feat: make Plan mode enforceable and recovery-safe

[Jay1]

What changed

• adds an app-owned Plan capability firewall across supported providers, with unknown and mutating capabilities denied before approvals or provider execution
• carries the exact reviewed plan revision through same-thread, new-thread, queued, edited, replayed, and restart-recovered implementation flows
• adds truthful provider capability reporting, legacy Codex read-only defense, and responsive Plan availability/denial UI
• adds managed OpenCode isolation profiles with verified archives, runtime/process attestation, credential-safe environments, project-config containment, and interruption-safe promotion/rollback
• isolates Kilo Plan sessions from project bootstrap side effects while preserving Default behavior
• hardens durable lifecycle ordering, terminal races, queue recovery, provider cursor lineage, and authoritative assistant-text reconciliation
• improves keyboard focus, semantic status styling, toast behavior, mobile header behavior, and compact Plan footer accessibility
• records the Plan authority architecture and the T3Code/DPCode upstream UX roadmaps

Why

Plan mode must be a JCode-owned safety boundary—not a provider hint. A Plan turn must not mutate the workspace, invoke unknown capabilities, silently reuse stale plan text, or leak an unanswered prompt into a later Default turn. The UI must also report support and denial reasons truthfully.

User impact

• supported Plan providers can inspect and propose safely
• implementation always references the exact latest reviewed plan
• queued edits and crash recovery preserve prompt, mode, model, and provider authority
• unsupported or unverifiable providers fail closed with a clear reason
• Plan controls remain accessible and distinct at 375, 768, and 1280 widths

Validation

• bun run test — 12/12 tasks; server 2,262 passed / 9 skipped; web 1,106 passed
• bun run typecheck — 9/9 tasks
• bun run build — 7/7 tasks
• bun run fmt:check — passed
• bun run lint — exit 0, existing warnings only
• isolation identity stress — 100/100 runs, 500/500 cases
• migration suite — 54/54
• Plan policy suite — 10/10
• exact-head manual provider QA and independent responsive/accessibility/CJK visual review completed locally

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 201 files, which is 101 over the limit of 100.

To get a review, narrow the scope:
• coderabbit review --committed # exclude uncommitted changes
• coderabbit review --dir # limit to a subdirectory
• coderabbit review --base # compare against a closer base

Upgrade to a paid plan to raise the limit.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b686b324-60f5-4777-90ae-2d9b33f191c8

📥 Commits

Reviewing files that changed from the base of the PR and between 7d8a300 and 4afb13b.

⛔ Files ignored due to path filters (1)

• bun.lock is excluded by !**/*.lock

📒 Files selected for processing (201)

