpActions.answerPlanApproval(tabId, approvalId, answer),
+    [acpActions, tabId]
+  )
+
   // Queue edit flow: derive editing draft text from queue state
   const editingQueueDraftText = useMemo(() => {
     if (!mqEditingItemId) return null
@@ -1471,12 +1480,14 @@ const ConversationTabView = memo(function ConversationTabView({
       pendingPermission={conn.pendingPermission}
       pendingQuestion={conn.pendingQuestion}
       pendingAskQuestion={conn.pendingAskQuestion}
+      pendingPlanApproval={conn.pendingPlanApproval}
       onFocus={handleFocus}
       onSend={handleSend}
       onCancel={handleCancel}
       onRespondPermission={handleRespondPermission}
       onAnswerQuestion={handleAnswerQuestion}
       onAnswerAskQuestion={handleAnswerAskQuestion}
+      onAnswerPlanApproval={handleAnswerPlanApproval}
       modes={connectionModes}
       configOptions={connectionConfigOptions}
       modeLoading={modeLoading}
diff --git a/src/components/message/delegated-sub-thread.test.tsx b/src/components/message/delegated-sub-thread.test.tsx
index 4eb4ddd7f..b4d1973d1 100644
--- a/src/components/message/delegated-sub-thread.test.tsx
+++ b/src/components/message/delegated-sub-thread.test.tsx
@@ -98,6 +98,7 @@ function childConnWith(pendingPermission: unknown) {
     pendingPermission,
     pendingQuestion: null,
     pendingAskQuestion: null,
+    pendingPlanApproval: null,
     claudeApiRetry: null,
     error: null,
     loadError: null,
diff --git a/src/components/message/sub-agent-session-dialog.test.tsx b/src/components/message/sub-agent-session-dialog.test.tsx
index 46fb5bf4f..ebb3d26d7 100644
--- a/src/components/message/sub-agent-session-dialog.test.tsx
+++ b/src/components/message/sub-agent-session-dialog.test.tsx
@@ -207,6 +207,7 @@ function makeConnState(overrides: Partial<ConnectionState>): ConnectionState {
     pendingPermission: null,
     pendingQuestion: null,
     pendingAskQuestion: null,
+    pendingPlanApproval: null,
     claudeApiRetry: null,
     error: null,
     loadError: null,
diff --git a/src/components/message/sub-agent-session-dialog.tsx b/src/components/message/sub-agent-session-dialog.tsx
index 4bbd08ac1..366ba78dc 100644
--- a/src/components/message/sub-agent-session-dialog.tsx
+++ b/src/components/message/sub-agent-session-dialog.tsx
@@ -46,7 +46,13 @@ import {
 } from "@/contexts/acp-connections-context"
 import { PermissionDialog } from "@/components/chat/permission-dialog"
 import { AskQuestionCard } from "@/components/chat/ask-question-card"
-import { AGENT_LABELS, type AgentType, type QuestionAnswer } from "@/lib/types"
+import { PlanApprovalCard } from "@/components/chat/plan-approval-card"
+import {
+  AGENT_LABELS,
+  type AgentType,
+  type PlanApprovalAnswer,
+  type QuestionAnswer,
+} from "@/lib/types"
 
 interface Props {
   open: boolean
@@ -320,7 +326,8 @@ function SubAgentSessionBody({
   // raise a permission request. The parent card no longer answers it inline
   // (it only badges "awaiting approval"); this dialog is where the user
   // resolves it. Route the response through the CHILD connection id.
-  const { respondPermission, answerQuestion } = useAcpActions()
+  const { respondPermission, answerQuestion, answerPlanApproval } =
+    useAcpActions()
   const childPendingPermission = childConn?.pendingPermission ?? null
   const onRespondPermission = useCallback(
     (requestId: string, optionId: string) => {
@@ -346,6 +353,19 @@ function SubAgentSessionBody({
     [childConnectionId, answerQuestion]
   )
 
+  // A child Grok session may enter plan mode and call `exit_plan_mode`, raising
+  // the blocking plan-approval card. Same shape as the ask path: surface the
+  // child's live `pendingPlanApproval` and route the decision back through the
+  // child connection id so the delegated agent isn't left blocked with no card.
+  const childPendingPlanApproval = childConn?.pendingPlanApproval ?? null
+  const onAnswerPlanApproval = useCallback(
+    (approvalId: string, answer: PlanApprovalAnswer) => {
+      if (!childConnectionId) return
+      return answerPlanApproval(childConnectionId, approvalId, answer)
+    },
+    [childConnectionId, answerPlanApproval]
+  )
+
   return (
     <div className="flex h-full min-h-0 flex-col">
       <div className="flex items-center gap-3 px-5 py-2.5 border-b border-border pr-12">
@@ -378,6 +398,15 @@ function SubAgentSessionBody({
             />
           </div>
         )}
+      {childConnectionId && childPendingPlanApproval && (
+        <div className="border-b border-border px-4 py-3">
+          <PlanApprovalCard
+            key={childPendingPlanApproval.approval_id}
+            approval={childPendingPlanApproval}
+            onAnswer={onAnswerPlanApproval}
+          />
+        </div>
+      )}
       <div className="flex-1 min-h-0 px-4 py-3">
         <MessageListView
           conversationId={childConversationId}
diff --git a/src/contexts/acp-connections-context.tsx b/src/contexts/acp-connections-context.tsx
index a87904fff..b6d083e1c 100644
--- a/src/contexts/acp-connections-context.tsx
+++ b/src/contexts/acp-connections-context.tsx
@@ -26,6 +26,7 @@ import {
   acpCancel,
   acpRespondPermission,
   acpAnswerQuestion,
+  acpAnswerPlanApproval,
   acpDisconnect,
   acpTouchConnection,
   acpGetSessionSnapshot,
@@ -51,6 +52,8 @@ import type {
   PermissionOptionInfo,
   PendingQuestionState,
   QuestionAnswer,
+  PendingPlanApprovalState,
+  PlanApprovalAnswer,
   SessionConfigOptionInfo,
   SessionModeStateInfo,
   SessionUsageUpdateInfo,
@@ -179,6 +182,10 @@ export interface ConnectionState {
    *  `pending_question`; cleared on `question_resolved` or turn end. Distinct
    *  from the free-text `pendingQuestion` above. */
   pendingAskQuestion: PendingQuestionState | null
+  /** Awaiting-decision Grok `exit_plan_mode` approval (the plan the agent is
+   *  blocked on). Set from a `plan_approval_request` event or a snapshot's
+   *  `pending_plan_approval`; cleared on `plan_approval_resolved` or turn end. */
+  pendingPlanApproval: PendingPlanApprovalState | null
   claudeApiRetry: ClaudeApiRetryState | null
   error: string | null
   /**
@@ -446,6 +453,18 @@ type Action =
        *  late `question_resolved` from wiping a freshly-raised question). */
       questionId?: string
     }
+  | {
+      type: "SET_PLAN_APPROVAL"
+      contextKey: string
+      pendingPlanApproval: PendingPlanApprovalState
+    }
+  | {
+      type: "CLEAR_PLAN_APPROVAL"
+      contextKey: string
+      /** When present, only clear if the current approval_id matches (guards a
+       *  late `plan_approval_resolved` from wiping a freshly-raised approval). */
+      approvalId?: string
+    }
   | { type: "SESSION_STARTED"; contextKey: string; sessionId: string }
   | {
       type: "SESSION_MODES"
@@ -1134,6 +1153,7 @@ function connectionsReducer(
         pendingUserMessage: null,
         pendingQuestion: null,
         pendingAskQuestion: null,
+        pendingPlanApproval: null,
         claudeApiRetry: null,
         error: null,
         loadError: null,
@@ -1190,6 +1210,7 @@ function connectionsReducer(
         pendingUserMessage: null,
         pendingQuestion: null,
         pendingAskQuestion: null,
+        pendingPlanApproval: null,
         claudeApiRetry: null,
         error: null,
         loadError: null,
@@ -1300,6 +1321,7 @@ function connectionsReducer(
         liveMessage: hydratedLiveMessage,
         pendingPermission: hydratedPendingPermission,
         pendingAskQuestion: action.patch.pendingAskQuestion,
+        pendingPlanApproval: action.patch.pendingPlanApproval,
         pendingUserMessage: action.patch.pendingUserMessage,
         promptCapabilities: mergedPromptCapabilities,
         selectorsReady: mergedSelectorsReady,
@@ -1377,6 +1399,9 @@ function connectionsReducer(
         // clears it via `question_resolved`; this is the safety net for a turn
         // that ended without one (agent error / abandoned block).
         updated.pendingAskQuestion = null
+        // Likewise a blocked exit_plan_mode approval — cleared via
+        // `plan_approval_resolved` normally; this is the turn-end safety net.
+        updated.pendingPlanApproval = null
       }
       next.set(action.contextKey, updated)
       return next
@@ -1900,6 +1925,34 @@ function connectionsReducer(
       return next
     }
 
+    case "SET_PLAN_APPROVAL": {
+      const conn = state.get(action.contextKey)
+      if (!conn) return state
+      const next = new Map(state)
+      next.set(action.contextKey, {
+        ...conn,
+        pendingPlanApproval: action.pendingPlanApproval,
+      })
+      return next
+    }
+
+    case "CLEAR_PLAN_APPROVAL": {
+      const conn = state.get(action.contextKey)
+      if (!conn) return state
+      if (
+        action.approvalId !== undefined &&
+        conn.pendingPlanApproval?.approval_id !== action.approvalId
+      ) {
+        return state
+      }
+      const next = new Map(state)
+      next.set(action.contextKey, {
+        ...conn,
+        pendingPlanApproval: null,
+      })
+      return next
+    }
+
     case "SESSION_STARTED": {
       const conn = state.get(action.contextKey)
       if (!conn) return state
@@ -2273,6 +2326,11 @@ export interface AcpActionsValue {
     questionId: string,
     answer: QuestionAnswer
   ): Promise<void>
+  answerPlanApproval(
+    contextKey: string,
+    approvalId: string,
+    answer: PlanApprovalAnswer
+  ): Promise<void>
   setActiveKey(key: string | null): void
   touchActivity(contextKey: string): void
   registerOpenTabKeys(keys: Set<string>): void
@@ -2948,6 +3006,31 @@ export function AcpConnectionsProvider({ children }: { children: ReactNode }) {
             questionId: e.question_id,
           })
           break
+        case "plan_approval_request":
+          // Grok called `exit_plan_mode`: it's blocked on the user's approval of
+          // the plan. Flush queued streaming so the card renders against current
+          // content, then raise the interactive plan-approval card.
+          flushStreamingQueue()
+          dispatch({
+            type: "SET_PLAN_APPROVAL",
+            contextKey,
+            pendingPlanApproval: {
+              approval_id: e.approval_id,
+              tool_call_id: e.tool_call_id,
+              plan_markdown: e.plan_markdown,
+              created_at: new Date().toISOString(),
+            },
+          })
+          break
+        case "plan_approval_resolved":
+          // The approval was answered (this or another window) or canceled.
+          // Matched by approval_id so a stale event can't wipe a fresh one.
+          dispatch({
+            type: "CLEAR_PLAN_APPROVAL",
+            contextKey,
+            approvalId: e.approval_id,
+          })
+          break
         case "background_activity": {
           // Out-of-turn transcript activity from the backend watcher: async
           // task completions, the agent's continued work after them, cron//
@@ -4472,6 +4555,35 @@ export function AcpConnectionsProvider({ children }: { children: ReactNode }) {
     [dispatch]
   )
 
+  const answerPlanApproval = useCallback(
+    async (
+      contextKey: string,
+      approvalId: string,
+      answer: PlanApprovalAnswer
+    ) => {
+      const conn = storeRef.current.connections.get(contextKey)
+      if (!conn) {
+        // Throw, don't silently return: PlanApprovalCard awaits this and holds a
+        // disabled in-flight state until it resolves. A silent resolve would
+        // leave the card stuck; the throw routes to its retryable inline error.
+        throw new Error(
+          `[AcpConnections] answerPlanApproval: no connection for ${contextKey}`
+        )
+      }
+      try {
+        lastActivityRef.current.set(contextKey, Date.now())
+        await acpAnswerPlanApproval(conn.connectionId, approvalId, answer)
+        // Optimistically clear; the backend also broadcasts
+        // plan_approval_resolved (idempotent on the matched id).
+        dispatch({ type: "CLEAR_PLAN_APPROVAL", contextKey, approvalId })
+      } catch (e) {
+        console.error("[AcpConnections] answerPlanApproval failed:", e)
+        throw e
+      }
+    },
+    [dispatch]
+  )
+
   const attachDelegationChild = useCallback(
     (args: {
       connectionId: string
@@ -4553,6 +4665,7 @@ export function AcpConnectionsProvider({ children }: { children: ReactNode }) {
       cancel,
       respondPermission,
       answerQuestion,
+      answerPlanApproval,
       setActiveKey,
       touchActivity,
       registerOpenTabKeys,
@@ -4573,6 +4686,7 @@ export function AcpConnectionsProvider({ children }: { children: ReactNode }) {
       cancel,
       respondPermission,
       answerQuestion,
+      answerPlanApproval,
       setActiveKey,
       touchActivity,
       registerOpenTabKeys,
diff --git a/src/hooks/use-connection.ts b/src/hooks/use-connection.ts
index 3150ea67d..6c1699e0b 100644
--- a/src/hooks/use-connection.ts
+++ b/src/hooks/use-connection.ts
@@ -16,6 +16,7 @@ import type {
   AvailableCommandInfo,
   ConfigStaleKind,
   ConnectionStatus,
+  PendingPlanApprovalState,
   PendingQuestionState,
   PromptCapabilitiesInfo,
   QuestionAnswer,
@@ -62,6 +63,7 @@ export interface UseConnectionReturn {
   pendingUserMessage: PendingUserMessage | null
   pendingQuestion: PendingQuestion | null
   pendingAskQuestion: PendingQuestionState | null
+  pendingPlanApproval: PendingPlanApprovalState | null
   claudeApiRetry: ClaudeApiRetryState | null
   error: string | null
   loadError: string | null
@@ -218,6 +220,7 @@ export function useConnection(contextKey: string): UseConnectionReturn {
   const pendingUserMessage = connection?.pendingUserMessage ?? null
   const pendingQuestion = connection?.pendingQuestion ?? null
   const pendingAskQuestion = connection?.pendingAskQuestion ?? null
+  const pendingPlanApproval = connection?.pendingPlanApproval ?? null
   const claudeApiRetry = connection?.claudeApiRetry ?? null
   const error = connection?.error ?? null
   const loadError = connection?.loadError ?? null
@@ -320,6 +323,7 @@ export function useConnection(contextKey: string): UseConnectionReturn {
       pendingUserMessage,
       pendingQuestion,
       pendingAskQuestion,
+      pendingPlanApproval,
       claudeApiRetry,
       error,
       loadError,
@@ -358,6 +362,7 @@ export function useConnection(contextKey: string): UseConnectionReturn {
       pendingUserMessage,
       pendingQuestion,
       pendingAskQuestion,
+      pendingPlanApproval,
       claudeApiRetry,
       error,
       loadError,
diff --git a/src/i18n/messages/ar.json b/src/i18n/messages/ar.json
index 71d7ed193..4793b1c84 100644
--- a/src/i18n/messages/ar.json
+++ b/src/i18n/messages/ar.json
@@ -2743,6 +2743,17 @@
         "submit": "إرسال",
         "submitError": "تعذّر الإرسال. حاول مرة أخرى."
       },
+      "planApproval": {
+        "title": "لدى الوكيل خطة — راجعها",
+        "emptyPlan": "لم يكتب الوكيل خطة. وافق للبدء في التنفيذ أو اطلب تعديلات.",
+        "approve": "الموافقة والبدء",
+        "requestChanges": "طلب تعديلات",
+        "abandon": "تجاهل",
+        "feedbackPlaceholder": "ما الذي ينبغي تغييره؟",
+        "sendChanges": "إرسال",
+        "cancel": "إلغاء",
+        "submitError": "تعذّر الإرسال. حاول مرة أخرى."
+      },
       "feedbackCheckResult": {
         "count": "{count} ملاحظة",
         "expand": "عرض كل الملاحظات",
diff --git a/src/i18n/messages/de.json b/src/i18n/messages/de.json
index 33a9803db..aea507911 100644
--- a/src/i18n/messages/de.json
+++ b/src/i18n/messages/de.json
@@ -2743,6 +2743,17 @@
         "submit": "Senden",
         "submitError": "Senden fehlgeschlagen. Bitte versuche es erneut."
       },
+      "planApproval": {
+        "title": "Der Agent hat einen Plan – bitte prüfen",
+        "emptyPlan": "Der Agent hat keinen Plan geschrieben. Genehmige, um zu starten, oder fordere Änderungen an.",
+        "approve": "Genehmigen & starten",
+        "requestChanges": "Änderungen anfordern",
+        "abandon": "Verwerfen",
+        "feedbackPlaceholder": "Was soll geändert werden?",
+        "sendChanges": "Senden",
+        "cancel": "Abbrechen",
+        "submitError": "Senden fehlgeschlagen. Bitte erneut versuchen."
+      },
       "feedbackCheckResult": {
         "count": "{count, plural, =1 {1 Rückmeldung} other {# Rückmeldungen}}",
         "expand": "Alle Rückmeldungen anzeigen",
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index b34011730..e26c4c074 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -2743,6 +2743,17 @@
         "submit": "Submit",
         "submitError": "Couldn't submit. Please try again."
       },
+      "planApproval": {
+        "title": "The agent has a plan — review it",
+        "emptyPlan": "The agent didn't write a plan. Approve to start building, or request changes.",
+        "approve": "Approve & build",
+        "requestChanges": "Request changes",
+        "abandon": "Abandon",
+        "feedbackPlaceholder": "What should change?",
+        "sendChanges": "Send",
+        "cancel": "Cancel",
+        "submitError": "Couldn't submit. Please try again."
+      },
       "feedbackCheckResult": {
         "count": "{count, plural, =1 {1 feedback note} other {# feedback notes}}",
         "expand": "Show all feedback",
diff --git a/src/i18n/messages/es.json b/src/i18n/messages/es.json
index d6f51d694..543f495d4 100644
--- a/src/i18n/messages/es.json
+++ b/src/i18n/messages/es.json
@@ -2743,6 +2743,17 @@
         "submit": "Enviar",
         "submitError": "No se pudo enviar. Inténtalo de nuevo."
       },
+      "planApproval": {
+        "title": "El agente tiene un plan: revísalo",
+        "emptyPlan": "El agente no escribió un plan. Aprueba para empezar a construir o solicita cambios.",
+        "approve": "Aprobar y construir",
+        "requestChanges": "Solicitar cambios",
+        "abandon": "Descartar",
+        "feedbackPlaceholder": "¿Qué debería cambiar?",
+        "sendChanges": "Enviar",
+        "cancel": "Cancelar",
+        "submitError": "No se pudo enviar. Inténtalo de nuevo."
+      },
       "feedbackCheckResult": {
         "count": "{count, plural, =1 {1 comentario} other {# comentarios}}",
         "expand": "Mostrar todos los comentarios",
diff --git a/src/i18n/messages/fr.json b/src/i18n/messages/fr.json
index 2f4872d2d..6c33178e3 100644
--- a/src/i18n/messages/fr.json
+++ b/src/i18n/messages/fr.json
@@ -2743,6 +2743,17 @@
         "submit": "Envoyer",
         "submitError": "Échec de l'envoi. Veuillez réessayer."
       },
+      "planApproval": {
+        "title": "L'agent a un plan — à vérifier",
+        "emptyPlan": "L'agent n'a pas rédigé de plan. Approuvez pour commencer ou demandez des modifications.",
+        "approve": "Approuver et lancer",
+        "requestChanges": "Demander des modifications",
+        "abandon": "Abandonner",
+        "feedbackPlaceholder": "Que faut-il changer ?",
+        "sendChanges": "Envoyer",
+        "cancel": "Annuler",
+        "submitError": "Échec de l'envoi. Veuillez réessayer."
+      },
       "feedbackCheckResult": {
         "count": "{count, plural, =1 {1 retour} other {# retours}}",
         "expand": "Afficher tous les retours",
diff --git a/src/i18n/messages/ja.json b/src/i18n/messages/ja.json
index b967e41b7..65c794981 100644
--- a/src/i18n/messages/ja.json
+++ b/src/i18n/messages/ja.json
@@ -2743,6 +2743,17 @@
         "submit": "送信",
         "submitError": "送信できませんでした。もう一度お試しください。"
       },
+      "planApproval": {
+        "title": "エージェントが計画を提示しました — 確認してください",
+        "emptyPlan": "エージェントは計画を作成しませんでした。承認して実装を開始するか、変更を依頼してください。",
+        "approve": "承認して開始",
+        "requestChanges": "変更を依頼",
+        "abandon": "破棄",
+        "feedbackPlaceholder": "何を変更しますか？",
+        "sendChanges": "送信",
+        "cancel": "キャンセル",
+        "submitError": "送信できませんでした。もう一度お試しください。"
+      },
       "feedbackCheckResult": {
         "count": "フィードバック {count} 件",
         "expand": "すべてのフィードバックを表示",
diff --git a/src/i18n/messages/ko.json b/src/i18n/messages/ko.json
index 8afa5f450..db9ce15d9 100644
--- a/src/i18n/messages/ko.json
+++ b/src/i18n/messages/ko.json
@@ -2743,6 +2743,17 @@
         "submit": "제출",
         "submitError": "제출하지 못했습니다. 다시 시도해 주세요."
       },
+      "planApproval": {
+        "title": "에이전트가 계획을 제시했습니다 — 검토하세요",
+        "emptyPlan": "에이전트가 계획을 작성하지 않았습니다. 승인하여 구현을 시작하거나 변경을 요청하세요.",
+        "approve": "승인하고 시작",
+        "requestChanges": "변경 요청",
+        "abandon": "포기",
+        "feedbackPlaceholder": "무엇을 변경할까요?",
+        "sendChanges": "보내기",
+        "cancel": "취소",
+        "submitError": "제출하지 못했습니다. 다시 시도하세요."
+      },
       "feedbackCheckResult": {
         "count": "피드백 {count}개",
         "expand": "모든 피드백 표시",
diff --git a/src/i18n/messages/pt.json b/src/i18n/messages/pt.json
index ec305ac09..eb21dd143 100644
--- a/src/i18n/messages/pt.json
+++ b/src/i18n/messages/pt.json
@@ -2743,6 +2743,17 @@
         "submit": "Enviar",
         "submitError": "Falha ao enviar. Tente novamente."
       },
+      "planApproval": {
+        "title": "O agente tem um plano — revise",
+        "emptyPlan": "O agente não escreveu um plano. Aprove para começar ou solicite alterações.",
+        "approve": "Aprovar e construir",
+        "requestChanges": "Solicitar alterações",
+        "abandon": "Descartar",
+        "feedbackPlaceholder": "O que deve mudar?",
+        "sendChanges": "Enviar",
+        "cancel": "Cancelar",
+        "submitError": "Não foi possível enviar. Tente novamente."
+      },
       "feedbackCheckResult": {
         "count": "{count, plural, =1 {1 comentário} other {# comentários}}",
         "expand": "Mostrar todos os comentários",
diff --git a/src/i18n/messages/zh-CN.json b/src/i18n/messages/zh-CN.json
index 63bc86ff5..e087f3cda 100644
--- a/src/i18n/messages/zh-CN.json
+++ b/src/i18n/messages/zh-CN.json
@@ -2743,6 +2743,17 @@
         "submit": "提交",
         "submitError": "提交失败，请重试。"
       },
+      "planApproval": {
+        "title": "智能体已给出计划——请审阅",
+        "emptyPlan": "智能体未写入计划。可批准开始实施，或要求修改。",
+        "approve": "批准并开始",
+        "requestChanges": "要求修改",
+        "abandon": "放弃",
+        "feedbackPlaceholder": "需要修改什么？",
+        "sendChanges": "发送",
+        "cancel": "取消",
+        "submitError": "提交失败，请重试。"
+      },
       "feedbackCheckResult": {
         "count": "{count} 条反馈",
         "expand": "展开全部反馈",
diff --git a/src/i18n/messages/zh-TW.json b/src/i18n/messages/zh-TW.json
index fa41e0178..7790afdcf 100644
--- a/src/i18n/messages/zh-TW.json
+++ b/src/i18n/messages/zh-TW.json
@@ -2743,6 +2743,17 @@
         "submit": "提交",
         "submitError": "提交失敗，請重試。"
       },
+      "planApproval": {
+        "title": "智慧代理已提出計畫——請審閱",
+        "emptyPlan": "智慧代理未寫入計畫。可核准開始實作，或要求修改。",
+        "approve": "核准並開始",
+        "requestChanges": "要求修改",
+        "abandon": "放棄",
+        "feedbackPlaceholder": "需要修改什麼？",
+        "sendChanges": "傳送",
+        "cancel": "取消",
+        "submitError": "提交失敗，請重試。"
+      },
       "feedbackCheckResult": {
         "count": "{count} 則回饋",
         "expand": "展開全部回饋",
diff --git a/src/lib/api.ts b/src/lib/api.ts
index ec4f0f1d6..72c0391f0 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -29,6 +29,7 @@ import type {
   LiveSessionSnapshot,
   FeedbackItem,
   QuestionAnswer,
+  PlanApprovalAnswer,
   AcpAgentInfo,
   AcpAgentStatus,
   AgentDiagnosticsReport,
@@ -283,6 +284,25 @@ export async function acpAnswerQuestion(
   })
 }
 