• CONTEXT.md
• DESIGN.md
• T3CODE_IMPORT_ROADMAP.md
• UPSTREAM_UX_WAVE_2_ROADMAP.md
• apps/server/integration/OrchestrationEngineHarness.integration.ts
• apps/server/integration/orchestrationEngine.integration.test.ts
• apps/server/package.json
• apps/server/src/codexAppServerManager.test.ts
• apps/server/src/codexAppServerManager.ts
• apps/server/src/main.ts
• apps/server/src/orchestration/Errors.ts
• apps/server/src/orchestration/Layers/CheckpointReactor.test.ts
• apps/server/src/orchestration/Layers/CheckpointReactor.ts
• apps/server/src/orchestration/Layers/EventSequenceBarrier.ts
• apps/server/src/orchestration/Layers/ExpectedProviderStartAuthority.test.ts
• apps/server/src/orchestration/Layers/ExpectedProviderStartAuthority.ts
• apps/server/src/orchestration/Layers/KeyedLifecycleWorkScheduler.ts
• apps/server/src/orchestration/Layers/LifecycleWorkScheduler.test.ts
• apps/server/src/orchestration/Layers/LifecycleWorkScheduler.ts
• apps/server/src/orchestration/Layers/OrchestrationEngine.test.ts
• apps/server/src/orchestration/Layers/OrchestrationEngine.ts
• apps/server/src/orchestration/Layers/ProjectionPipeline.test.ts
• apps/server/src/orchestration/Layers/ProjectionPipeline.ts
• apps/server/src/orchestration/Layers/ProjectionSnapshotQuery.test.ts
• apps/server/src/orchestration/Layers/ProjectionSnapshotQuery.ts
• apps/server/src/orchestration/Layers/ProviderCommandReactor.test.ts
• apps/server/src/orchestration/Layers/ProviderCommandReactor.ts
• apps/server/src/orchestration/Layers/ProviderRuntimeIngestion.test.ts
• apps/server/src/orchestration/Layers/ProviderRuntimeIngestion.ts
• apps/server/src/orchestration/Layers/RuntimeIngestionFingerprint.test.ts
• apps/server/src/orchestration/Layers/RuntimeIngestionFingerprint.ts
• apps/server/src/orchestration/Services/ExpectedProviderStartAuthority.ts
• apps/server/src/orchestration/Services/RuntimeReceiptBus.ts
• apps/server/src/orchestration/decider.activeTurnInteractionMode.test.ts
• apps/server/src/orchestration/decider.cleanupEmptyCreated.test.ts
• apps/server/src/orchestration/decider.sourceProposedPlan.test.ts
• apps/server/src/orchestration/decider.ts
• apps/server/src/orchestration/editSourceProposedPlan.ts
• apps/server/src/orchestration/handoff.test.ts
• apps/server/src/orchestration/handoff.ts
• apps/server/src/orchestration/latestActionableSourcePlan.restart.test.ts
• apps/server/src/orchestration/latestTurnUpgradeReplay.test.ts
• apps/server/src/orchestration/projector.activeTurnInteractionMode.test.ts
• apps/server/src/orchestration/projector.latestTurnDiffAuthority.test.ts
• apps/server/src/orchestration/projector.test.ts
• apps/server/src/orchestration/projector.ts
• apps/server/src/orchestration/terminalLatestTurn.restart.test.ts
• apps/server/src/orchestration/terminalLatestTurnReset.test.ts
• apps/server/src/persistence/Layers/OrchestrationCommandReceipts.test.ts
• apps/server/src/persistence/Layers/OrchestrationCommandReceipts.ts
• apps/server/src/persistence/Layers/OrchestrationEventStore.test.ts
• apps/server/src/persistence/Layers/OrchestrationEventStore.ts
• apps/server/src/persistence/Layers/ProjectionCheckpoints.ts
• apps/server/src/persistence/Layers/ProjectionRepositories.test.ts
• apps/server/src/persistence/Layers/ProjectionThreads.ts
• apps/server/src/persistence/Layers/ProjectionTurnLifecycleAdmissionRestart.test.ts
• apps/server/src/persistence/Layers/ProjectionTurns.ts
• apps/server/src/persistence/Layers/Sqlite.ts
• apps/server/src/persistence/Migrations.test.ts
• apps/server/src/persistence/Migrations.ts
• apps/server/src/persistence/Migrations/032_ReconcileLegacyT3SchemaImport.test.ts
• apps/server/src/persistence/Migrations/042_ProjectionTurnsSourceProposedPlanRevision.test.ts
• apps/server/src/persistence/Migrations/042_ProjectionTurnsSourceProposedPlanRevision.ts
• apps/server/src/persistence/Migrations/043_ProjectionTurnsInteractionMode.test.ts
• apps/server/src/persistence/Migrations/043_ProjectionTurnsInteractionMode.ts
• apps/server/src/persistence/Migrations/044_ReplayProjectionThreadShellSummary.test.ts
• apps/server/src/persistence/Migrations/044_ReplayProjectionThreadShellSummary.ts
• apps/server/src/persistence/Migrations/045_ProjectionTurnsExpectedStartIdentity.test.ts
• apps/server/src/persistence/Migrations/045_ProjectionTurnsExpectedStartIdentity.ts
• apps/server/src/persistence/Migrations/046_ProjectionTurnRollbackGenerations.test.ts
• apps/server/src/persistence/Migrations/046_ProjectionTurnRollbackGenerations.ts
• apps/server/src/persistence/Migrations/047_ProjectionTurnStartAuthority.test.ts
• apps/server/src/persistence/Migrations/047_ProjectionTurnStartAuthority.ts
• apps/server/src/persistence/Migrations/048_ProjectionTurnEventAuthority.test.ts
• apps/server/src/persistence/Migrations/048_ProjectionTurnEventAuthority.ts
• apps/server/src/persistence/Migrations/049_ProjectionTurnLifecycleInbox.test.ts
• apps/server/src/persistence/Migrations/049_ProjectionTurnLifecycleInbox.ts
• apps/server/src/persistence/Migrations/050_ProjectionTurnLifecycleOutbox.test.ts
• apps/server/src/persistence/Migrations/050_ProjectionTurnLifecycleOutbox.ts
• apps/server/src/persistence/Migrations/051_ProjectionTurnLifecycleLedger.test.ts
• apps/server/src/persistence/Migrations/051_ProjectionTurnLifecycleLedger.ts
• apps/server/src/persistence/Migrations/052_LifecycleScopesAndCommandFingerprints.test.ts
• apps/server/src/persistence/Migrations/052_LifecycleScopesAndCommandFingerprints.ts
• apps/server/src/persistence/Migrations/Wave2CanonicalStageValidation.test.ts
• apps/server/src/persistence/Migrations/Wave2LineageReconciliation.test.ts
• apps/server/src/persistence/Services/OrchestrationCommandReceipts.ts
• apps/server/src/persistence/Services/ProjectionThreads.ts
• apps/server/src/persistence/Services/ProjectionTurns.ts
• apps/server/src/persistence/Wave2MigrationLineage.ts
• apps/server/src/persistence/Wave2MigrationLineageSchema.ts
• apps/server/src/persistence/modelSelectionCompatibility.test.ts
• apps/server/src/persistence/modelSelectionCompatibility.ts
• apps/server/src/provider/Layers/ClaudeAdapter.test.ts
• apps/server/src/provider/Layers/ClaudeAdapter.ts
• apps/server/src/provider/Layers/CursorAdapter.ts
• apps/server/src/provider/Layers/GeminiAdapter.ts
• apps/server/src/provider/Layers/OpenCodeAdapter.test.ts
• apps/server/src/provider/Layers/OpenCodeAdapter.ts
• apps/server/src/provider/Layers/PiAdapter.ts
• apps/server/src/provider/Layers/ProviderDiscoveryService.test.ts
• apps/server/src/provider/Layers/ProviderDiscoveryService.ts
• apps/server/src/provider/Layers/ProviderPlanModePolicy.test.ts
• apps/server/src/provider/Layers/ProviderService.test.ts
• apps/server/src/provider/Layers/ProviderService.ts
• apps/server/src/provider/Layers/ProviderSessionDirectory.test.ts
• apps/server/src/provider/Services/ProviderPlanModePolicy.ts
• apps/server/src/provider/managedPlanIsolation.test.ts
• apps/server/src/provider/managedPlanIsolation.ts
• apps/server/src/provider/managedPlanIsolationFixture.ts
• apps/server/src/provider/managedPlanIsolationIdentity.test.ts
• apps/server/src/provider/managedPlanIsolationIdentity.ts
• apps/server/src/provider/managedPlanIsolationLaunch.ts
• apps/server/src/provider/managedPlanIsolationRuntime.manual.test.ts
• apps/server/src/provider/managedPlanIsolationRuntime.test.ts
• apps/server/src/provider/managedPlanIsolationRuntime.ts
• apps/server/src/provider/managedPlanIsolationTerminal.ts
• apps/server/src/provider/managedProcessScopeOwnership.test.ts
• apps/server/src/provider/managedProcessScopeOwnership.ts
• apps/server/src/provider/managedRuntimeDownload.test.ts