+/**
+ * Submit the user's decision on a blocking Grok `exit_plan_mode` approval
+ * (approve / request-changes / abandon). Resolves the parked ext request on the
+ * backend (and clears the card on every client via the `plan_approval_resolved`
+ * event). Idempotent: answering an already-resolved / unknown `approvalId` is a
+ * no-op success.
+ */
+export async function acpAnswerPlanApproval(
+  connectionId: string,
+  approvalId: string,
+  answer: PlanApprovalAnswer
+): Promise<void> {
+  return getTransport().call("acp_answer_plan_approval", {
+    connectionId,
+    approvalId,
+    answer,
+  })
+}
+
 export async function acpDisconnect(connectionId: string): Promise<void> {
   return getTransport().call("acp_disconnect", { connectionId })
 }
diff --git a/src/lib/snapshot-denormalize.ts b/src/lib/snapshot-denormalize.ts
index 9cda13b78..c4d95aa7c 100644
--- a/src/lib/snapshot-denormalize.ts
+++ b/src/lib/snapshot-denormalize.ts
@@ -6,6 +6,7 @@ import type {
   LiveContentBlock as WireLiveContentBlock,
   LiveMessage as WireLiveMessage,
   LiveSessionSnapshot,
+  PendingPlanApprovalState,
   PendingQuestionState,
   PromptCapabilitiesInfo,
   SessionConfigOptionInfo,
@@ -49,6 +50,10 @@ export interface SnapshotPatch {
    *  no question is pending. (Distinct from the frontend-only free-text
    *  `pendingQuestion`, which is NOT in the snapshot.) */
   pendingAskQuestion: PendingQuestionState | null
+  /** Awaiting-decision Grok `exit_plan_mode` approval carried by the snapshot,
+   *  so a client attaching mid-turn re-renders the plan-approval card. `null`
+   *  when no approval is pending. */
+  pendingPlanApproval: PendingPlanApprovalState | null
   /** In-flight user prompt carried by the snapshot, so a client attaching
    *  mid-turn can synthesize the user turn (Bug-2 / cross-client viewing).
    *  `null` when no turn is in flight. */
@@ -114,6 +119,8 @@ export function denormalizeSnapshot(wire: LiveSessionSnapshot): SnapshotPatch {
       : null,
     // The snapshot shape already matches PendingQuestionState; pass through.
     pendingAskQuestion: wire.pending_question ?? null,
+    // The snapshot shape already matches PendingPlanApprovalState; pass through.
+    pendingPlanApproval: wire.pending_plan_approval ?? null,
     pendingUserMessage: wire.pending_user_message
       ? {
           messageId: wire.pending_user_message.message_id,
diff --git a/src/lib/types.ts b/src/lib/types.ts
index 328ed89b5..103f362b0 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -1002,6 +1002,29 @@ export interface QuestionAnswer {
   declined: boolean
 }
 
+// --- plan approval (mirror of Rust `crate::acp::plan_approval`) ---
+
+/** Awaiting-decision Grok `exit_plan_mode` approval on the session (mirror of
+ *  Rust `PendingPlanApprovalState`). The agent is blocked until the user acts. */
+export interface PendingPlanApprovalState {
+  approval_id: string
+  tool_call_id: string
+  plan_markdown: string
+  created_at: string
+}
+
+/** Which action the user took on the plan-approval card (mirror of Rust
+ *  `PlanApprovalDecision`). */
+export type PlanApprovalDecision = "approve" | "request_changes" | "abandon"
+
+/** The user's decision submitted to `acp_answer_plan_approval` (mirror of Rust
+ *  `PlanApprovalAnswer`). `feedback` carries the freeform revision notes for a
+ *  `request_changes` decision. */
+export interface PlanApprovalAnswer {
+  decision: PlanApprovalDecision
+  feedback?: string | null
+}
+
 export interface SessionModeInfo {
   id: string
   name: string
@@ -1438,6 +1461,25 @@ export type AcpEvent =
       type: "question_resolved"
       question_id: string
     }
+  /**
+   * A Grok `exit_plan_mode` call: the agent finished planning and is blocked on
+   * the user's approval of the plan. Broadcast so every client renders the
+   * interactive plan-approval card; also captured in the snapshot for attach.
+   */
+  | {
+      type: "plan_approval_request"
+      approval_id: string
+      tool_call_id: string
+      plan_markdown: string
+    }
+  /**
+   * A pending plan approval was answered (from any client) or canceled
+   * (connection drained). Clients clear the matching card.
+   */
+  | {
+      type: "plan_approval_resolved"
+      approval_id: string
+    }
   /**
    * The agent's effective settings (env vars / model provider / native config)
    * changed AFTER this connection spawned, so the running process is still on
@@ -1618,6 +1660,9 @@ export interface LiveSessionSnapshot {
   /** Awaiting-answer `ask_user_question`, recoverable on mid-turn attach.
    *  Absent (omitted) when no question is pending. */
   pending_question?: PendingQuestionState | null
+  /** Awaiting-decision Grok `exit_plan_mode` approval, recoverable on mid-turn
+   *  attach. Absent (omitted) when no approval is pending. */
+  pending_plan_approval?: PendingPlanApprovalState | null
   /** In-flight user prompt for the current turn — lets a client attaching
    *  mid-turn render the user turn. Absent (omitted) when no turn is in flight. */
   pending_user_message?: {

From 78d859df488b8659c31e1075ef1ed468ef8d3ffa Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Fri, 24 Jul 2026 20:23:43 +0800
Subject: [PATCH 10/15] feat(codex): bridge codex-acp elicitation to native ask
 and permission cards
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Advertise elicitation.form to codex and classify every form it sends — Plan-mode request_user_input, generic MCP forms, MCP tool-call approvals, and message-only confirms — into either the interactive ask card or the permission card, replying with typed content.

Render the request_user_input ask consistently: synthesized in-stream while live, and standalone with the chosen answer echoed on history reload (hoisted out of the generic tool group, with codex's id-keyed answer envelope now parsed).

Pin codex-acp 1.1.7, keep the codeg-mcp injection from being dropped by config.toml name filtering, render <proposed_plan> as a markdown card, and run each ACP connection on a dedicated 8 MiB thread to avoid a debug-only stack overflow.

Mask secret answers, and support free-text (option-less) questions in the ask card.
---
 src-tauri/Cargo.toml                          |    2 +-
 src-tauri/src/acp/connection.rs               |  501 +++++++-
 src-tauri/src/acp/delegation/listener.rs      |    1 +
 src-tauri/src/acp/manager.rs                  |    1 +
 src-tauri/src/acp/question.rs                 | 1022 ++++++++++++++++-
 src-tauri/src/acp/registry.rs                 |   30 +-
 .../src/chat_channel/event_subscriber.rs      |    1 +
 .../src/chat_channel/message_formatter.rs     |    1 +
 src-tauri/tests/delegation_e2e_uds.rs         |    2 +
 .../chat/ask-question-card.test.tsx           |   50 +
 src/components/chat/ask-question-card.tsx     |   29 +-
 .../message/ask-question-result-card.test.tsx |   42 +
 .../message/ask-question-result-card.tsx      |   18 +-
 .../message/content-parts-renderer.tsx        |   33 +
 src/i18n/messages/ar.json                     |    4 +
 src/i18n/messages/de.json                     |    4 +
 src/i18n/messages/en.json                     |    4 +
 src/i18n/messages/es.json                     |    4 +
 src/i18n/messages/fr.json                     |    4 +
 src/i18n/messages/ja.json                     |    4 +
 src/i18n/messages/ko.json                     |    4 +
 src/i18n/messages/pt.json                     |    4 +
 src/i18n/messages/zh-CN.json                  |    4 +
 src/i18n/messages/zh-TW.json                  |    4 +
 src/lib/adapters/ai-elements-adapter.test.ts  |   51 +
 src/lib/adapters/ai-elements-adapter.ts       |   82 ++
 src/lib/adapters/tool-kind-classifier.test.ts |    6 +
 src/lib/adapters/tool-kind-classifier.ts      |    4 +
 src/lib/ask-question.test.ts                  |   69 ++
 src/lib/ask-question.ts                       |   65 +-
 src/lib/types.ts                              |    6 +-
 31 files changed, 1976 insertions(+), 80 deletions(-)

diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 45304bc0f..274f1ba98 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -100,7 +100,7 @@ toml_edit = "0.19"
 serde_yaml = "0.9"
 notify = "6"
 base64 = "0.22"
-agent-client-protocol-schema = { version = "0.11", features = ["unstable_session_usage", "unstable_session_fork", "unstable_session_resume"] }
+agent-client-protocol-schema = { version = "0.11", features = ["unstable_session_usage", "unstable_session_fork", "unstable_session_resume", "unstable_elicitation"] }
 kill_tree = { version = "0.2", features = ["tokio"] }
 which = "7"
 keyring = { version = "3", features = ["apple-native", "windows-native", "sync-secret-service"], optional = true }
diff --git a/src-tauri/src/acp/connection.rs b/src-tauri/src/acp/connection.rs
index e790e401b..1641951d3 100644
--- a/src-tauri/src/acp/connection.rs
+++ b/src-tauri/src/acp/connection.rs
@@ -4,7 +4,8 @@ use std::sync::Arc;
 
 use sacp::schema::{
     BlobResourceContents, CancelNotification, ClientCapabilities, ContentBlock, ContentChunk,
-    CreateTerminalRequest, CreateTerminalResponse, EmbeddedResource, EmbeddedResourceResource,
+    CreateTerminalRequest, CreateTerminalResponse,
+    ElicitationCapabilities, ElicitationFormCapabilities, EmbeddedResource, EmbeddedResourceResource,
     FileSystemCapabilities, ImageContent, InitializeRequest, KillTerminalRequest,
     KillTerminalResponse, LoadSessionRequest, NewSessionRequest, NewSessionResponse,
     PermissionOptionKind, Plan, PlanEntryPriority, PlanEntryStatus, PromptRequest, ProtocolVersion,
@@ -128,6 +129,23 @@ fn apply_grok_env_policy(merged: &mut Vec<(String, String)>, runtime_env: &BTree
     }
 }
 
+/// Codex-only launch policy: force codex-acp's MCP name-conflict de-duplication
+/// OFF. codeg injects its companion server (`codeg-mcp`) over ACP
+/// `session/new.mcpServers`; codex-acp otherwise drops any ACP-passed server
+/// whose name collides with a `config.toml` entry — global *or* project layer
+/// (the check was widened to project `.codex/config.toml` in codex-acp #322) —
+/// silently stripping codeg-mcp and with it ask_user_question / delegation /
+/// feedback / session_info. The late `retain` + `push` makes the override win
+/// over any user `runtime_env` twin, so the injection is guaranteed to survive.
+fn apply_codex_env_policy(agent_type: AgentType, merged: &mut Vec<(String, String)>) {
+    if agent_type != AgentType::Codex {
+        return;
+    }
+    let key = "DISABLE_MCP_CONFIG_FILTERING";
+    merged.retain(|(k, _)| k != key);
+    merged.push((key.to_string(), "true".to_string()));
+}
+
 /// Prepend `dir` to the PATH entry of `env`, seeding from `fallback_path` when
 /// `env` has no PATH key of its own. Removes any pre-existing PATH key first
 /// (case-insensitively when `windows`, since Windows env keys are
@@ -394,6 +412,7 @@ async fn build_agent(
                 crate::commands::acp::seed_pi_workspace_trust(cwd, runtime_env);
             }
             let mut merged_env = merge_agent_env(env, runtime_env);
+            apply_codex_env_policy(agent_type, &mut merged_env);
             // codex-acp 1.0.0 honors APP_SERVER_LOGS as a directory for its
             // adapter-side logs. Surface it only under CODEG_ACP_DEBUG so
             // default runs are unchanged; a directory-creation failure silently
@@ -752,6 +771,23 @@ async fn build_agent(
     })
 }
 
+/// Stack size for the dedicated OS thread that drives each ACP connection's
+/// `run_connection` future (see the spawn site below). `run_connection` is one
+/// colossal async state machine — the full per-connection message loop plus
+/// every registered client-request handler — and in DEBUG builds the compiler
+/// does not pack async locals, so a single poll of the connection closure needs
+/// far more than a default ~2 MiB Tokio worker-thread stack. Left on the worker
+/// pool it overflowed the stack and aborted the whole process under `tauri dev`
+/// (release builds pack the frame small enough to fit, which is why only debug
+/// crashed). 8 MiB matches the macOS main-thread stack — 4x the default that
+/// overflowed, generous headroom for the debug frame as ACP features accrete.
+/// The stack is reserved address space, lazily committed, so it costs no
+/// physical memory beyond the pages actually touched (~the real 2-3 MiB the
+/// frame uses), regardless of this cap — so the larger reservation is free. If a
+/// future ACP feature ever grows the loop past even this, split `run_connection`
+/// into boxed sub-futures rather than raising it further.
+const ACP_CONNECTION_STACK_SIZE: usize = 8 * 1024 * 1024;
+
 /// Spawn an ACP agent process and run the connection loop in a background task.
 ///
 /// On success, the newly created `AgentConnection` is inserted into
@@ -866,14 +902,30 @@ pub async fn spawn_agent_connection(
         },
     );
 
-    tokio::spawn(async move {
-        // RAII guard: runs on normal exit AND on panic unwinding, so a
-        // panic inside `run_connection` can't leak a stale map entry.
-        let _cleanup = ConnectionCleanupGuard {
-            connections: cleanup_connections,
-            connection_id: cleanup_connection_id,
-        };
-
+    // Drive `run_connection` on a dedicated, large-stack thread (see
+    // ACP_CONNECTION_STACK_SIZE) rather than a Tokio worker task: its debug
+    // poll frame is too big for a default ~2 MiB worker stack and was aborting
+    // the process under `tauri dev`. `Handle::block_on` runs it on the SAME
+    // shared runtime, so `tokio::spawn`/timers/IO inside `run_connection` still
+    // use the pool — only the giant top-level frame moves to the roomy stack.
+    // The connection is fire-and-forget (torn down from within via `cmd_rx` /
+    // process exit; no JoinHandle is awaited), so a thread is behaviorally
+    // equivalent to the previous task.
+    let connection_rt = tokio::runtime::Handle::current();
+    // RAII guard built OUTSIDE the thread body and moved in: on a normal exit
+    // or panic unwind its Drop removes the manager map entry, AND if the thread
+    // fails to spawn the dropped closure runs the same Drop — so the entry is
+    // never leaked.
+    let cleanup_guard = ConnectionCleanupGuard {
+        connections: cleanup_connections,
+        connection_id: cleanup_connection_id,
+    };
+    let connection_thread = std::thread::Builder::new()
+        .name(format!("acp-conn-{conn_id}"))
+        .stack_size(ACP_CONNECTION_STACK_SIZE)
+        .spawn(move || {
+            let _cleanup = cleanup_guard;
+            connection_rt.block_on(async move {
         let delegation_for_cleanup = delegation_injection.clone();
         let result = run_connection(
             agent,
@@ -950,16 +1002,80 @@ pub async fn spawn_agent_connection(
             },
         )
         .await;
-        // `_cleanup` is dropped here — removes the connection entry from
-        // the manager map. Same drop semantics apply on panic unwinding.
-    });
+                // Connection loop ended; `block_on` returns and `_cleanup`
+                // (bound at the top of the thread body) drops next, removing
+                // the manager map entry — same as on a panic unwind.
+            });
+        });
+    if let Err(e) = connection_thread {
+        // Thread creation only fails on OS resource exhaustion. Dropping the
+        // un-spawned closure already ran `cleanup_guard`'s Drop (removing the
+        // map entry), so just surface the failure and let the caller abort.
+        tracing::error!("[ACP] failed to spawn connection driver thread: {e}");
+        return Err(AcpError::SpawnFailed(format!(
+            "connection driver thread: {e}"
+        )));
+    }
 
     Ok(session_started_rx)
 }
 
+/// A pending permission-card responder. `Acp` is a real ACP
+/// `session/request_permission`; `CodexElicitation` is a codex approval-style
+/// `elicitation/create` (MCP tool-call approval / message-only confirm) routed
+/// through the SAME permission card so approvals look exactly like they did
+/// before codeg advertised `elicitation.form` — its chosen option answers the
+/// blocked elicitation request instead (see `handle_elicitation_request`).
+enum PendingPermission {
+    Acp(Responder<RequestPermissionResponse>),
+    CodexElicitation {
+        responder: Responder<serde_json::Value>,
+        approval: crate::acp::question::ElicitationApproval,
+    },
+}
+
+impl PendingPermission {
+    /// Resolve with the user's chosen option id.
+    fn respond_selected(self, option_id: String) {
+        match self {
+            PendingPermission::Acp(responder) => {
+                let outcome =
+                    RequestPermissionOutcome::Selected(SelectedPermissionOutcome::new(option_id));
+                let _ = responder.respond(RequestPermissionResponse::new(outcome));
+            }
+            PendingPermission::CodexElicitation {
+                responder,
+                approval,
+            } => {
+                let response = crate::acp::question::build_elicitation_approval_response(
+                    &approval, &option_id,
+                );
+                let _ = responder.respond(serde_json::to_value(response).unwrap_or_default());
+            }
+        }
+    }
+
+    /// Resolve as cancelled — the turn ended / connection tore down before the
+    /// user chose.
+    fn respond_cancelled(self) {
+        match self {
+            PendingPermission::Acp(responder) => {
+                let _ = responder.respond(RequestPermissionResponse::new(
+                    RequestPermissionOutcome::Cancelled,
+                ));
+            }
+            PendingPermission::CodexElicitation { responder, .. } => {
+                let _ = responder.respond(
+                    serde_json::to_value(crate::acp::question::elicitation_cancel_response())
+                        .unwrap_or_default(),
+                );
+            }
+        }
+    }
+}
+
 /// Shared state for pending permission responders.
-type PendingPermissions =
-    Arc<tokio::sync::Mutex<HashMap<String, Responder<RequestPermissionResponse>>>>;
+type PendingPermissions = Arc<tokio::sync::Mutex<HashMap<String, PendingPermission>>>;
 
 fn map_session_modes(mode_state: &SessionModeState) -> SessionModeStateInfo {
     SessionModeStateInfo {
@@ -2531,18 +2647,64 @@ async fn run_connection(
             },
             on_receive_request!(),
         )
+        .on_receive_request(
+            {
+                // Codex `elicitation/create`: question-style requests (Plan
+                // mode `request_user_input`, generic MCP forms) bridge into
+                // the same ask card as the codeg-mcp ask tool (reusing the ask
+                // access + kill switch); approval-style requests (MCP
+                // tool-call approvals, message-only confirms) route through
+                // the permission card via `pending_perms`.
+                let access = grok_ask_access.clone();
+                let conn_id = grok_ask_conn_id.clone();
+                let perms = perms.clone();
+                let state_inner = Arc::clone(&state);
+                let emitter_inner = emitter_clone.clone();
+                async move |req: CodexElicitationRequest,
+                            responder: Responder<serde_json::Value>,
+                            _cx: ConnectionTo<Agent>| {
+                    handle_elicitation_request(
+                        &access,
+                        &perms,
+                        &state_inner,
+                        &emitter_inner,
+                        &conn_id,
+                        req,
+                        responder,
+                    )
+                    .await;
+                    Ok(())
+                }
+            },
+            on_receive_request!(),
+        )
         .connect_with(agent, async move |cx| -> Result<(), sacp::Error> {
             let state = state_outer;
             let agent_name_for_log = registry::get_agent_meta(agent_type).name;
 
             // Advertise filesystem + terminal capabilities for ACP tool execution.
-            let init_request = InitializeRequest::new(ProtocolVersion::LATEST).client_capabilities(
-                ClientCapabilities::new()
-                    .terminal(true)
-                    .fs(FileSystemCapabilities::new()
-                        .read_text_file(true)
-                        .write_text_file(true)),
-            );
+            let mut client_capabilities = ClientCapabilities::new()
+                .terminal(true)
+                .fs(FileSystemCapabilities::new()
+                    .read_text_file(true)
+                    .write_text_file(true));
+            // Codex only: advertise form elicitation so codex's native Plan-mode
+            // `request_user_input` tool is delivered as an `elicitation/create`
+            // request (handled below) instead of being silently answered `{}`.
+            // NOTE this reroutes codex's WHOLE form-elicitation surface — MCP
+            // tool-call approvals and MCP-server forms included — so the
+            // handler must cover every shape (`classify_elicitation`). URL
+            // elicitation is deliberately NOT advertised: codex-acp then falls
+            // back to `session/request_permission`, which codeg already
+            // handles. Scoped to Codex to keep the blast radius off other
+            // agents (e.g. Claude's native AskUserQuestion, which would
+            // otherwise un-gate and duplicate the codeg-mcp ask tool).
+            if agent_type == AgentType::Codex {
+                client_capabilities = client_capabilities
+                    .elicitation(ElicitationCapabilities::new().form(ElicitationFormCapabilities::new()));
+            }
+            let init_request = InitializeRequest::new(ProtocolVersion::LATEST)
+                .client_capabilities(client_capabilities);
             // Bound the Initialize handshake so an outdated / incompatible
             // cached binary that never responds can't leave the frontend
             // stuck on "Connecting...". A healthy agent answers in <1s; we
@@ -3206,6 +3368,19 @@ async fn run_connection(
 #[serde(transparent)]
 struct GrokAskUserQuestionRequest(serde_json::Value);
 
+/// Every codex `elicitation/create` request — `request_user_input` (Plan
+/// mode), generic MCP-server forms, MCP tool-call approvals, message-only
+/// confirms — arrives here once codeg advertises `elicitation.form`. sacp
+/// 11.0.0 ships no `JsonRpcRequest`/`JsonRpcResponse` impl for the schema's
+/// elicitation types (and no feature to enable them), so — like the grok bridge
+/// — take the raw params object and reply with a raw JSON value (the serialized
+/// `CreateElicitationResponse`). sacp has no built-in elicitation handling, so
+/// this custom method handler fills the gap with no dispatch conflict.
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, JsonRpcRequest)]
+#[request(method = "elicitation/create", response = serde_json::Value)]
+#[serde(transparent)]
+struct CodexElicitationRequest(serde_json::Value);
+
 /// Bridge grok's native `_x.ai/ask_user_question` ext request into codeg's
 /// interactive question card. Grok blocks on the reply, so codeg registers the
 /// questions through the shared [`crate::acp::question::SessionQuestionAccess`] —
@@ -3311,6 +3486,217 @@ async fn handle_grok_ask_user_question(
     });
 }
 
+/// Bridge codex's `elicitation/create` requests into codeg's interactive
+/// surfaces. Codex only sends these when codeg declares `elicitation.form`
+/// (see `connect_with`), then BLOCKS on the reply, so every shape must resolve
+/// to something the user can act on (see
+/// [`crate::acp::question::classify_elicitation`] for the full taxonomy):
+///
+///   * Question-style (Plan-mode `request_user_input`, generic MCP forms) →
+///     the shared [`crate::acp::question::SessionQuestionAccess`] path — the
+///     SAME one the codeg-mcp ask tool and the grok bridge use (it sets
+///     `pending_question`, broadcasts `QuestionRequest`, and `AskQuestionCard`
+///     renders) — answered once the user submits.
+///   * Approval-style (MCP tool-call approvals, message-only confirms) → the
+///     permission card via `pending_perms`, exactly like the
+///     `session/request_permission` fallback codex-acp used before the
+///     capability was advertised. Auto-declining these would reject the tool
+///     call (including codeg-mcp's own tools in consent-requiring modes).
+///
+/// Question-path early returns DECLINE, which makes codex proceed with its own
+/// judgment — no worse than the pre-bridge `{answers:{}}`, so nothing here can
+/// regress it. Codex delivers `request_user_input` ONLY as this elicitation and
+/// never puts a completed tool_call on the stream, so — like the grok bridge —
+/// the question path synthesizes the answered result card itself once the user
+/// submits (keyed by the elicitation's tool_call_id).
+#[allow(clippy::too_many_arguments)]
+async fn handle_elicitation_request(
+    access: &Option<(
+        Arc<dyn crate::acp::question::SessionQuestionAccess>,
+        crate::acp::question::QuestionRuntimeConfig,
+    )>,
+    perms: &PendingPermissions,
+    state: &Arc<RwLock<SessionState>>,
+    emitter: &EventEmitter,
+    connection_id: &str,
+    req: CodexElicitationRequest,
+    responder: Responder<serde_json::Value>,
+) {
+    // The wire reply is the serialized `CreateElicitationResponse` (see the
+    // newtype above). `Decline` makes codex proceed with its own judgment.
+    fn decline() -> serde_json::Value {
+        serde_json::to_value(crate::acp::question::elicitation_decline_response())
+            .unwrap_or_default()
+    }
+    let raw = req.0;
+    // Everything codex-acp can send once `elicitation.form` is advertised
+    // resolves to a plan here — an unhandled shape would silently reject the
+    // agent's blocked request (an MCP tool-call approval, most damagingly).
+    let plan = match crate::acp::question::classify_elicitation(&raw) {
+        Ok(plan) => plan,
+        Err(e) => {
+            tracing::warn!("[codex elicitation] declining unrenderable request: {e}");
+            let _ = responder.respond(decline());
+            return;
+        }
+    };
+    match plan {
+        // Approval-style (MCP tool-call approval / message-only confirm):
+        // render through the permission card — the exact surface these used
+        // before codeg advertised `elicitation.form` (codex-acp then sent
+        // `session/request_permission`). Deliberately NOT gated by the
+        // ask_user_question toggle: this is consent, not an agent question,
+        // and auto-declining would reject the tool call outright.
+        crate::acp::question::ElicitationPlan::Approval(approval) => {
+            let request_id = uuid::Uuid::new_v4().to_string();
+            // Mirror codex-acp's own `request_permission` fallback tool_call
+            // shape (`buildPermissionRequest`) so the frontend permission card
+            // renders it identically. When codex correlated the approval to an
+            // already-rendered mcpToolCall item, reuse that id so the card
+            // attaches to it.
+            let tool_call = serde_json::json!({
+                "toolCallId": approval
+                    .tool_call_id
+                    .clone()
+                    .unwrap_or_else(|| format!("elicitation-{request_id}")),
+                "title": approval.message,
+                "kind": "execute",
+                "status": "pending",
+                "content": [{
+                    "type": "content",
+                    "content": {"type": "text", "text": approval.message},
+                }],
+            });
+            let options: Vec<PermissionOptionInfo> = approval
+                .options
+                .iter()
+                .map(|o| PermissionOptionInfo {
+                    option_id: o.option_id.clone(),
+                    name: o.label.clone(),
+                    kind: o.kind.to_string(),
+                })
+                .collect();
+            perms.lock().await.insert(
+                request_id.clone(),
+                PendingPermission::CodexElicitation {
+                    responder,
+                    approval,
+                },
+            );
+            emit_with_state(
+                state,
+                emitter,
+                AcpEvent::PermissionRequest {
+                    request_id,
+                    tool_call,
+                    options,
+                },
+            )
+            .await;
+        }
+        // Question-style (codex `request_user_input`, generic MCP forms):
+        // bridge into the same ask card as the codeg-mcp ask tool.
+        crate::acp::question::ElicitationPlan::Questions(questions) => {
+            let Some((question_access, ask_cfg)) = access else {
+                let _ = responder.respond(decline());
+                return;
+            };
+            // Same kill switch as the codeg-mcp ask tool and the grok bridge:
+            // when the user has turned ask_user_question off, decline so codex
+            // proceeds.
+            if !ask_cfg.is_enabled().await {
+                let _ = responder.respond(decline());
+                return;
+            }
+            // register_question consumes the specs; `questions` keeps its copy
+            // to correlate the answer back to each field when building the
+            // response.
+            let Some(registered) = question_access
+                .register_question(connection_id, questions.specs.clone())
+                .await
+            else {
+                // Connection gone, or an ask is already pending on this connection.
+                let _ = responder.respond(decline());
+                return;
+            };
+            // Codex advertises an auto-resolution timeout on some
+            // `request_user_input` asks (`_meta.codex.autoResolutionMs`):
+            // codex-acp races the elicitation against it and answers
+            // `{answers: {}}` itself on expiry, ABANDONING this request. Reap
+            // the by-then-pointless card shortly after so it can't linger as a
+            // zombie; `cancel_question` is a no-op if the user already
+            // answered.
+            if let Some(ms) = crate::acp::question::elicitation_auto_resolution_ms(&raw) {
+                let reaper_access = Arc::clone(question_access);
+                let reaper_conn = connection_id.to_string();
+                let reaper_qid = registered.question_id.clone();
+                tokio::spawn(async move {
+                    tokio::time::sleep(std::time::Duration::from_millis(
+                        ms.saturating_add(2_000),
+                    ))
+                    .await;
+                    reaper_access.cancel_question(&reaper_conn, &reaper_qid).await;
+                });
+            }
+            // The user answers out-of-band (the `answer_question` endpoint
+            // resolves the one-shot below), so await it on a task — keeping
+            // the ACP dispatch loop free — then reply to codex's blocked
+            // elicitation request. Cloned here so the synthesized card below can
+            // write through the session state from the spawned task.
+            let card_state = Arc::clone(state);
+            let card_emitter = emitter.clone();
+            tokio::spawn(async move {
+                let response = match registered.answer_rx.await {
+                    Ok(outcome) => {
+                        // Surface the answered "提问回答" capsule in-stream — the
+                        // parity codex's `request_user_input` never emits itself: it
+                        // resolves the answer over THIS elicitation round-trip and
+                        // puts no completed tool_call on the ACP stream (so the live
+                        // message has nothing to render otherwise). Emit BEFORE
+                        // unblocking codex so the card lands ahead of its follow-up
+                        // text; codex is blocked on this reply, so nothing races the
+                        // emit. Keyed by the elicitation's tool_call_id so this is
+                        // the single card for the ask and the reloaded history card
+                        // (`codex.rs`, same id) replaces rather than duplicates it.
+                        if let Some(tool_call_id) = questions.tool_call_id.clone() {
+                            emit_with_state(
+                                &card_state,
+                                &card_emitter,
+                                AcpEvent::ToolCall {
+                                    tool_call_id,
+                                    title: "request_user_input".to_string(),
+                                    kind: "other".to_string(),
+                                    status: "completed".to_string(),
+                                    content: None,
+                                    raw_input: Some(
+                                        crate::acp::question::grok_result_card_input(
+                                            &questions.specs,
+                                        )
+                                        .to_string(),
+                                    ),
+                                    raw_output: Some(
+                                        crate::acp::question::grok_result_card_output(&outcome)
+                                            .to_string(),
+                                    ),
+                                    locations: None,
+                                    meta: None,
+                                    images: None,
+                                },
+                            )
+                            .await;
+                        }
+                        crate::acp::question::build_elicitation_response(&questions, &outcome)
+                    }
+                    // Sender dropped: canceled or the connection tore down.
+                    // Decline so codex proceeds with its own judgment.
+                    Err(_) => crate::acp::question::elicitation_decline_response(),
+                };
+                let _ = responder.respond(serde_json::to_value(response).unwrap_or_default());
+            });
+        }
+    }
+}
+
 async fn handle_permission_request(
     state: &Arc<RwLock<SessionState>>,
     emitter: &EventEmitter,
@@ -3369,7 +3755,10 @@ async fn handle_permission_request(
         }
     }
 
-    perms.lock().await.insert(request_id.clone(), responder);
+    perms
+        .lock()
+        .await
+        .insert(request_id.clone(), PendingPermission::Acp(responder));
 
     emit_with_state(
         state,
@@ -4860,11 +5249,8 @@ async fn run_conversation_loop<'a>(
                                     request_id,
                                     option_id,
                                 }) => {
-                                    if let Some(responder) = perms.lock().await.remove(&request_id) {
-                                        let outcome = RequestPermissionOutcome::Selected(
-                                            SelectedPermissionOutcome::new(option_id),
-                                        );
-                                        let _ = responder.respond(RequestPermissionResponse::new(outcome));
+                                    if let Some(pending) = perms.lock().await.remove(&request_id) {
+                                        pending.respond_selected(option_id);
                                         emit_with_state(
                                             state,
                                             emitter,
@@ -4962,10 +5348,8 @@ async fn run_conversation_loop<'a>(
                                     tracked_terminal_tool_calls.clear();
                                     // Also cancel any pending permission requests
                                     let mut locked = perms.lock().await;
-                                    for (_, responder) in locked.drain() {
-                                        let _ = responder.respond(RequestPermissionResponse::new(
-                                            RequestPermissionOutcome::Cancelled,
-                                        ));
+                                    for (_, pending) in locked.drain() {
+                                        pending.respond_cancelled();
                                     }
                                     drop(locked);
                                     // Immediately emit TurnComplete so the frontend
@@ -5034,10 +5418,8 @@ async fn run_conversation_loop<'a>(
                                         .await;
                                     tracked_terminal_tool_calls.clear();
                                     let mut locked = perms.lock().await;
-                                    for (_, responder) in locked.drain() {
-                                        let _ = responder.respond(RequestPermissionResponse::new(
-                                            RequestPermissionOutcome::Cancelled,
-                                        ));
+                                    for (_, pending) in locked.drain() {
+                                        pending.respond_cancelled();
                                     }
                                     disconnect_requested = true;
                                     break;
@@ -5068,11 +5450,8 @@ async fn run_conversation_loop<'a>(
                 request_id,
                 option_id,
             }) => {
-                if let Some(responder) = perms.lock().await.remove(&request_id) {
-                    let outcome = RequestPermissionOutcome::Selected(
-                        SelectedPermissionOutcome::new(option_id),
-                    );
-                    let _ = responder.respond(RequestPermissionResponse::new(outcome));
+                if let Some(pending) = perms.lock().await.remove(&request_id) {
+                    pending.respond_selected(option_id);
                     emit_with_state(state, emitter, AcpEvent::PermissionResolved { request_id })
                         .await;
                 }
@@ -5152,10 +5531,8 @@ async fn run_conversation_loop<'a>(
                     .release_all_for_session(sid.0.as_ref())
                     .await;
                 let mut locked = perms.lock().await;
-                for (_, responder) in locked.drain() {
-                    let _ = responder.respond(RequestPermissionResponse::new(
-                        RequestPermissionOutcome::Cancelled,
-                    ));
+                for (_, pending) in locked.drain() {
+                    pending.respond_cancelled();
                 }
                 drop(locked);
                 // Cascade-cancel any pending delegations owned by this parent.
@@ -6971,6 +7348,42 @@ mod tests {
         }
     }
 