• apps/server/src/provider/managedRuntimeDownload.ts
• apps/server/src/provider/managedRuntimeLifecycle.manual.test.ts
• apps/server/src/provider/managedRuntimeLifecycle.test.ts
• apps/server/src/provider/managedRuntimeLifecycle.ts
• apps/server/src/provider/managedRuntimeProfile.test.ts
• apps/server/src/provider/managedRuntimeProfile.ts
• apps/server/src/provider/opencodeRuntime.test.ts
• apps/server/src/provider/opencodeRuntime.ts
• apps/server/src/provider/planMode.test.ts
• apps/server/src/provider/planMode.ts
• apps/server/src/provider/runtimeLayer.ts
• apps/server/src/serverLayers.ts
• apps/server/src/serverSettings.ts
• apps/server/src/threadRetention.test.ts
• apps/server/src/threadRetention.ts
• apps/server/src/wsRpc.test.ts
• apps/server/src/wsRpc.ts
• apps/web/src/appSettings.ts
• apps/web/src/components/BranchToolbar.tsx
• apps/web/src/components/ChatView.browser.tsx
• apps/web/src/components/ChatView.tsx
• apps/web/src/components/ComposerPromptEditor.tsx
• apps/web/src/components/OpenCodePlanIsolationSettings.logic.ts
• apps/web/src/components/OpenCodePlanIsolationSettings.tsx
• apps/web/src/components/OpenCodeRuntimeSettingsPanel.browser.tsx
• apps/web/src/components/OpenCodeRuntimeSettingsPanel.tsx
• apps/web/src/components/chat/ChatHeader.tsx
• apps/web/src/components/chat/ComposerExtrasMenu.browser.tsx
• apps/web/src/components/chat/ComposerExtrasMenu.tsx
• apps/web/src/components/chat/ComposerPlanModeBlockedReason.tsx
• apps/web/src/components/chat/MessagesTimeline.test.tsx
• apps/web/src/components/chat/ThreadErrorBanner.tsx
• apps/web/src/components/providerUpdateNotifications.logic.test.ts
• apps/web/src/components/providerUpdateNotifications.logic.ts
• apps/web/src/components/ui/menu.tsx
• apps/web/src/components/ui/sidebar.tsx
• apps/web/src/components/ui/toast.logic.test.ts
• apps/web/src/components/ui/toast.logic.ts
• apps/web/src/components/ui/toast.tsx
• apps/web/src/composerDraftStore.test.ts
• apps/web/src/composerDraftStore.ts
• apps/web/src/composerPlanSlashPolicy.test.ts
• apps/web/src/composerPlanSlashPolicy.ts
• apps/web/src/hooks/useComposerSlashCommands.ts
• apps/web/src/index.css
• apps/web/src/lib/providerDiscoveryReactQuery.test.ts
• apps/web/src/lib/providerDiscoveryReactQuery.ts
• apps/web/src/openCodePlanProfile.test.ts
• apps/web/src/openCodePlanProfile.ts
• apps/web/src/planModeAvailability.test.ts
• apps/web/src/planModeAvailability.ts
• apps/web/src/planModeCorrection.test.ts
• apps/web/src/planModeCorrection.ts
• apps/web/src/proposedPlan.test.ts
• apps/web/src/proposedPlan.ts
• apps/web/src/routes/__root.tsx
• apps/web/src/session-logic.test.ts
• apps/web/src/session-logic.ts
• apps/web/src/theme/theme.logic.test.ts
• apps/web/src/theme/theme.logic.ts
• apps/web/src/vite-env.d.ts
• apps/web/src/wsNativeApi.ts
• apps/web/vitest.browser.config.ts
• docs/adr/0012-plan-mode-authorization-and-durable-turn-lifecycle-authority.md
• docs/adr/README.md
• packages/contracts/src/ipc.ts
• packages/contracts/src/managedRuntime.ts
• packages/contracts/src/managedRuntimeLifecycle.ts
• packages/contracts/src/managedRuntimeProfile.ts
• packages/contracts/src/orchestration.test.ts
• packages/contracts/src/orchestration.ts
• packages/contracts/src/provider.test.ts
• packages/contracts/src/provider.ts
• packages/contracts/src/providerDiscovery.test.ts
• packages/contracts/src/providerDiscovery.ts
• packages/contracts/src/providerRuntime.ts
• packages/contracts/src/rpc.test.ts
• packages/contracts/src/rpc.ts
• packages/contracts/src/ws.test.ts
• packages/contracts/src/ws.ts
• packages/shared/src/DrainableWorker.test.ts
• packages/shared/src/DrainableWorker.ts

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Review on demand using usage pricing

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}