+    #[test]
+    fn codex_env_policy_forces_mcp_filter_off_and_overrides_user_twin() {
+        // Codex gets the flag injected so codex-acp never drops the injected
+        // `codeg-mcp` server on a config.toml name collision.
+        let mut env = vec![("PATH".to_string(), "/usr/bin".to_string())];
+        apply_codex_env_policy(AgentType::Codex, &mut env);
+        assert!(env
+            .iter()
+            .any(|(k, v)| k == "DISABLE_MCP_CONFIG_FILTERING" && v == "true"));
+
+        // A user-supplied twin is replaced (not duplicated) so the override wins.
+        let mut with_twin = vec![(
+            "DISABLE_MCP_CONFIG_FILTERING".to_string(),
+            "false".to_string(),
+        )];
+        apply_codex_env_policy(AgentType::Codex, &mut with_twin);
+        let hits: Vec<_> = with_twin
+            .iter()
+            .filter(|(k, _)| k == "DISABLE_MCP_CONFIG_FILTERING")
+            .collect();
+        assert_eq!(hits.len(), 1, "no duplicate key");
+        assert_eq!(hits[0].1, "true", "codeg override wins over user twin");
+    }
+
+    #[test]
+    fn codex_env_policy_is_noop_for_other_agents() {
+        for agent in [AgentType::Grok, AgentType::ClaudeCode, AgentType::Gemini] {
+            let mut env = vec![("PATH".to_string(), "/usr/bin".to_string())];
+            apply_codex_env_policy(agent, &mut env);
+            assert!(
+                !env.iter().any(|(k, _)| k == "DISABLE_MCP_CONFIG_FILTERING"),
+                "{agent:?} must not receive the codex-only flag"
+            );
+        }
+    }
+
     #[test]
     fn synthesize_edit_single_diff_makes_canonical_edit() {
         let content = vec![diff_content("/a.rs", Some("old line\n"), "new line\n")];
diff --git a/src-tauri/src/acp/delegation/listener.rs b/src-tauri/src/acp/delegation/listener.rs
index 439298018..db57cda62 100644
--- a/src-tauri/src/acp/delegation/listener.rs
+++ b/src-tauri/src/acp/delegation/listener.rs
@@ -1859,6 +1859,7 @@ mod tests {
                         description: String::new(),
                     },
                 ],
+                is_secret: false,
             }],
         })
     }
diff --git a/src-tauri/src/acp/manager.rs b/src-tauri/src/acp/manager.rs
index fa1cc2319..f3a44aee1 100644
--- a/src-tauri/src/acp/manager.rs
+++ b/src-tauri/src/acp/manager.rs
@@ -5414,6 +5414,7 @@ mod tests {
                     description: String::new(),
                 },
             ],
+            is_secret: false,
         }]
     }
 
diff --git a/src-tauri/src/acp/question.rs b/src-tauri/src/acp/question.rs
index 6a1c257dd..9963b6501 100644
--- a/src-tauri/src/acp/question.rs
+++ b/src-tauri/src/acp/question.rs
@@ -29,8 +29,14 @@ use std::sync::Arc;
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
+use sacp::schema::{
+    CreateElicitationRequest, CreateElicitationResponse, ElicitationAcceptAction, ElicitationAction,
+    ElicitationContentValue, ElicitationMode, ElicitationPropertySchema, ElicitationScope,
+    MultiSelectItems, StringPropertySchema,
+};
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
+use std::collections::BTreeMap;
 use tokio::sync::{oneshot, RwLock};
 
 /// Max questions per `ask_user_question` call. Matches Claude Code's
@@ -74,8 +80,17 @@ pub struct QuestionSpec {
     pub header: String,
     /// When true the user may select multiple options.
     pub multi_select: bool,
-    /// The choices ([`MIN_OPTIONS`]..=[`MAX_OPTIONS`]).
+    /// The choices (0..=[`MAX_OPTIONS`]). Empty means free-text: the card
+    /// renders only its always-present "Other" input (codex `request_user_input`
+    /// and MCP-server elicitations both ask open questions this way; the
+    /// codeg-mcp ask tool still requires [`MIN_OPTIONS`] at its own parse
+    /// layer).
     pub options: Vec<QuestionOption>,
+    /// True when the answer is a secret (codex `request_user_input` marks API
+    /// keys etc. with `_meta.codex.isSecret`): the card masks the free-text
+    /// input. Default false — absent on the wire for every non-secret source.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub is_secret: bool,
 }
 
 /// The pending (awaiting-answer) question set stored on
@@ -276,6 +291,7 @@ pub fn parse_questions(arguments: &Value) -> Result<Vec<QuestionSpec>, String> {
             header: header.to_string(),
             multi_select,
             options,
+            is_secret: false,
         });
     }
     Ok(out)
@@ -323,9 +339,14 @@ pub fn validate_specs(specs: &[QuestionSpec]) -> Result<(), String> {
                 "questions[{qi}] `header` exceeds {MAX_HEADER_CHARS} characters"
             ));
         }
-        if q.options.len() < MIN_OPTIONS || q.options.len() > MAX_OPTIONS {
+        // Unlike `parse_questions` (the codeg-mcp tool contract, which keeps
+        // its [`MIN_OPTIONS`] floor), typed specs allow 0..=[`MAX_OPTIONS`]:
+        // a question with no options is a legal free-text ask — the card
+        // renders its always-present "Other" input alone (codex elicitation
+        // and MCP-server forms ask open questions this way).
+        if q.options.len() > MAX_OPTIONS {
             return Err(format!(
-                "questions[{qi}] must have between {MIN_OPTIONS} and {MAX_OPTIONS} options"
+                "questions[{qi}] must have at most {MAX_OPTIONS} options"
             ));
         }
         let mut seen_labels = std::collections::HashSet::new();
@@ -526,6 +547,7 @@ pub fn parse_grok_ext_questions(params: &Value) -> Result<Vec<QuestionSpec>, Str
             header: synthesize_grok_header(question),
             multi_select,
             options,
+            is_secret: false,
         });
     }
     Ok(out)
@@ -573,19 +595,621 @@ pub fn grok_ext_skip_response() -> Value {
     serde_json::json!({ "outcome": "skip_interview" })
 }
 
+/// One selectable choice lifted from a schema property: the display `label`
+/// (`title`, falling back to the wire value) and the `value` (`const` / `enum`
+/// entry) the accept response must send back. The two differ when a generic
+/// MCP server elicits with `enum` + `enumNames` (codex-acp normalizes that to
+/// `oneOf` with `const` ≠ `title`); codex's own `request_user_input` sets them
+/// identical. The typed schema drops per-option descriptions, so they are left
+/// empty (the card renders fine without one).
+struct ElicitationChoice {
+    label: String,
+    value: String,
+}
+
+fn string_prop_choices(s: &StringPropertySchema) -> Vec<ElicitationChoice> {
+    if let Some(one_of) = &s.one_of {
+        return one_of
+            .iter()
+            .map(|o| ElicitationChoice {
+                label: if o.title.trim().is_empty() {
+                    o.value.clone()
+                } else {
+                    o.title.clone()
+                },
+                value: o.value.clone(),
+            })
+            .collect();
+    }
+    if let Some(values) = &s.enum_values {
+        return values
+            .iter()
+            .map(|v| ElicitationChoice {
+                label: v.clone(),
+                value: v.clone(),
+            })
+            .collect();
+    }
+    Vec::new()
+}
+
+fn multi_select_choices(items: &MultiSelectItems) -> Vec<ElicitationChoice> {
+    match items {
+        MultiSelectItems::Titled(t) => t
+            .options
+            .iter()
+            .map(|o| ElicitationChoice {
+                label: if o.title.trim().is_empty() {
+                    o.value.clone()
+                } else {
+                    o.title.clone()
+                },
+                value: o.value.clone(),
+            })
+            .collect(),
+        MultiSelectItems::Untitled(u) => u
+            .values
+            .iter()
+            .map(|v| ElicitationChoice {
+                label: v.clone(),
+                value: v.clone(),
+            })
+            .collect(),
+        // `MultiSelectItems` is `#[non_exhaustive]`; an unknown item kind
+        // yields no options — the question degrades to free text.
+        _ => Vec::new(),
+    }
+}
+
+/// How one form field's answer must be typed in the elicitation response.
+/// MCP servers validate the accepted content against their schema, so a
+/// boolean/number field answered with a string would be rejected — each
+/// answer is rebuilt into the schema's own primitive.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ElicitationFieldKind {
+    /// Single-select or free-text string → bare string.
+    Text,
+    /// Multi-select array → string array.
+    MultiSelect,
+    /// Yes/No choice → JSON boolean.
+    Boolean,
+    /// Free-text parsed as f64 → JSON number (unparseable answers are omitted).
+    Number,
+    /// Free-text parsed as i64 → JSON integer (unparseable answers are omitted).
+    Integer,
+}
+
+/// The response-side rebuild plan for one schema property, parallel (same
+/// index) to the [`QuestionSpec`] minted for it. Keeps the property id, the
+/// primitive kind, and the label→value map for choice fields — everything
+/// [`build_elicitation_response`] needs that [`QuestionSpec`] (a shared wire
+/// type the card renders) must not carry.
+pub struct ElicitationField {
+    /// Schema property name — the key the accepted content is sent under.
+    pub id: String,
+    pub kind: ElicitationFieldKind,
+    /// Display label → wire value for choice fields. A label the user typed
+    /// via "Other" (absent here) is sent verbatim.
+    pub value_by_label: std::collections::HashMap<String, String>,
+}
+
+/// A form elicitation that renders as ask-card questions.
+pub struct ElicitationQuestions {
+    pub specs: Vec<QuestionSpec>,
+    /// Parallel to `specs` (same index).
+    pub fields: Vec<ElicitationField>,
+    /// The elicitation's `toolCallId` (codex sets it to the `request_user_input`
+    /// item id). The connection handler keys the synthesized in-stream result
+    /// card to it, so the live card and the reloaded history card (parsed by
+    /// `codex.rs` from the same id) are one card. `None` when the wire carried
+    /// no session scope tool_call_id.
+    pub tool_call_id: Option<String>,
+}
+
+/// One selectable option of an approval-style elicitation, shaped for the
+/// permission card (`PermissionOptionInfo` mirrors these fields 1:1).
+pub struct ElicitationApprovalOption {
+    pub option_id: String,
+    pub label: String,
+    /// `allow_once` / `allow_always` / `reject_once` — the permission-option
+    /// kinds the frontend already styles.
+    pub kind: &'static str,
+}
+
+/// The reserved option id for rejecting an approval-style elicitation. Never
+/// collides with a persist `const` (codex only mints `once`/`session`/`always`)
+/// and is filtered out of the accept mapping defensively.
+pub const ELICITATION_DECLINE_OPTION_ID: &str = "__decline";
+
+/// A form elicitation that renders through the PERMISSION card rather than the
+/// ask card: an MCP tool-call approval (`_meta.codex_approval_kind ==
+/// "mcp_tool_call"`) or a message-only confirm (a form with no renderable
+/// fields). Routing these through the permission flow keeps MCP approvals
+/// looking exactly like they did before codeg advertised `elicitation.form`
+/// (codex-acp then used `session/request_permission` with the same options).
+pub struct ElicitationApproval {
+    /// The human prompt ("Allow tool call?" / the MCP server's message).
+    pub message: String,
+    /// The tool call this approval correlates to (codex emits the mcpToolCall
+    /// item before eliciting), when the wire carried one.
+    pub tool_call_id: Option<String>,
+    /// The selectable options in display order; always ends with the
+    /// [`ELICITATION_DECLINE_OPTION_ID`] entry.
+    pub options: Vec<ElicitationApprovalOption>,
+    /// True when the accept response must echo the chosen option back as
+    /// `content.persist` (the request carried codex's persist-choice
+    /// property; codex-acp pops it into the app-server `_meta.persist`).
+    pub persist_in_content: bool,
+}
+
+/// How a form `elicitation/create` request must be presented.
+pub enum ElicitationPlan {
+    Questions(ElicitationQuestions),
+    Approval(ElicitationApproval),
+}
+
+/// Codex's synthetic free-text "Other" companion fields are named
+/// `<questionId>__other` (`__other1`, `__other2`… on collision). The card
+/// offers its own "Other" on every question, so companions are skipped and the
+/// typed answer rides the main field (codex falls back to it).
+fn is_other_companion(id: &str) -> bool {
+    let Some(pos) = id.rfind("__other") else {
+        return false;
+    };
+    pos > 0 && id[pos + "__other".len()..].chars().all(|c| c.is_ascii_digit())
+}
+
+/// True when the request is codex's MCP tool-call approval elicitation. The
+/// marker rides the request `_meta` verbatim (codex-acp passes the app-server
+/// `_meta` through), NOT under the `codex` namespace.
+fn is_mcp_tool_call_approval(raw: &Value) -> bool {
+    raw.get("_meta")
+        .and_then(|m| m.get("codex_approval_kind"))
+        .and_then(Value::as_str)
+        == Some("mcp_tool_call")
+}
+
+/// Codex's auto-resolution timeout for a `request_user_input` elicitation
+/// (`_meta.codex.autoResolutionMs`). When set, codex-acp races the elicitation
+/// against this timer and answers `{answers: {}}` itself on expiry — the
+/// connection handler mirrors it to reap the by-then-pointless card.
+pub fn elicitation_auto_resolution_ms(raw: &Value) -> Option<u64> {
+    raw.get("_meta")?
+        .get("codex")?
+        .get("autoResolutionMs")?
+        .as_u64()
+}
+
+/// Classify a form `elicitation/create` request (the raw JSON params) into its
+/// presentation plan. Everything codex-acp can send once `elicitation.form` is
+/// advertised lands here, so every shape must resolve to SOMETHING the user
+/// can act on — an unhandled shape would stall or silently reject the agent's
+/// blocked request:
+///
+///   * MCP tool-call approvals (`_meta.codex_approval_kind`) → [`ElicitationApproval`]
+///     with the persist choices (`once`/`session`/`always`) + Decline — the
+///     permission card, exactly like the pre-capability `request_permission`
+///     fallback. This includes approvals for codeg-mcp's OWN tools in
+///     consent-requiring permission modes, so declining them here would break
+///     ask/delegation for codex outright.
+///   * Forms with no renderable fields (message-only MCP confirms) →
+///     [`ElicitationApproval`] with Accept/Decline.
+///   * Everything else (codex `request_user_input`, generic MCP forms) →
+///     [`ElicitationQuestions`]: string `oneOf`/`enum` render as choices
+///     (title displayed, `const` sent back), plain strings/numbers/integers as
+///     free text, booleans as Yes/No, arrays as multi-select; `<id>__other`
+///     companions are skipped (the card has its own "Other").
+///
+/// Counts are clamped to codeg's bounds because
+/// [`crate::acp::manager::ConnectionManager::register_question`] re-runs
+/// [`validate_specs`]. Errors only on non-form / undeserializable requests,
+/// which the connection handler turns into a graceful decline.
+pub fn classify_elicitation(raw: &Value) -> Result<ElicitationPlan, String> {
+    let req: CreateElicitationRequest = serde_json::from_value(raw.clone())
+        .map_err(|e| format!("unparseable elicitation request: {e}"))?;
+    let ElicitationMode::Form(form) = &req.mode else {
+        // codeg only advertises `elicitation.form` — URL mode goes down
+        // codex-acp's `request_permission` fallback and never reaches here.
+        return Err("elicitation is not form mode".to_string());
+    };
+    let message: String = req
+        .message
+        .trim()
+        .chars()
+        .take(MAX_QUESTION_TEXT_CHARS)
+        .collect();
+    let tool_call_id = match &form.scope {
+        ElicitationScope::Session(s) => s.tool_call_id.as_ref().map(|t| t.0.to_string()),
+        _ => None,
+    };
+    if is_mcp_tool_call_approval(raw) {
+        return Ok(ElicitationPlan::Approval(approval_from_form(
+            form,
+            message,
+            tool_call_id,
+        )));
+    }
+    let mut questions = parse_form_questions(form, raw);
+    if questions.specs.is_empty() {
+        // A form with nothing to fill in is a bare confirmation — mirror
+        // codex-acp's own no-capability fallback (Accept/Decline options).
+        return Ok(ElicitationPlan::Approval(ElicitationApproval {
+            message,
+            tool_call_id,
+            options: vec![
+                ElicitationApprovalOption {
+                    option_id: "accept".to_string(),
+                    label: "Accept".to_string(),
+                    kind: "allow_once",
+                },
+                decline_approval_option(),
+            ],
+            persist_in_content: false,
+        }));
+    }
+    // Carry the elicitation's tool_call_id so the connection handler can key the
+    // synthesized in-stream result card to it — codex delivers `request_user_input`
+    // ONLY as this elicitation, never as a stream tool_call.
+    questions.tool_call_id = tool_call_id;
+    Ok(ElicitationPlan::Questions(questions))
+}
+
+fn decline_approval_option() -> ElicitationApprovalOption {
+    ElicitationApprovalOption {
+        option_id: ELICITATION_DECLINE_OPTION_ID.to_string(),
+        label: "Decline".to_string(),
+        kind: "reject_once",
+    }
+}
+
+/// Build the approval plan for an MCP tool-call approval elicitation. The
+/// request's only (optional) field is codex-acp's injected `persist` choice —
+/// `oneOf` of `once` (+ `session`/`always` when codex advertises them). Its
+/// options become the allow choices (wire titles displayed, `const` as the
+/// option id) plus Decline; with no persist property the choices are plain
+/// Allow/Decline. Mirrors codex-acp's own `request_permission` fallback
+/// (`buildToolApprovalOptions`) so approvals look identical either way.
+fn approval_from_form(
+    form: &sacp::schema::ElicitationFormMode,
+    message: String,
+    tool_call_id: Option<String>,
+) -> ElicitationApproval {
+    let persist_choices = form
+        .requested_schema
+        .properties
+        .get("persist")
+        .and_then(|p| match p {
+            ElicitationPropertySchema::String(s) => Some(string_prop_choices(s)),
+            _ => None,
+        })
+        .filter(|c| !c.is_empty());
+    let persist_in_content = persist_choices.is_some();
+    let mut options = Vec::new();
+    let mut seen = std::collections::HashSet::new();
+    if let Some(choices) = persist_choices {
+        for c in choices {
+            if options.len() == MAX_OPTIONS {
+                break;
+            }
+            let value = c.value.trim();
+            if value.is_empty()
+                || value == ELICITATION_DECLINE_OPTION_ID
+                || !seen.insert(value.to_string())
+            {
+                continue;
+            }
+            options.push(ElicitationApprovalOption {
+                option_id: value.to_string(),
+                label: if c.label.trim().is_empty() {
+                    value.to_string()
+                } else {
+                    c.label.trim().chars().take(MAX_QUESTION_TEXT_CHARS).collect()
+                },
+                kind: if value == "once" {
+                    "allow_once"
+                } else {
+                    "allow_always"
+                },
+            });
+        }
+    }
+    if options.is_empty() {
+        options.push(ElicitationApprovalOption {
+            option_id: "accept".to_string(),
+            label: "Allow".to_string(),
+            kind: "allow_once",
+        });
+    }
+    options.push(decline_approval_option());
+    ElicitationApproval {
+        message,
+        tool_call_id,
+        options,
+        persist_in_content,
+    }
+}
+
+/// True when the raw schema property carries codex's secret marker
+/// (`_meta.codex.isSecret`). The typed sacp property structs drop `_meta`, so
+/// this reads the raw JSON alongside them.
+fn is_secret_property(raw: &Value, id: &str) -> bool {
+    raw.get("requestedSchema")
+        .and_then(|s| s.get("properties"))
+        .and_then(|p| p.get(id))
+        .and_then(|prop| prop.get("_meta"))
+        .and_then(|m| m.get("codex"))
+        .and_then(|c| c.get("isSecret"))
+        .and_then(Value::as_bool)
+        .unwrap_or(false)
+}
+
+/// Convert a form's schema properties into ask-card questions + their typed
+/// rebuild plans (see [`classify_elicitation`] for the shape taxonomy). A
+/// property with no usable choices renders as free text (the card's
+/// always-present "Other" input) — including plain strings, numbers, integers,
+/// and choice fields whose options were all empty/duplicate.
+fn parse_form_questions(
+    form: &sacp::schema::ElicitationFormMode,
+    raw: &Value,
+) -> ElicitationQuestions {
+    let mut specs = Vec::new();
+    let mut fields = Vec::new();
+    for (id, prop) in &form.requested_schema.properties {
+        if specs.len() == MAX_QUESTIONS {
+            tracing::warn!(
+                "[codex elicitation] dropping question(s) past the max of {MAX_QUESTIONS}"
+            );
+            break;
+        }
+        // Skip codex's synthetic free-text "Other" companion fields.
+        if is_other_companion(id) {
+            continue;
+        }
+        let (title, description, kind, multi_select, choices) = match prop {
+            ElicitationPropertySchema::String(s) => (
+                s.title.clone(),
+                s.description.clone(),
+                ElicitationFieldKind::Text,
+                false,
+                string_prop_choices(s),
+            ),
+            ElicitationPropertySchema::Array(a) => (
+                a.title.clone(),
+                a.description.clone(),
+                ElicitationFieldKind::MultiSelect,
+                true,
+                multi_select_choices(&a.items),
+            ),
+            ElicitationPropertySchema::Boolean(b) => (
+                b.title.clone(),
+                b.description.clone(),
+                ElicitationFieldKind::Boolean,
+                false,
+                vec![
+                    ElicitationChoice {
+                        label: "Yes".to_string(),
+                        value: "true".to_string(),
+                    },
+                    ElicitationChoice {
+                        label: "No".to_string(),
+                        value: "false".to_string(),
+                    },
+                ],
+            ),
+            ElicitationPropertySchema::Number(n) => (
+                n.title.clone(),
+                n.description.clone(),
+                ElicitationFieldKind::Number,
+                false,
+                Vec::new(),
+            ),
+            ElicitationPropertySchema::Integer(i) => (
+                i.title.clone(),
+                i.description.clone(),
+                ElicitationFieldKind::Integer,
+                false,
+                Vec::new(),
+            ),
+            // `ElicitationPropertySchema` is `#[non_exhaustive]`; a future
+            // property type has no rendering here, so skip it (the agent
+            // reads the missing key as unanswered and proceeds).
+            _ => continue,
+        };
+        let question = description
+            .as_deref()
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+            .or_else(|| title.as_deref().map(str::trim).filter(|s| !s.is_empty()))
+            .unwrap_or(id.as_str());
+        // Dedup + clamp option labels exactly like the grok bridge, keeping
+        // the label→value map for the response rebuild.
+        let mut options = Vec::with_capacity(choices.len().min(MAX_OPTIONS));
+        let mut value_by_label = std::collections::HashMap::new();
+        let mut seen = std::collections::HashSet::new();
+        for c in &choices {
+            if options.len() == MAX_OPTIONS {
+                break;
+            }
+            let label = c.label.trim();
+            if label.is_empty() || !seen.insert(label.to_string()) {
+                continue;
+            }
+            let label: String = label.chars().take(MAX_QUESTION_TEXT_CHARS).collect();
+            value_by_label.insert(label.clone(), c.value.clone());
+            options.push(QuestionOption {
+                label,
+                description: String::new(),
+            });
+        }
+        let header = title
+            .as_deref()
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+            .map(|h| h.chars().take(MAX_HEADER_CHARS).collect())
+            .unwrap_or_else(|| synthesize_grok_header(question));
+        specs.push(QuestionSpec {
+            id: id.clone(),
+            question: question.chars().take(MAX_QUESTION_TEXT_CHARS).collect(),
+            header,
+            multi_select,
+            options,
+            is_secret: is_secret_property(raw, id),
+        });
+        fields.push(ElicitationField {
+            id: id.clone(),
+            kind,
+            value_by_label,
+        });
+    }
+    // `tool_call_id` is filled in by `classify_elicitation` (which reads the
+    // form scope); the parser itself only shapes the questions.
+    ElicitationQuestions {
+        specs,
+        fields,
+        tool_call_id: None,
+    }
+}
+
+/// "Yes"/"No" answers (and free-text variants) for a boolean field.
+fn parse_bool_answer(v: &str) -> Option<bool> {
+    match v.trim().to_ascii_lowercase().as_str() {
+        "true" | "yes" | "y" => Some(true),
+        "false" | "no" | "n" => Some(false),
+        _ => None,
+    }
+}
+
+/// Serialize a resolved [`QuestionOutcome`] into the elicitation response.
+/// The agent keys answers by the schema property id, which [`QuestionOutcome`]
+/// drops — so correlate each answered item back to its spec by
+/// `(question, header)` (unique per ask) and rebuild the value through the
+/// parallel [`ElicitationField`]: chosen labels map back to their wire values
+/// (free-text "Other" answers ride verbatim), typed per the field's kind — an
+/// answer that can't be coerced (e.g. non-numeric text for a number field) is
+/// omitted rather than sent mistyped. A declined card or an empty result maps
+/// to `Decline`, which the agent reads as "no answer" and proceeds — never
+/// worse than the pre-bridge behavior.
+pub fn build_elicitation_response(
+    questions: &ElicitationQuestions,
+    outcome: &QuestionOutcome,
+) -> CreateElicitationResponse {
+    if outcome.declined {
+        return elicitation_decline_response();
+    }
+    let mut content: BTreeMap<String, ElicitationContentValue> = BTreeMap::new();
+    for item in &outcome.answers {
+        let Some(idx) = questions
+            .specs
+            .iter()
+            .position(|s| s.question == item.question && s.header == item.header)
+        else {
+            continue;
+        };
+        let field = &questions.fields[idx];
+        let mapped: Vec<String> = item
+            .selected
+            .iter()
+            .map(|l| field.value_by_label.get(l).cloned().unwrap_or_else(|| l.clone()))
+            .collect();
+        let value = match field.kind {
+            ElicitationFieldKind::Text => match mapped.into_iter().next() {
+                Some(v) => ElicitationContentValue::String(v),
+                None => continue,
+            },
+            ElicitationFieldKind::MultiSelect => ElicitationContentValue::StringArray(mapped),
+            ElicitationFieldKind::Boolean => {
+                match mapped.first().and_then(|v| parse_bool_answer(v)) {
+                    Some(b) => ElicitationContentValue::Boolean(b),
+                    None => continue,
+                }
+            }
+            ElicitationFieldKind::Number => {
+                match mapped
+                    .first()
+                    .and_then(|v| v.trim().parse::<f64>().ok())
+                    .filter(|f| f.is_finite())
+                {
+                    Some(f) => ElicitationContentValue::Number(f),
+                    None => continue,
+                }
+            }
+            ElicitationFieldKind::Integer => {
+                match mapped.first().and_then(|v| v.trim().parse::<i64>().ok()) {
+                    Some(i) => ElicitationContentValue::Integer(i),
+                    None => continue,
+                }
+            }
+        };
+        content.insert(field.id.clone(), value);
+    }
+    if content.is_empty() {
+        return elicitation_decline_response();
+    }
+    CreateElicitationResponse::new(ElicitationAction::Accept(
+        ElicitationAcceptAction::new().content(content),
+    ))
+}
+
+/// Serialize the user's permission-card choice for an approval-style
+/// elicitation. The decline option (and any unknown option id, defensively)
+/// maps to `Decline`; an allow choice maps to `Accept`, echoing the chosen
+/// persist value back as `content.persist` when the request carried the
+/// persist property (codex-acp pops it into the app-server `_meta.persist`;
+/// a plain Accept sends no content, which codex-acp reads the same as
+/// `content: null`).
+pub fn build_elicitation_approval_response(
+    approval: &ElicitationApproval,
+    option_id: &str,
+) -> CreateElicitationResponse {
+    let accepted = option_id != ELICITATION_DECLINE_OPTION_ID
+        && approval.options.iter().any(|o| o.option_id == option_id);
+    if !accepted {
+        return elicitation_decline_response();
+    }
+    let mut accept = ElicitationAcceptAction::new();
+    if approval.persist_in_content {
+        let mut content: BTreeMap<String, ElicitationContentValue> = BTreeMap::new();
+        content.insert(
+            "persist".to_string(),
+            ElicitationContentValue::String(option_id.to_string()),
+        );
+        accept = accept.content(content);
+    }
+    CreateElicitationResponse::new(ElicitationAction::Accept(accept))
+}
+
+/// The elicitation reply for a declined / unrenderable / torn-down ask.
+/// `Decline` makes the agent proceed with its own judgment (it reads it as no
+/// answer), so no path through the bridge can regress the pre-bridge behavior.
+pub fn elicitation_decline_response() -> CreateElicitationResponse {
+    CreateElicitationResponse::new(ElicitationAction::Decline)
+}
+
+/// The elicitation reply when the pending card is torn down without a user
+/// choice (turn cancel, disconnect): `Cancel`, mirroring codex-acp's own
+/// "cancelled" outcome mapping.
+pub fn elicitation_cancel_response() -> CreateElicitationResponse {
+    CreateElicitationResponse::new(ElicitationAction::Cancel)
+}
+
 /// Build the `raw_input` (questions) for the in-stream `AskQuestionResultCard`
-/// codeg synthesizes for a grok native ask. Grok never emits a *completed* tool
-/// result into the ACP `updates.jsonl` stream (it resolves the answer over the
-/// `_x.ai/ask_user_question` ext round-trip instead), so the connection handler
-/// emits this itself once the user submits — see `handle_grok_ask_user_question`.
+/// codeg synthesizes for a native ask that resolves out-of-band rather than as a
+/// completed stream tool_call. Two callers: grok (answers over the
+/// `_x.ai/ask_user_question` ext round-trip — `handle_grok_ask_user_question`)
+/// and codex `request_user_input` (answers over the `elicitation/create`
+/// round-trip — `handle_elicitation_request`). Neither emits a completed tool
+/// result into the ACP stream, so the connection handler emits this once the
+/// user submits.
 ///
-/// Deliberately omits `header`: grok's native questions have none (the chip
-/// header we synthesize for the interactive card is an internal detail), so the
-/// frontend parses `header:""` here. The paired [`grok_result_card_output`] uses
-/// the SAME empty header, and the history parser (`grok.rs`) emits `header:""`
-/// too, so the card's answer↔question match key (`header + question`) aligns and
-/// a conversation renders identically live and after reload. Built from the
-/// already-clamped [`QuestionSpec`]s so input and output stay in lockstep.
+/// Deliberately omits `header`, so the frontend parses `header:""` and matches
+/// answers to questions by `question` text alone. The paired
+/// [`grok_result_card_output`] uses the SAME empty header. For grok this is exact
+/// live↔reload parity (its history parser emits `header:""` too); for codex the
+/// reloaded history card (`codex.rs`) does carry the question header, so a
+/// multi-question ask shows header tab labels after reload but not live — a
+/// cosmetic gap only (single-question asks, the common case, render identically
+/// and the answer always shows). Built from the already-clamped [`QuestionSpec`]s
+/// so input and output stay in lockstep.
 pub fn grok_result_card_input(specs: &[QuestionSpec]) -> Value {
     let questions: Vec<Value> = specs
         .iter()
@@ -686,6 +1310,369 @@ mod tests {
         assert!(!qs[0].id.is_empty());
     }
 
+    fn elicitation_raw(props: Value, required: Value) -> Value {
+        json!({
+            "mode": "form",
+            "sessionId": "sess-1",
+            "toolCallId": "item-1",
+            "requestedSchema": {
+                "type": "object",
+                "properties": props,
+                "required": required,
+            },
+            "message": "Input requested",
+        })
+    }
+
+    fn expect_questions(plan: ElicitationPlan) -> ElicitationQuestions {
+        match plan {
+            ElicitationPlan::Questions(q) => q,
+            ElicitationPlan::Approval(_) => panic!("expected a questions plan"),
+        }
+    }
+
+    fn expect_approval(plan: ElicitationPlan) -> ElicitationApproval {
+        match plan {
+            ElicitationPlan::Approval(a) => a,
+            ElicitationPlan::Questions(_) => panic!("expected an approval plan"),
+        }
+    }
+
+    #[test]
+    fn classify_elicitation_single_select_maps_options_and_id() {
+        let raw = elicitation_raw(
+            json!({
+                "q1": {
+                    "type": "string",
+                    "title": "Approach",
+                    "description": "Which approach?",
+                    "oneOf": [
+                        {"const": "Incremental", "title": "Incremental"},
+                        {"const": "Rewrite", "title": "Rewrite"}
+                    ]
+                }
+            }),
+            json!(["q1"]),
+        );
+        let q = expect_questions(classify_elicitation(&raw).unwrap());
+        assert_eq!(q.specs.len(), 1);
+        assert_eq!(q.specs[0].id, "q1", "property key becomes the spec id");
+        assert_eq!(q.specs[0].question, "Which approach?");
+        assert_eq!(q.specs[0].header, "Approach");
+        assert!(!q.specs[0].multi_select);
+        assert!(!q.specs[0].is_secret);
+        let labels: Vec<_> = q.specs[0].options.iter().map(|o| o.label.as_str()).collect();
+        assert_eq!(labels, ["Incremental", "Rewrite"]);
+        assert_eq!(q.fields[0].kind, ElicitationFieldKind::Text);
+        // The elicitation's toolCallId rides along so the connection handler can
+        // key the synthesized in-stream result card to it (see the fn docs).
+        assert_eq!(
+            q.tool_call_id.as_deref(),
+            Some("item-1"),
+            "carries the elicitation toolCallId for the synthesized card"
+        );
+    }
+
+    #[test]
+    fn classify_elicitation_free_text_renders_and_skips_other_companion() {
+        // A free-text question (no options) renders as a 0-option spec (the
+        // card shows its always-present "Other" input); the synthetic
+        // `__other` companion (any digit-suffixed collision variant too) is
+        // skipped.
+        let raw = elicitation_raw(
+            json!({
+                "q1": {"type": "string", "title": "Name", "description": "Your name?",
+                       "_meta": {"codex": {"isSecret": true}}},
+                "q1__other": {"type": "string", "title": "Other"},
+                "q1__other1": {"type": "string", "title": "Other"}
+            }),
+            json!([]),
+        );
+        let q = expect_questions(classify_elicitation(&raw).unwrap());
+        assert_eq!(q.specs.len(), 1);
+        assert_eq!(q.specs[0].id, "q1");
+        assert!(q.specs[0].options.is_empty(), "free text has no options");
+        assert!(q.specs[0].is_secret, "secret marker read from raw _meta");
+        assert!(validate_specs(&q.specs).is_ok(), "0-option specs register");
+
+        // The typed answer rides the main field verbatim.
+        let answer = QuestionAnswer {
+            answers: vec![QuestionAnswerItem {
+                question_id: "q1".into(),
+                labels: vec!["Ada Lovelace".into()],
+            }],
+            declined: false,
+        };
+        let outcome = build_outcome(&q.specs, &answer);
+        let v = serde_json::to_value(build_elicitation_response(&q, &outcome)).unwrap();
+        assert_eq!(v["action"], "accept");
+        assert_eq!(v["content"]["q1"], "Ada Lovelace");
+    }
+
+    #[test]
+    fn classify_elicitation_multi_select_marks_multi_and_maps_values() {
+        let raw = elicitation_raw(
+            json!({
+                "langs": {
+                    "type": "array",
+                    "title": "Langs",
+                    "description": "Pick languages",
+                    "items": { "anyOf": [
+                        {"const": "rust", "title": "Rust"},
+                        {"const": "ts", "title": "TS"}
+                    ]}
+                }
+            }),
+            json!([]),
+        );
+        let q = expect_questions(classify_elicitation(&raw).unwrap());
+        assert_eq!(q.specs.len(), 1);
+        assert!(q.specs[0].multi_select);
+        // Titles display; consts ride back on accept.
+        let labels: Vec<_> = q.specs[0].options.iter().map(|o| o.label.as_str()).collect();
+        assert_eq!(labels, ["Rust", "TS"]);
+        let answer = QuestionAnswer {
+            answers: vec![QuestionAnswerItem {
+                question_id: q.specs[0].id.clone(),
+                labels: vec!["Rust".into(), "TS".into()],
+            }],
+            declined: false,
+        };
+        let outcome = build_outcome(&q.specs, &answer);
+        let v = serde_json::to_value(build_elicitation_response(&q, &outcome)).unwrap();
+        assert_eq!(v["content"]["langs"], json!(["rust", "ts"]));
+    }
+
+    #[test]
+    fn classify_elicitation_boolean_and_numbers_type_their_answers() {
+        let raw = elicitation_raw(
+            json!({
+                "confirm": {"type": "boolean", "title": "Confirm", "description": "Proceed?"},
+                "count": {"type": "integer", "title": "Count", "description": "How many?"},
+                "ratio": {"type": "number", "title": "Ratio", "description": "What ratio?"}
+            }),
+            json!(["confirm"]),
+        );
+        let q = expect_questions(classify_elicitation(&raw).unwrap());
+        assert_eq!(q.specs.len(), 3);
+        // Booleans render as Yes/No; numbers as free text.
+        let confirm = q.specs.iter().position(|s| s.id == "confirm").unwrap();
+        let labels: Vec<_> = q.specs[confirm].options.iter().map(|o| o.label.as_str()).collect();
+        assert_eq!(labels, ["Yes", "No"]);
+
+        let answer = QuestionAnswer {
+            answers: vec![
+                QuestionAnswerItem {
+                    question_id: "confirm".into(),
+                    labels: vec!["Yes".into()],
+                },
+                QuestionAnswerItem {
+                    question_id: "count".into(),
+                    labels: vec!["42".into()],
+                },
+                QuestionAnswerItem {
+                    question_id: "ratio".into(),
+                    labels: vec!["not-a-number".into()],
+                },
+            ],
+            declined: false,
+        };
+        let outcome = build_outcome(&q.specs, &answer);
+        let v = serde_json::to_value(build_elicitation_response(&q, &outcome)).unwrap();
+        assert_eq!(v["content"]["confirm"], json!(true), "boolean typed");
+        assert_eq!(v["content"]["count"], json!(42), "integer typed");
+        assert!(
+            v["content"].get("ratio").is_none(),
+            "unparseable number omitted, not sent mistyped"
+        );
+    }
+
+    #[test]
+    fn classify_elicitation_enum_names_display_title_but_send_const() {
+        // Generic MCP `enum` + `enumNames` normalize to oneOf with
+        // const ≠ title: display the title, send the const back.
+        let raw = elicitation_raw(
+            json!({
+                "env": {
+                    "type": "string",
+                    "title": "Env",
+                    "description": "Which environment?",
+                    "oneOf": [
+                        {"const": "prod-eu-1", "title": "Production (EU)"},
+                        {"const": "stg-eu-1", "title": "Staging (EU)"}
+                    ]
+                }
+            }),
+            json!(["env"]),
+        );
+        let q = expect_questions(classify_elicitation(&raw).unwrap());
+        assert_eq!(q.specs[0].options[0].label, "Production (EU)");
+        let answer = QuestionAnswer {
+            answers: vec![QuestionAnswerItem {
+                question_id: "env".into(),
+                labels: vec!["Production (EU)".into()],
+            }],
+            declined: false,
+        };
+        let outcome = build_outcome(&q.specs, &answer);
+        let v = serde_json::to_value(build_elicitation_response(&q, &outcome)).unwrap();
+        assert_eq!(v["content"]["env"], "prod-eu-1");
+    }
+
+    #[test]
+    fn classify_elicitation_tool_approval_maps_persist_options() {
+        // The exact wire shape codex-acp sends for an MCP tool-call approval
+        // once `elicitation.form` is advertised (verified against its
+        // elicitation-events tests): message + persist choice, approval marker
+        // in top-level `_meta`.
+        let raw = json!({
+            "mode": "form",
+            "sessionId": "sess-1",
+            "toolCallId": "call-1",
+            "message": "Allow tool call?",
+            "requestedSchema": {
+                "type": "object",
+                "properties": {
+                    "persist": {
+                        "type": "string",
+                        "title": "Approval scope",
+                        "oneOf": [
+                            {"const": "once", "title": "Allow once"},
+                            {"const": "session", "title": "Allow for this session"},
+                            {"const": "always", "title": "Allow and don't ask again"}
+                        ],
+                        "default": "once"
+                    }
+                },
+                "required": ["persist"]
+            },
+            "_meta": {"codex_approval_kind": "mcp_tool_call", "persist": ["session", "always"]}
+        });
+        let approval = expect_approval(classify_elicitation(&raw).unwrap());
+        assert_eq!(approval.message, "Allow tool call?");
+        assert_eq!(approval.tool_call_id.as_deref(), Some("call-1"));
+        assert!(approval.persist_in_content);
+        let ids: Vec<_> = approval.options.iter().map(|o| o.option_id.as_str()).collect();
+        assert_eq!(ids, ["once", "session", "always", ELICITATION_DECLINE_OPTION_ID]);
+        assert_eq!(approval.options[0].label, "Allow once");
+        assert_eq!(approval.options[0].kind, "allow_once");
+        assert_eq!(approval.options[1].kind, "allow_always");
+
+        // Accepting echoes the chosen persist back in content…
+        let v =
+            serde_json::to_value(build_elicitation_approval_response(&approval, "session"))
+                .unwrap();
+        assert_eq!(v["action"], "accept");
+        assert_eq!(v["content"]["persist"], "session");
+        // …declining (or an unknown option) maps to decline.
+        let v = serde_json::to_value(build_elicitation_approval_response(
+            &approval,
+            ELICITATION_DECLINE_OPTION_ID,
+        ))
+        .unwrap();
+        assert_eq!(v["action"], "decline");
+        let v = serde_json::to_value(build_elicitation_approval_response(&approval, "bogus"))
+            .unwrap();
+        assert_eq!(v["action"], "decline");
+    }
+
+    #[test]
+    fn classify_elicitation_tool_approval_without_persist_is_allow_decline() {
+        // No persist advertised → codex-acp sends an EMPTY properties object.
+        // This must NOT auto-decline: it renders Allow/Decline and accepts
+        // with no content.
+        let raw = json!({
+            "mode": "form",
+            "sessionId": "sess-1",
+            "toolCallId": "call-1",
+            "message": "Allow tool call?",
+            "requestedSchema": {"type": "object", "properties": {}},
+            "_meta": {"codex_approval_kind": "mcp_tool_call"}
+        });
+        let approval = expect_approval(classify_elicitation(&raw).unwrap());
+        assert!(!approval.persist_in_content);
+        let ids: Vec<_> = approval.options.iter().map(|o| o.option_id.as_str()).collect();
+        assert_eq!(ids, ["accept", ELICITATION_DECLINE_OPTION_ID]);
+        let v = serde_json::to_value(build_elicitation_approval_response(&approval, "accept"))
+            .unwrap();
+        assert_eq!(v["action"], "accept");
+        assert!(
+            v.get("content").is_none() || v["content"].is_null(),
+            "plain accept sends no content"
+        );
+    }
+
+    #[test]
+    fn classify_elicitation_message_only_form_is_accept_decline_confirm() {
+        // A non-approval form with nothing to fill in (a bare MCP server
+        // confirmation) renders Accept/Decline rather than auto-declining.
+        let raw = elicitation_raw(json!({}), json!([]));
+        let approval = expect_approval(classify_elicitation(&raw).unwrap());
+        assert_eq!(approval.message, "Input requested");
+        let ids: Vec<_> = approval.options.iter().map(|o| o.option_id.as_str()).collect();
+        assert_eq!(ids, ["accept", ELICITATION_DECLINE_OPTION_ID]);
+    }
+
+    #[test]
+    fn elicitation_round_trips_answer_keyed_by_property_id() {
+        let raw = elicitation_raw(
+            json!({
+                "colour": {
+                    "type": "string",
+                    "title": "Colour",
+                    "description": "Pick a colour",
+                    "oneOf": [
+                        {"const": "Red", "title": "Red"},
+                        {"const": "Blue", "title": "Blue"}
+                    ]
+                }
+            }),
+            json!(["colour"]),
+        );
+        let q = expect_questions(classify_elicitation(&raw).unwrap());
+        // Simulate the user picking "Blue" through the normal answer path.
+        let answer = QuestionAnswer {
+            answers: vec![QuestionAnswerItem {
+                question_id: "colour".into(),
+                labels: vec!["Blue".into()],
+            }],
+            declined: false,
+        };
+        let outcome = build_outcome(&q.specs, &answer);
+        let resp = build_elicitation_response(&q, &outcome);
+        let v = serde_json::to_value(&resp).unwrap();
+        assert_eq!(v["action"], "accept");
+        // Codex reads the answer back by the schema property id.
+        assert_eq!(v["content"]["colour"], "Blue");
+    }
+
+    #[test]
+    fn build_elicitation_response_declined_maps_to_decline() {
+        let outcome = QuestionOutcome {
+            answers: vec![],
+            declined: true,
+        };
+        let empty = ElicitationQuestions {
+            specs: vec![],
+            fields: vec![],
+            tool_call_id: None,
+        };
+        let v = serde_json::to_value(build_elicitation_response(&empty, &outcome)).unwrap();
+        assert_eq!(v["action"], "decline");
+        let v = serde_json::to_value(elicitation_cancel_response()).unwrap();
+        assert_eq!(v["action"], "cancel");
+    }
+
+    #[test]
+    fn elicitation_auto_resolution_ms_reads_codex_meta() {
+        let mut raw = elicitation_raw(json!({}), json!([]));
+        assert_eq!(elicitation_auto_resolution_ms(&raw), None);
+        raw["_meta"] = json!({"codex": {"autoResolutionMs": 30000}});
+        assert_eq!(elicitation_auto_resolution_ms(&raw), Some(30000));
+        raw["_meta"] = json!({"codex": {"autoResolutionMs": null}});
+        assert_eq!(elicitation_auto_resolution_ms(&raw), None);
+    }
+
     #[test]
     fn validate_specs_accepts_well_formed_and_rejects_malformed() {
         // What parse_questions mints passes the request-side re-check.
@@ -709,6 +1696,7 @@ mod tests {
                     description: String::new(),
                 })
                 .collect(),
+            is_secret: false,
         };
 
         assert!(validate_specs(&[]).is_err(), "empty set");
@@ -717,8 +1705,8 @@ mod tests {
             "oversized question text"
         );
         assert!(
-            validate_specs(&[spec("ok", MIN_OPTIONS - 1, 0)]).is_err(),
-            "too few options"
+            validate_specs(&[spec("ok", 0, 0)]).is_ok(),
+            "0 options is a legal free-text ask (elicitation / MCP forms)"
         );
         assert!(
             validate_specs(&[spec("ok", MAX_OPTIONS + 1, 0)]).is_err(),
@@ -751,6 +1739,7 @@ mod tests {
                     description: String::new(),
                 },
             ],
+            is_secret: false,
         };
         assert!(validate_specs(&[blank_id]).is_err(), "blank id");
         // Duplicate option label within one question (parse_questions rejects it).
@@ -769,6 +1758,7 @@ mod tests {
                     description: String::new(),
                 },
             ],
+            is_secret: false,
         };
         assert!(
             validate_specs(&[dup_label]).is_err(),
diff --git a/src-tauri/src/acp/registry.rs b/src-tauri/src/acp/registry.rs
index a825b7cc9..485cb8678 100644
--- a/src-tauri/src/acp/registry.rs
+++ b/src-tauri/src/acp/registry.rs
@@ -209,7 +209,7 @@ pub fn get_agent_meta(agent_type: AgentType) -> AcpAgentMeta {
             description: "ACP adapter for OpenAI's coding assistant",
             // codex-acp moved from zed-industries (Rust binary) to the
             // agentclientprotocol org (TypeScript rewrite, npx-distributed).
-            // 1.1.4 depends on `@openai/codex` ^0.144.4 and drives `codex
+            // 1.1.7 depends on `@openai/codex` ^0.145.0 and drives `codex
             // app-server`; since 1.0.1 it also resolves the resumed
             // `model_provider` from `~/.codex/config.toml` (#224), so codeg no
             // longer injects `MODEL_PROVIDER` to keep resumed sessions on the
@@ -222,10 +222,28 @@ pub fn get_agent_meta(agent_type: AgentType) -> AcpAgentMeta {
             // retryable turn errors (#289, `_meta.codex.error` → a transient
             // retry banner via `codex_retry_indicator`), and the
             // context-compaction lifecycle (#288, `_meta.contextCompaction` tool
-            // call → a dedicated frontend card).
+            // call → a dedicated frontend card). 1.1.x also adds Plan mode: the
+            // `collaboration_mode` config option (rendered by the generic
+            // config-option path) and native `request_user_input`, delivered as
+            // an ACP `elicitation/create` request — codeg advertises
+            // `elicitation.form` for Codex and bridges the WHOLE form surface
+            // (Plan-mode questions, MCP-server forms, MCP tool-call approvals)
+            // in `handle_elicitation_request` / `question::classify_elicitation`.
+            // 1.1.5 (#322) also widened codex-acp's MCP config filtering to
+            // project `.codex` layers, which is why codeg forces
+            // `DISABLE_MCP_CONFIG_FILTERING` (see `apply_codex_env_policy`) so
+            // the injected `codeg-mcp` server always survives. 1.1.6 adds
+            // steering (#309): `_session/steering` injects a user prompt into
+            // the LIVE turn (initialize advertises `_meta.steering.supported`)
+            // — not wired into codeg yet. 1.1.7 (#326) emits Plan-mode plan
+            // contents as a plain `agent_message_chunk`
+            // (`_meta.codex.phase = "final_answer"`, no `<proposed_plan>` tags),
+            // which the adapter's tag-splitter simply no-ops on — tagged output
+            // from older codex still renders as the proposed-plan card. 1.1.7
+            // declares no `engines.node`, so the 20.0.0 floor is retained.
             distribution: AgentDistribution::Npx {
-                version: "1.1.4",
-                package: "@agentclientprotocol/codex-acp@1.1.4",
+                version: "1.1.7",
+                package: "@agentclientprotocol/codex-acp@1.1.7",
                 cmd: "codex-acp",
                 args: &[],
                 env: &[],
@@ -646,8 +664,8 @@ mod tests {
         );
         assert_npx_version(
             AgentType::Codex,
-            "1.1.4",
-            "@agentclientprotocol/codex-acp@1.1.4",
+            "1.1.7",
+            "@agentclientprotocol/codex-acp@1.1.7",
             Some("20.0.0"),
         );
         assert_npx_version(AgentType::Pi, "0.0.31", "pi-acp@0.0.31", Some("22.0.0"));
diff --git a/src-tauri/src/chat_channel/event_subscriber.rs b/src-tauri/src/chat_channel/event_subscriber.rs
index eb901d7e4..d9eaaa962 100644
--- a/src-tauri/src/chat_channel/event_subscriber.rs
+++ b/src-tauri/src/chat_channel/event_subscriber.rs
@@ -632,6 +632,7 @@ mod permission_push_tests {
                             description: String::new(),
                         },
                     ],
+                    is_secret: false,
                 }],
             },
         }
diff --git a/src-tauri/src/chat_channel/message_formatter.rs b/src-tauri/src/chat_channel/message_formatter.rs
index aea7f08eb..3334606cd 100644
--- a/src-tauri/src/chat_channel/message_formatter.rs
+++ b/src-tauri/src/chat_channel/message_formatter.rs
@@ -226,6 +226,7 @@ mod question_request_tests {
                     description: String::new(),
                 })
                 .collect(),
+            is_secret: false,
         }
     }
 
diff --git a/src-tauri/tests/delegation_e2e_uds.rs b/src-tauri/tests/delegation_e2e_uds.rs
index 703ef8bd3..13a9814f7 100644
--- a/src-tauri/tests/delegation_e2e_uds.rs
+++ b/src-tauri/tests/delegation_e2e_uds.rs
@@ -466,6 +466,7 @@ async fn end_to_end_uds_ask_question_round_trip() {
                         description: String::new(),
                     },
                 ],
+                is_secret: false,
             }],
         };
         client_ask_round_trip(&socket_str, &req).await
@@ -601,6 +602,7 @@ async fn end_to_end_uds_ask_revoked_after_register_declines() {
                     description: String::new(),
                 },
             ],
+            is_secret: false,
         }],
     };
     let resp = client_ask_round_trip(&socket.to_string_lossy(), &req)
diff --git a/src/components/chat/ask-question-card.test.tsx b/src/components/chat/ask-question-card.test.tsx
index 5ef1d1d9d..c35aaaa29 100644
--- a/src/components/chat/ask-question-card.test.tsx
+++ b/src/components/chat/ask-question-card.test.tsx
@@ -216,6 +216,56 @@ describe("AskQuestionCard", () => {
     })
   })
 
+  it("renders a free-text question (no options) as a bare input and submits it", () => {
+    // Codex elicitation / MCP-server forms ask open questions with 0 options:
+    // the input is the answer field — no "Other" toggle to click through.
+    const freeText: PendingQuestionState = {
+      question_id: "q-free",
+      created_at: "2026-01-01T00:00:00Z",
+      questions: [
+        {
+          id: "qf",
+          question: "What is the base URL?",
+          header: "URL",
+          multi_select: false,
+          options: [],
+        },
+      ],
+    }
+    const onAnswer = renderCard(freeText)
+    expect(screen.queryByRole("radio")).toBeNull()
+    const input = screen.getByPlaceholderText("Type your answer…")
+    const submit = screen.getByRole("button", { name: "Submit" })
+    expect(submit).toBeDisabled()
+    fireEvent.change(input, { target: { value: "https://api.example.com" } })
+    expect(submit).toBeEnabled()
+    fireEvent.click(submit)
+    expect(onAnswer).toHaveBeenCalledWith("q-free", {
+      answers: [{ questionId: "qf", labels: ["https://api.example.com"] }],
+      declined: false,
+    })
+  })
+
+  it("masks the input for a secret question", () => {
+    const secret: PendingQuestionState = {
+      question_id: "q-secret",
+      created_at: "2026-01-01T00:00:00Z",
+      questions: [
+        {
+          id: "qs",
+          question: "Paste your API key",
+          header: "Key",
+          multi_select: false,
+          options: [],
+          is_secret: true,
+        },
+      ],
+    }
+    renderCard(secret)
+    const input = screen.getByPlaceholderText("Type your answer…")
+    expect(input).toHaveAttribute("type", "password")
+  })
+
   it("skips with a declined answer", () => {
     const onAnswer = renderCard(single)
     fireEvent.click(screen.getByRole("button", { name: "Skip" }))
diff --git a/src/components/chat/ask-question-card.tsx b/src/components/chat/ask-question-card.tsx
index bd081c938..9caf679ca 100644
--- a/src/components/chat/ask-question-card.tsx
+++ b/src/components/chat/ask-question-card.tsx
@@ -302,17 +302,42 @@ export function AskQuestionCard({
   const renderOptions = (q: QuestionSpec) => {
     const s = state[q.id]
     const otherId = `${q.id}-other`
+    // Secret questions (codex marks API keys etc. with `is_secret`) mask the
+    // typed answer.
+    const inputType = q.is_secret ? "password" : "text"
+    const inputClass =
+      "w-full rounded-md border border-border/60 bg-background px-2.5 py-1.5 text-sm outline-none focus:border-ring disabled:cursor-not-allowed disabled:opacity-60"
+
+    // Free-text question (no options — codex elicitation and MCP-server forms
+    // ask open questions this way): the text input IS the answer field, always
+    // visible, with no "Other" toggle to click through first. Typing marks the
+    // question answered (`setOtherText` activates the free-text state).
+    if (q.options.length === 0) {
+      return (
+        <input
+          id={otherId}
+          type={inputType}
+          aria-label={q.question}
+          disabled={locked}
+          value={s?.otherText ?? ""}
+          onChange={(e) => setOtherText(q, e.target.value)}
+          placeholder={t("otherPlaceholder")}
+          className={inputClass}
+        />
+      )
+    }
+
     const otherInput = s?.otherActive ? (
       <input
         id={otherId}
-        type="text"
+        type={inputType}
         autoFocus
         aria-label={t("other")}
         disabled={locked}
         value={s.otherText}
         onChange={(e) => setOtherText(q, e.target.value)}
         placeholder={t("otherPlaceholder")}
-        className="w-full rounded-md border border-border/60 bg-background px-2.5 py-1.5 text-sm outline-none focus:border-ring disabled:cursor-not-allowed disabled:opacity-60"
+        className={inputClass}
       />
     ) : null
 
diff --git a/src/components/message/ask-question-result-card.test.tsx b/src/components/message/ask-question-result-card.test.tsx
index 6e7939df1..22251f187 100644
--- a/src/components/message/ask-question-result-card.test.tsx
+++ b/src/components/message/ask-question-result-card.test.tsx
@@ -293,4 +293,46 @@ describe("AskQuestionResultCard", () => {
     expect(chosen).toBeChecked()
     expect(chosen).toBeDisabled()
   })
+
+  it("echoes codex request_user_input answers keyed by question id", () => {
+    // The reported bug: codex Plan-mode `request_user_input` rendered "no
+    // selection" because its answer envelope is keyed by the question id
+    // ({answers:{<id>:{answers:[label]}}}), not the codeg-mcp array shape. The
+    // card must match the answer to the question by that id and echo the pick.
+    const input = JSON.stringify({
+      questions: [
+        {
+          id: "drink_preference",
+          header: "饮品偏好",
+          question: "工作时你更喜欢喝哪一种饮品？",
+          options: [
+            { label: "咖啡（推荐）", description: "浓郁提神" },
+            { label: "茶", description: "清爽温和" },
+            { label: "果汁", description: "甜味水果" },
+          ],
+        },
+      ],
+    })
+    const output = JSON.stringify({
+      answers: { drink_preference: { answers: ["咖啡（推荐）"] } },
+    })
+    renderWithIntl(
+      <AskQuestionResultCard
+        input={input}
+        output={output}
+        state="output-available"
+      />
+    )
+
+    // Collapsed capsule echoes the pick — NOT the noSelection fallback.
+    expect(screen.getByText("咖啡（推荐）")).toBeInTheDocument()
+    expect(screen.queryByText(result.noSelection)).toBeNull()
+    // Expanded: the chosen option is checked + disabled, others not. (The radio's
+    // accessible name folds in its description, so match on the label substring.)
+    expand()
+    const chosen = screen.getByRole("radio", { name: /咖啡/ })
+    expect(chosen).toBeChecked()
+    expect(chosen).toBeDisabled()
+    expect(screen.getByRole("radio", { name: /茶/ })).not.toBeChecked()
+  })
 })
diff --git a/src/components/message/ask-question-result-card.tsx b/src/components/message/ask-question-result-card.tsx
index eb4924deb..766499cb1 100644
--- a/src/components/message/ask-question-result-card.tsx
+++ b/src/components/message/ask-question-result-card.tsx
@@ -75,6 +75,7 @@ export function AskQuestionResultCard({
         header: q.header,
         multi_select: q.multiSelect,
         options: q.options,
+        is_secret: q.isSecret,
       })),
     }
   }, [questions])
@@ -84,14 +85,25 @@ export function AskQuestionResultCard({
   const initialSelections = useMemo(() => {
     const sel: Record<string, { chosen: string[]; otherText: string }> = {}
     if (!pending || outcome?.declined) return sel
+    // codex `request_user_input` answers carry the question `id`; codeg-mcp / grok
+    // asks carry none and match on the header+question signature instead.
+    const byId = new Map(
+      (outcome?.answers ?? [])
+        .filter((a) => a.id)
+        .map((a) => [a.id as string, a.selected])
+    )
     const bySig = new Map(
       (outcome?.answers ?? []).map((a) => [
         `${a.header}${KEY_SEP}${a.question}`,
         a.selected,
       ])
     )
-    pending.questions.forEach((q) => {
-      const values = bySig.get(`${q.header}${KEY_SEP}${q.question}`) ?? []
+    pending.questions.forEach((q, i) => {
+      const qid = questions[i]?.id
+      const values =
+        (qid ? byId.get(qid) : undefined) ??
+        bySig.get(`${q.header}${KEY_SEP}${q.question}`) ??
+        []
       const { selected, other } = matchSelections(
         values,
         q.options.map((o) => o.label)
@@ -99,7 +111,7 @@ export function AskQuestionResultCard({
       sel[q.id] = { chosen: selected, otherText: other.join(", ") }
     })
     return sel
-  }, [pending, outcome])
+  }, [pending, outcome, questions])
 
   // Compact header card for the states with no answered selection to render.
   const shell = (subtitle: string | null, body?: ReactNode) => (
diff --git a/src/components/message/content-parts-renderer.tsx b/src/components/message/content-parts-renderer.tsx
index 15a5a4651..f13ccd582 100644
--- a/src/components/message/content-parts-renderer.tsx
+++ b/src/components/message/content-parts-renderer.tsx
@@ -64,6 +64,7 @@ import {
   TerminalIcon,
   SearchIcon,
   GlobeIcon,
+  ClipboardListIcon,
   ListTodoIcon,
   SparklesIcon,
   CircleCheckIcon,
@@ -2574,6 +2575,34 @@ const PlanPart = memo(function PlanPart({
   return <PlanCard entries={part.entries} isStreaming={part.isStreaming} />
 })
 
+// Codex Plan-mode `<proposed_plan>` block: free-form markdown plan document
+// rendered inside card chrome (distinct from the TodoWrite checklist PlanCard).
+const ProposedPlanPart = memo(function ProposedPlanPart({
+  part,
+}: {
+  part: Extract<AdaptedContentPart, { type: "proposed-plan" }>
+}) {
+  const t = useTranslations("Folder.chat.proposedPlan")
+  const markdown = part.markdown.trim()
+  return (
+    <div className="overflow-hidden rounded-lg border bg-card/50 ws-msg-card">
+      <div className="flex items-center gap-2 border-b px-3 py-2">
+        <ClipboardListIcon className="size-4 shrink-0 text-muted-foreground" />
+        <span className="min-w-0 flex-1 truncate text-sm font-medium">
+          {t("title")}
+        </span>
+      </div>
+      <div className="px-3 py-2 text-sm">
+        {markdown.length > 0 ? (
+          <MessageResponse>{markdown}</MessageResponse>
+        ) : (
+          <span className="text-muted-foreground">{t("planning")}</span>
+        )}
+      </div>
+    </div>
+  )
+})
+
 const ToolGroupPart = memo(function ToolGroupPart({
   part,
 }: {
@@ -2730,6 +2759,10 @@ export const ContentPartsRenderer = memo(function ContentPartsRenderer({
       return <PlanPart key={`plan-${keyId}`} part={part} />
     }
 
+    if (part.type === "proposed-plan") {
+      return <ProposedPlanPart key={`proposed-plan-${keyId}`} part={part} />
+    }
+
     if (part.type === "generated-image") {
       return (
         <GeneratedImagesBlock
diff --git a/src/i18n/messages/ar.json b/src/i18n/messages/ar.json
index c3333a251..24277ab8d 100644
--- a/src/i18n/messages/ar.json
+++ b/src/i18n/messages/ar.json
@@ -2794,6 +2794,10 @@
         "cardCompleted": "اكتملت مهمة الخلفية",
         "cardFinishedWithStatus": "انتهت مهمة الخلفية ({status})",
         "cardResultPending": "لم تصل النتيجة بعد"
+      },
+      "proposedPlan": {
+        "title": "الخطة المقترحة",
+        "planning": "جارٍ التخطيط…"
       }
     },
     "diffPreview": {
diff --git a/src/i18n/messages/de.json b/src/i18n/messages/de.json
index 5526da56f..fac95f071 100644
--- a/src/i18n/messages/de.json
+++ b/src/i18n/messages/de.json
@@ -2794,6 +2794,10 @@
         "cardCompleted": "Hintergrundaufgabe abgeschlossen",
         "cardFinishedWithStatus": "Hintergrundaufgabe beendet ({status})",
         "cardResultPending": "Ergebnis steht noch aus"
+      },
+      "proposedPlan": {
+        "title": "Vorgeschlagener Plan",
+        "planning": "Wird geplant…"
       }
     },
     "diffPreview": {
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index 5b1cd0f13..40d000718 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -2794,6 +2794,10 @@
         "cardCompleted": "Background task completed",
         "cardFinishedWithStatus": "Background task finished ({status})",
         "cardResultPending": "Result not returned yet"
+      },
+      "proposedPlan": {
+        "title": "Proposed plan",
+        "planning": "Planning…"
       }
     },
     "diffPreview": {
diff --git a/src/i18n/messages/es.json b/src/i18n/messages/es.json
index 55a859699..35f210855 100644
--- a/src/i18n/messages/es.json
+++ b/src/i18n/messages/es.json
@@ -2794,6 +2794,10 @@
         "cardCompleted": "Tarea en segundo plano completada",
         "cardFinishedWithStatus": "Tarea en segundo plano finalizada ({status})",
         "cardResultPending": "El resultado aún no ha llegado"
+      },
+      "proposedPlan": {
+        "title": "Plan propuesto",
+        "planning": "Planificando…"
       }
     },
     "diffPreview": {
diff --git a/src/i18n/messages/fr.json b/src/i18n/messages/fr.json
index 0ab23cec6..91697deda 100644
--- a/src/i18n/messages/fr.json
+++ b/src/i18n/messages/fr.json
@@ -2794,6 +2794,10 @@
         "cardCompleted": "Tâche en arrière-plan terminée",
         "cardFinishedWithStatus": "Tâche en arrière-plan terminée ({status})",
         "cardResultPending": "Résultat pas encore reçu"
+      },
+      "proposedPlan": {
+        "title": "Plan proposé",
+        "planning": "Planification…"
       }
     },
     "diffPreview": {
diff --git a/src/i18n/messages/ja.json b/src/i18n/messages/ja.json
index d85e75cad..45135b574 100644
--- a/src/i18n/messages/ja.json
+++ b/src/i18n/messages/ja.json
@@ -2794,6 +2794,10 @@
         "cardCompleted": "バックグラウンドタスクが完了しました",
         "cardFinishedWithStatus": "バックグラウンドタスクが終了しました（{status}）",
         "cardResultPending": "結果はまだ返っていません"
+      },
+      "proposedPlan": {
+        "title": "提案された計画",
+        "planning": "計画中…"
       }
     },
     "diffPreview": {
diff --git a/src/i18n/messages/ko.json b/src/i18n/messages/ko.json
index e50b3ddc0..4f3ec2397 100644
--- a/src/i18n/messages/ko.json
+++ b/src/i18n/messages/ko.json
@@ -2794,6 +2794,10 @@
         "cardCompleted": "백그라운드 작업 완료",
         "cardFinishedWithStatus": "백그라운드 작업 종료 ({status})",
         "cardResultPending": "결과가 아직 반환되지 않았습니다"
+      },
+      "proposedPlan": {
+        "title": "제안된 계획",
+        "planning": "계획 중…"
       }
     },
     "diffPreview": {
diff --git a/src/i18n/messages/pt.json b/src/i18n/messages/pt.json
index 3759dbf3c..61c1e0252 100644
--- a/src/i18n/messages/pt.json
+++ b/src/i18n/messages/pt.json
@@ -2794,6 +2794,10 @@
         "cardCompleted": "Tarefa em segundo plano concluída",
         "cardFinishedWithStatus": "Tarefa em segundo plano encerrada ({status})",
         "cardResultPending": "Resultado ainda não retornou"
+      },
+      "proposedPlan": {
+        "title": "Plano proposto",
+        "planning": "A planear…"
       }
     },
     "diffPreview": {
diff --git a/src/i18n/messages/zh-CN.json b/src/i18n/messages/zh-CN.json
index ec72c2452..8539dae4e 100644
--- a/src/i18n/messages/zh-CN.json
+++ b/src/i18n/messages/zh-CN.json
@@ -2794,6 +2794,10 @@
         "cardCompleted": "后台任务已完成",
         "cardFinishedWithStatus": "后台任务已结束（{status}）",
         "cardResultPending": "结果尚未返回"
+      },
+      "proposedPlan": {
+        "title": "计划提案",
+        "planning": "规划中…"
       }
     },
     "diffPreview": {
diff --git a/src/i18n/messages/zh-TW.json b/src/i18n/messages/zh-TW.json
index 8407a3e3b..3cf0dfc9c 100644
--- a/src/i18n/messages/zh-TW.json
+++ b/src/i18n/messages/zh-TW.json
@@ -2794,6 +2794,10 @@
         "cardCompleted": "背景任務已完成",
         "cardFinishedWithStatus": "背景任務已結束（{status}）",
         "cardResultPending": "結果尚未返回"
+      },
+      "proposedPlan": {
+        "title": "計劃提案",
+        "planning": "規劃中…"
       }
     },
     "diffPreview": {
diff --git a/src/lib/adapters/ai-elements-adapter.test.ts b/src/lib/adapters/ai-elements-adapter.test.ts
index 1371f87bf..feee262cd 100644
--- a/src/lib/adapters/ai-elements-adapter.test.ts
+++ b/src/lib/adapters/ai-elements-adapter.test.ts
@@ -557,6 +557,57 @@ describe("groupGoalRuns", () => {
   })
 })
 
+describe("adaptMessageTurn proposed plan", () => {
+  const wrap = (text: string, streaming = false) =>
+    adaptMessageTurn(
+      {
+        id: "pp-turn",
+        role: "assistant" as const,
+        timestamp: "2026-07-22T00:00:00.000Z",
+        blocks: [{ type: "text", text }],
+      },
+      {
+        attachedResources: "Attached resources",
+        toolCallFailed: "Tool failed",
+      },
+      streaming
+    )
+
+  it("lifts a closed <proposed_plan> block into a card with surrounding prose", () => {
+    const adapted = wrap(
+      "Here is my plan.\n<proposed_plan>\n# Plan\n\n- step one\n</proposed_plan>\nProceeding."
+    )
+    expect(adapted.content.map((p) => p.type)).toEqual([
+      "text",
+      "proposed-plan",
+      "text",
+    ])
+    const card = adapted.content[1] as {
+      markdown: string
+      isStreaming: boolean
+    }
+    expect(card.isStreaming).toBe(false)
+    expect(card.markdown).toContain("# Plan")
+    expect(card.markdown).toContain("- step one")
+    // The raw tags never leak into rendered content.
+    expect(JSON.stringify(adapted.content)).not.toContain("<proposed_plan>")
+  })
+
+  it("renders an unclosed block as a streaming card while the turn streams", () => {
+    const adapted = wrap("<proposed_plan>\n# Draft", true)
+    expect(adapted.content.map((p) => p.type)).toEqual(["proposed-plan"])
+    expect(adapted.content[0]).toMatchObject({
+      type: "proposed-plan",
+      isStreaming: true,
+    })
+  })
+
+  it("leaves ordinary assistant text untouched", () => {
+    const adapted = wrap("Just a normal reply.")
+    expect(adapted.content.map((p) => p.type)).toEqual(["text"])
+  })
+})
+
 describe("adaptMessageTurn goal update text", () => {
   it("converts streaming Codex goal update text into a running goal card", () => {
     const adapted = adaptMessageTurn(
diff --git a/src/lib/adapters/ai-elements-adapter.ts b/src/lib/adapters/ai-elements-adapter.ts
index 9f1abbd7f..773016272 100644
--- a/src/lib/adapters/ai-elements-adapter.ts
+++ b/src/lib/adapters/ai-elements-adapter.ts
@@ -108,6 +108,20 @@ export type AdaptedPlanPart = {
   isStreaming: boolean
 }
 
+/**
+ * A codex Plan-mode `<proposed_plan>…</proposed_plan>` block, lifted out of the
+ * assistant's message text and rendered as a dedicated card. Unlike
+ * `AdaptedPlanPart` (a TodoWrite checklist), the body is free-form markdown (the
+ * plan document codex proposes), so it renders through the normal markdown
+ * pipeline inside card chrome. Detection lives purely in the frontend adapter,
+ * so live and reload converge (both hand raw assistant text to the same path).
+ */
+export type AdaptedProposedPlanPart = {
+  type: "proposed-plan"
+  markdown: string
+  isStreaming: boolean
+}
+
 export type AdaptedContentPart =
   | { type: "text"; text: string }
   | AdaptedToolCallPart
@@ -150,6 +164,7 @@ export type AdaptedContentPart =
   | AdaptedGoalRunPart
   | AdaptedGeneratedImagePart
   | AdaptedPlanPart
+  | AdaptedProposedPlanPart
 
 export interface UserResourceDisplay {
   name: string
@@ -397,6 +412,64 @@ function parseInlineToolResultPayload(payload: string): {
   }
 }
 
+const PROPOSED_PLAN_OPEN = "<proposed_plan>"
+const PROPOSED_PLAN_CLOSE = "</proposed_plan>"
+
+/**
+ * Lift codex Plan-mode `<proposed_plan>…</proposed_plan>` block(s) out of an
+ * assistant text block into dedicated `proposed-plan` parts, leaving surrounding
+ * prose as normal text. Returns `null` when the text has no such block (so it
+ * falls through to the normal text path). While the turn streams, an as-yet
+ * unclosed block renders as a streaming card (its markdown grows in place);
+ * once `</proposed_plan>` arrives it settles. The open/close markers are always
+ * consumed so the raw tags never render, even for an empty or truncated block.
+ */
+function expandProposedPlanText(
+  text: string,
+  isStreaming: boolean
+): AdaptedContentPart[] | null {
+  if (!text.includes(PROPOSED_PLAN_OPEN)) return null
+
+  const parts: AdaptedContentPart[] = []
+  let cursor = 0
+  let sawPlan = false
+
+  for (;;) {
+    const open = text.indexOf(PROPOSED_PLAN_OPEN, cursor)
+    if (open === -1) break
+    sawPlan = true
+
+    const lead = text.slice(cursor, open)
+    if (lead.trim().length > 0) parts.push({ type: "text", text: lead })
+
+    const bodyStart = open + PROPOSED_PLAN_OPEN.length
+    const close = text.indexOf(PROPOSED_PLAN_CLOSE, bodyStart)
+    const stillStreaming = close === -1
+    const body = (
+      stillStreaming ? text.slice(bodyStart) : text.slice(bodyStart, close)
+    ).trim()
+    const streamingCard = stillStreaming && isStreaming
+    if (body.length > 0 || streamingCard) {
+      parts.push({
+        type: "proposed-plan",
+        markdown: body,
+        isStreaming: streamingCard,
+      })
+    }
+
+    if (stillStreaming) {
+      cursor = text.length
+      break
+    }
+    cursor = close + PROPOSED_PLAN_CLOSE.length
+  }
+
+  const trail = text.slice(cursor)
+  if (trail.trim().length > 0) parts.push({ type: "text", text: trail })
+
+  return sawPlan ? parts : null
+}
+
 function expandInlineToolText(
   text: string,
   messageId: string,
@@ -1670,6 +1743,15 @@ export function adaptMessageTurn(
         adaptedContent.push(...expandedParts)
         continue
       }
+
+      // Codex Plan mode emits its plan as a `<proposed_plan>…</proposed_plan>`
+      // block inside the assistant text; render it as a dedicated card instead
+      // of raw text with visible tags. Covers live + reload (same adapter).
+      const proposedPlanParts = expandProposedPlanText(block.text, isStreaming)
+      if (proposedPlanParts) {
+        adaptedContent.push(...proposedPlanParts)
+        continue
+      }
     }
 
     if (block.type === "tool_use") {
diff --git a/src/lib/adapters/tool-kind-classifier.test.ts b/src/lib/adapters/tool-kind-classifier.test.ts
index fdb8f93a8..5e15a802c 100644
--- a/src/lib/adapters/tool-kind-classifier.test.ts
+++ b/src/lib/adapters/tool-kind-classifier.test.ts
@@ -98,6 +98,12 @@ describe("isAgentLikeToolName", () => {
     expect(isAgentLikeToolName("codeg-mcp:ask_user_question")).toBe(true)
   })
 
+  it("matches codex's Plan-mode request_user_input", () => {
+    // History keeps the raw name (the live path collapses it to "question"); it
+    // owns the AskQuestionResultCard, so it must render standalone, not folded.
+    expect(isAgentLikeToolName("request_user_input")).toBe(true)
+  })
+
   it("matches check_user_feedback across host naming conventions", () => {
     expect(isAgentLikeToolName("check_user_feedback")).toBe(true)
     expect(isAgentLikeToolName("mcp__codeg-mcp__check_user_feedback")).toBe(
diff --git a/src/lib/adapters/tool-kind-classifier.ts b/src/lib/adapters/tool-kind-classifier.ts
index 964d62551..cb09e1f8d 100644
--- a/src/lib/adapters/tool-kind-classifier.ts
+++ b/src/lib/adapters/tool-kind-classifier.ts
@@ -66,6 +66,10 @@ export function isAgentLikeToolName(toolName: string): boolean {
     // forms, since this runs pre-normalize.
     name === "question" ||
     name === "ask_user_question" ||
+    // codex Plan-mode `request_user_input` (delivered via elicitation) owns the
+    // same AskQuestionResultCard. The history parser keeps this raw name, so
+    // hoist it here too; the live path already collapses it to "question".
+    name === "request_user_input" ||
     // codeg-mcp check_user_feedback — owns the FeedbackCheckResultCard capsule,
     // so the (visible) ones must break the run and render standalone rather than
     // fold into a tool-group. The no-op polls are dropped upstream by
diff --git a/src/lib/ask-question.test.ts b/src/lib/ask-question.test.ts
index a747d7704..f8fd658ec 100644
--- a/src/lib/ask-question.test.ts
+++ b/src/lib/ask-question.test.ts
@@ -58,6 +58,7 @@ describe("parseAskQuestionInput", () => {
           { label: "Incremental", description: "Smaller steps" },
           { label: "Rewrite", description: "Start fresh" },
         ],
+        isSecret: false,
       },
     ])
   })
@@ -86,6 +87,7 @@ describe("parseAskQuestionInput", () => {
         header: "H",
         multiSelect: false,
         options: [{ label: "A", description: "" }],
+        isSecret: false,
       },
     ])
   })
@@ -130,10 +132,41 @@ describe("parseAskQuestionInput", () => {
         header: "Approach",
         multiSelect: false,
         options: [{ label: "Incremental", description: "Smaller steps" }],
+        isSecret: false,
       },
     ])
   })
 
+  it("reads codex's isSecret marker (and the snake_case variant)", () => {
+    const input = JSON.stringify({
+      questions: [
+        { question: "API key?", header: "Key", options: [], isSecret: true },
+        { question: "Token?", header: "Tok", options: [], is_secret: true },
+        { question: "Name?", header: "Name", options: [] },
+      ],
+    })
+    const result = parseAskQuestionInput(input)
+    expect(result.map((q) => q.isSecret)).toEqual([true, true, false])
+  })
+
+  it("captures codex's per-question id (and leaves it undefined otherwise)", () => {
+    // codex `request_user_input` keys each question with a stable id; its answer
+    // envelope is keyed by that id (see parseAskQuestionOutcome below).
+    const input = JSON.stringify({
+      questions: [
+        {
+          id: "drink_preference",
+          header: "饮品偏好",
+          question: "工作时你更喜欢喝哪一种饮品？",
+          options: [{ label: "咖啡（推荐）" }, { label: "茶" }],
+        },
+        { question: "No id here", header: "H", options: [{ label: "A" }] },
+      ],
+    })
+    const result = parseAskQuestionInput(input)
+    expect(result.map((q) => q.id)).toEqual(["drink_preference", undefined])
+  })
+
   it("returns [] for malformed JSON, missing questions, or nullish input", () => {
     expect(parseAskQuestionInput("not json")).toEqual([])
     expect(parseAskQuestionInput(JSON.stringify({ foo: 1 }))).toEqual([])
@@ -286,6 +319,42 @@ describe("parseAskQuestionOutcome", () => {
     expect(parseAskQuestionOutcome(output)?.answers[0].selected).toEqual(["A"])
   })
 
+  it("parses codex request_user_input's object-keyed answers", () => {
+    // Verbatim function_call_output shape from ~/.codex/sessions: answers are
+    // keyed by the question id, each carrying its own `answers` array — NOT the
+    // codeg-mcp `{answers:[{…,selected}]}` envelope. Without this the card shows
+    // "no selection" (the reported bug).
+    const output = JSON.stringify({
+      answers: { drink_preference: { answers: ["咖啡（推荐）"] } },
+    })
+    expect(parseAskQuestionOutcome(output)).toEqual({
+      declined: false,
+      answers: [
+        {
+          id: "drink_preference",
+          header: "",
+          question: "",
+          selected: ["咖啡（推荐）"],
+        },
+      ],
+    })
+  })
+
+  it("parses a multi-question codex answer envelope", () => {
+    const output = JSON.stringify({
+      answers: {
+        q1: { answers: ["A"] },
+        q2: { answers: ["X", "Y"] },
+      },
+    })
+    const parsed = parseAskQuestionOutcome(output)
+    expect(parsed?.declined).toBe(false)
+    expect(parsed?.answers).toEqual([
+      { id: "q1", header: "", question: "", selected: ["A"] },
+      { id: "q2", header: "", question: "", selected: ["X", "Y"] },
+    ])
+  })
+
   it("keeps an option label containing a comma intact as one entry", () => {
     const output = JSON.stringify({
       answers: [
diff --git a/src/lib/ask-question.ts b/src/lib/ask-question.ts
index bc21451ed..a5861bde4 100644
--- a/src/lib/ask-question.ts
+++ b/src/lib/ask-question.ts
@@ -23,6 +23,13 @@ export interface AskQuestion {
   /** The wire field is `multiSelect` (camelCase); we also accept `multi_select`. */
   multiSelect: boolean
   options: AskQuestionOption[]
+  /** Codex `request_user_input` marks secret answers (API keys etc.) with
+   *  `isSecret`; the read-only card masks them. */
+  isSecret: boolean
+  /** Codex `request_user_input` gives each question a stable `id`; its chosen
+   *  answer envelope is keyed by that id rather than the question text (unlike
+   *  the codeg-mcp ask, which the card matches by header+question). */
+  id?: string
 }
 
 export interface AskQuestionAnswer {
@@ -32,6 +39,10 @@ export interface AskQuestionAnswer {
    *  "Other" answer (empty when nothing was chosen). Partition against the
    *  question's options with `matchSelections`. */
   selected: string[]
+  /** Present for codex `request_user_input`, whose answers are keyed by the
+   *  question `id` rather than its header/question text; the card matches on it
+   *  when set, otherwise on the header+question signature. */
+  id?: string
 }
 
 export interface AskQuestionOutcome {
@@ -122,6 +133,8 @@ export function parseAskQuestionInput(
       header: asString(obj.header),
       multiSelect: obj.multiSelect === true || obj.multi_select === true,
       options,
+      isSecret: obj.isSecret === true || obj.is_secret === true,
+      id: typeof obj.id === "string" && obj.id ? obj.id : undefined,
     })
   }
   return out
@@ -163,11 +176,37 @@ function parseAnswers(raw: unknown): AskQuestionAnswer[] {
   return out
 }
 
+/**
+ * codex `request_user_input` records its answers keyed by question id rather
+ * than as the codeg-mcp array envelope:
+ *   { "answers": { "<questionId>": { "answers": ["label", ...] } } }
+ * Return one answer per id (carrying that id so the card can match it against
+ * the question's own id), or `null` when `answers` isn't the object map — so a
+ * codeg-mcp / Claude result (whose `answers` is an ARRAY) never lands here.
+ */
+function parseCodexAnswers(
+  source: Record<string, unknown> | null | undefined
+): AskQuestionAnswer[] | null {
+  if (!source) return null
+  const map = source.answers
+  if (!map || typeof map !== "object" || Array.isArray(map)) return null
+  const out: AskQuestionAnswer[] = []
+  for (const [id, entry] of Object.entries(map as Record<string, unknown>)) {
+    const raw = asRecord(entry)?.answers
+    const selected = Array.isArray(raw)
+      ? raw.filter((x): x is string => typeof x === "string")
+      : []
+    out.push({ id, header: "", question: "", selected })
+  }
+  return out.length > 0 ? out : null
+}
+
 /**
  * Parse the structured `{ answers, declined }` envelope the agent CLI persists
  * for the tool result (the companion's `structuredContent`). It may sit at the
- * top level or nested under `structuredContent`. Returns `null` when `output`
- * is not that envelope, so the text fallback can take over.
+ * top level or nested under `structuredContent`. Also recognizes codex's
+ * object-keyed `request_user_input` envelope (see `parseCodexAnswers`). Returns
+ * `null` when `output` is neither, so the text fallback can take over.
  */
 function parseOutcomeJson(output: string): AskQuestionOutcome | null {
   let parsed: unknown
@@ -196,12 +235,24 @@ function parseOutcomeJson(output: string): AskQuestionOutcome | null {
   const result = asRecord(top.result)
   const resultOk = result ? (asRecord(result.Ok) ?? asRecord(result.ok)) : null
   const env = envelopeOf(top) ?? envelopeOf(result) ?? envelopeOf(resultOk)
-  if (!env) return null
-  if (!Array.isArray(env.answers) && typeof env.declined !== "boolean") {
-    return null
+  if (
+    env &&
+    (Array.isArray(env.answers) || typeof env.declined === "boolean")
+  ) {
+    if (env.declined === true) return { declined: true, answers: [] }
+    return { declined: false, answers: parseAnswers(env.answers) }
   }
-  if (env.declined === true) return { declined: true, answers: [] }
-  return { declined: false, answers: parseAnswers(env.answers) }
+
+  // codex `request_user_input`: object-keyed answers. Checked after the
+  // array-shaped envelope above so a codeg-mcp result never falls through here.
+  const codex =
+    parseCodexAnswers(top) ??
+    parseCodexAnswers(asRecord(top.structuredContent)) ??
+    parseCodexAnswers(result) ??
+    parseCodexAnswers(resultOk)
+  if (codex) return { declined: false, answers: codex }
+
+  return null
 }
 
 /**
diff --git a/src/lib/types.ts b/src/lib/types.ts
index a763d61ea..dd4661e94 100644
--- a/src/lib/types.ts
+++ b/src/lib/types.ts
@@ -972,13 +972,17 @@ export interface QuestionOption {
 }
 
 /** A single multiple-choice question (mirror of Rust `QuestionSpec`). `id` is
- *  the backend-minted correlation key the answer is submitted against. */
+ *  the backend-minted correlation key the answer is submitted against. Empty
+ *  `options` means free-text: the card renders only its "Other" input (codex
+ *  elicitation / MCP-server forms ask open questions this way). `is_secret`
+ *  masks that input (absent on the wire for non-secret sources). */
 export interface QuestionSpec {
   id: string
   question: string
   header: string
   multi_select: boolean
   options: QuestionOption[]
+  is_secret?: boolean
 }
 
 /** Awaiting-answer question set on the session (mirror of `PendingQuestionState`). */

From 06bd9c0d1f91ff551bd45c4e2bd4cc0ffd1b4de2 Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Fri, 24 Jul 2026 20:25:54 +0800
Subject: [PATCH 11/15] feat(settings): exclude built-in expert/office/science
 skills from agent import picker

---
 .../settings/custom-skills-settings.tsx       | 52 +++++++++++++++++--
 1 file changed, 49 insertions(+), 3 deletions(-)

diff --git a/src/components/settings/custom-skills-settings.tsx b/src/components/settings/custom-skills-settings.tsx
index 1d13fd862..990cc7043 100644
--- a/src/components/settings/custom-skills-settings.tsx
+++ b/src/components/settings/custom-skills-settings.tsx
@@ -65,6 +65,9 @@ import {
   customSaveSkill,
   acpListAgents,
   acpListAgentSkills,
+  expertsList,
+  scienceList,
+  officecliListSkills,
 } from "@/lib/api"
 import { invalidateAgentSkillsCache } from "@/hooks/use-agent-skills"
 import { isLocalDesktop } from "@/lib/platform"
@@ -86,6 +89,41 @@ import { cn } from "@/lib/utils"
 // Custom skills have no curated category taxonomy — they live under one group.
 const CATEGORY_ORDER: Record<string, number> = { custom: 1 }
 
+// Built-in pack skill ids (experts / office / science) — the same union the
+// backend treats as "reserved". When one of these packs is enabled for an agent
+// it's symlinked into the agent's skill directory, so it surfaces in the agent's
+// skill list; but it's codeg's OWN bundled skill, not the user's, and is
+// deliberately excluded from the custom central store. We hide them from the
+// import-from-agent picker so users only ever see (and re-import) their own
+// agent skills. The set is static per session (bundled at compile time), so it's
+// fetched once and cached at module scope. A load failure degrades to
+// "no filtering" rather than blocking imports.
+let reservedSkillIdsCache: Set<string> | null = null
+
+async function loadReservedSkillIds(): Promise<Set<string>> {
+  if (reservedSkillIdsCache) return reservedSkillIdsCache
+  try {
+    const [experts, science, office] = await Promise.all([
+      expertsList(),
+      scienceList(),
+      officecliListSkills(),
+    ])
+    const ids = new Set<string>([
+      ...experts.map((e) => e.metadata.id),
+      ...science.map((s) => s.metadata.id),
+      ...office.map((o) => o.id),
+    ])
+    reservedSkillIdsCache = ids
+    return ids
+  } catch (err) {
+    console.warn(
+      "[CustomSkillsSettings] failed to load built-in skill ids; import filter disabled:",
+      err
+    )
+    return new Set()
+  }
+}
+
 type EditorMode = "create" | "edit"
 
 export function CustomSkillsBody({
@@ -321,15 +359,23 @@ export function CustomSkillsBody({
       setAgentImportSkills([])
       setAgentImportSelected(new Set())
       try {
-        const result = await acpListAgentSkills({ agentType })
+        const [result, reserved] = await Promise.all([
+          acpListAgentSkills({ agentType }),
+          loadReservedSkillIds(),
+        ])
         if (!result.supported) {
           setAgentImportUnsupported(true)
           return
         }
         // Only global-scope skills belong in the shared store (project skills
         // are workspace-specific). We pass no workspace, so the result is
-        // already global-only; filter defensively.
-        const globals = result.skills.filter((s) => s.scope === "global")
+        // already global-only; filter defensively. Also drop codeg's own
+        // built-in pack skills (experts / office / science): when enabled they
+        // symlink into the agent's dir and would otherwise appear here, but they
+        // aren't the user's own skills to re-import.
+        const globals = result.skills.filter(
+          (s) => s.scope === "global" && !reserved.has(s.id)
+        )
         setAgentImportSkills(globals)
         // Pre-select everything not already in the central library so the common
         // "import all" case is a single click.

From 7bd87da94c59d4cfcfde97f8ac9338776a59a0eb Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Fri, 24 Jul 2026 20:26:06 +0800
Subject: [PATCH 12/15] fix(messages): fit the user message capsule to its
 content instead of full width

---
 src/components/ai-elements/message.tsx | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/components/ai-elements/message.tsx b/src/components/ai-elements/message.tsx
index 5edc19f31..451f47cd3 100644
--- a/src/components/ai-elements/message.tsx
+++ b/src/components/ai-elements/message.tsx
@@ -40,10 +40,14 @@ export type MessageProps = HTMLAttributes<HTMLDivElement> & {
 export const Message = ({ className, from, ...props }: MessageProps) => (
   <div
     className={cn(
-      "group flex w-full flex-col gap-2",
+      "group flex flex-col gap-2",
       from === "user"
-        ? "is-user ml-auto justify-end max-w-[88%]"
-        : "is-assistant",
+        ? // Outer user capsule hugs its content (`w-fit`) instead of always
+          // reserving the full `max-w-[88%]` box — the inner bubble
+          // (`MessageContent`) is already `w-fit`, so this just drops the
+          // phantom full-width wrapper. Assistant keeps `w-full`.
+          "is-user ml-auto justify-end w-fit max-w-[88%]"
+        : "is-assistant w-full",
       className
     )}
     {...props}

From 848648d5bd1b795b1f8608b5aa6a3211f70a5235 Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Fri, 24 Jul 2026 21:17:31 +0800
Subject: [PATCH 13/15] perf(conversations): hide the outgoing tab immediately
 on session switch

Drive each tab's isActive/showActiveFlow from a deferred active id so the visibility toggle commits before the memoized ConversationTabView bodies re-render, instead of the previous view (notably the new-session welcome page) lingering until that heavy work finished.
---
 .../conversation-detail-panel.tsx             | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/components/conversations/conversation-detail-panel.tsx b/src/components/conversations/conversation-detail-panel.tsx
index d1afe73a5..0ce5a7388 100644
--- a/src/components/conversations/conversation-detail-panel.tsx
+++ b/src/components/conversations/conversation-detail-panel.tsx
@@ -3,6 +3,7 @@
 import {
   memo,
   useCallback,
+  useDeferredValue,
   useEffect,
   useMemo,
   useRef,
@@ -1691,6 +1692,15 @@ export function ConversationDetailPanel() {
   const allFolders = useAppWorkspaceStore((s) => s.allFolders)
   const tabs = useTabStore((s) => s.tabs)
   const activeTabId = useTabStore((s) => s.activeTabId)
+  // Content-priority active id. The per-tab wrapper's show/hide reads the urgent
+  // `activeTabId`, so the outgoing tab (notably the new-session welcome page)
+  // hides in the same frame as the click; the heavy per-tab subtree only flips
+  // its `isActive`/`showActiveFlow` when this deferred value catches up — a
+  // non-blocking transition a frame later. Previously both tabs' large memoized
+  // bodies re-rendered in the same synchronous commit that hid the old tab, so
+  // the browser couldn't paint the hidden state until that work finished and the
+  // welcome components appeared to linger before disappearing.
+  const deferredActiveTabId = useDeferredValue(activeTabId)
   const isTileMode = useTabStore((s) => s.isTileMode)
   const { openNewConversationTab, closeTab, switchTab, onPreviewTabReplaced } =
     useTabActions()
@@ -1999,7 +2009,12 @@ export function ConversationDetailPanel() {
   }
 
   const tabElements = tabs.map((tab, index) => {
+    // `active` drives the urgent show/hide (below); `contentActive` (deferred)
+    // drives the tab body's active-only work, so a switch paints the visibility
+    // change before re-rendering the heavy subtrees. They agree once the
+    // deferred value settles a frame later.
     const active = tab.id === activeTabId
+    const contentActive = tab.id === deferredActiveTabId
     const folderPath = allFolders.find((f) => f.id === tab.folderId)?.path
     const view = (
       <ConversationTabView
@@ -2007,8 +2022,8 @@ export function ConversationDetailPanel() {
         conversationId={tab.conversationId}
         agentType={tab.agentType}
         workingDir={tab.workingDir ?? folderPath}
-        isActive={active}
-        showActiveFlow={canTile && active}
+        isActive={contentActive}
+        showActiveFlow={canTile && contentActive}
         reloadSignal={reloadByTabId[tab.id] ?? 0}
       />
     )

From ba9c7d5abfb9da7f78221c81c4ffe78e6fc7e23e Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Fri, 24 Jul 2026 21:18:30 +0800
Subject: [PATCH 14/15] fix(messages): fit the ask-question result capsule to
 its content instead of full width

---
 src/components/message/ask-question-result-card.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/components/message/ask-question-result-card.tsx b/src/components/message/ask-question-result-card.tsx
index 766499cb1..758742a6d 100644
--- a/src/components/message/ask-question-result-card.tsx
+++ b/src/components/message/ask-question-result-card.tsx
@@ -226,7 +226,7 @@ export function AskQuestionResultCard({
       aria-expanded={expanded}
       data-testid="ask-question-result-card"
       className={cn(
-        "flex w-full items-center gap-2 rounded-full border border-primary/30 bg-card ws-msg-card px-3 py-1.5 text-left transition-colors hover:bg-muted/40",
+        "flex w-fit max-w-full items-center gap-2 rounded-full border border-primary/30 bg-card ws-msg-card px-3 py-1.5 text-left transition-colors hover:bg-muted/40",
         !expanded && "mb-2"
       )}
     >

From feedf14811e63b9e771806279b281e581f415267 Mon Sep 17 00:00:00 2001
From: xintaofei <itpkcn@gmail.com>
Date: Fri, 24 Jul 2026 21:29:17 +0800
Subject: [PATCH 15/15] fix(acp): raise crate recursion_limit so the connection
 async frame compiles
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The block_on(async move { … }) frame wrapping run_connection nests deep enough that computing its type layout overflows rustc's default query depth of 128. Set recursion_limit to 256 on the codeg_lib crate root.
---
 src-tauri/src/lib.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 9df46643e..157ce5cde 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -1,3 +1,12 @@
+// The ACP connection driver (`acp::connection`) wraps the enormous
+// `run_connection` future in a `block_on(async move { … })` frame whose type
+// layout nests deep enough to blow rustc's default query depth of 128 (it
+// overflowed by ~130 when computing the async block's layout). This is a
+// compile-time type-recursion knob, unrelated to any runtime limit — bump it
+// so the giant future's layout resolves. See the big-stack thread in
+// `acp/connection.rs` for the sibling *runtime* mitigation of the same frame.
+#![recursion_limit = "256"]
+
 pub mod acp;
 pub use acp::{
     idle_sweep_task, idle_timeout_from_env, lifecycle_subscriber_task, SWEEP_INTERVAL_SECS,