feat: Aether cloud provider — run T3 Code agents in isolated microVMs

[pranav100000]

What this adds

A first-class Aether provider for T3 Code: run any T3 Code agent (Claude Code, Codex, …) in an isolated cloud microVM instead of locally — one click, no VPS, no Tailscale, and no long cold start. T3 Code stays the client; the agent, workspace, and a live preview all run in the VM.

Highlights:

• Provider driver wired into the existing provider registry (settings, model catalog).
• REST task client + WS transport + full event mapper so cloud turns stream into the normal T3 Code timeline.
• Turn lifecycle + mirror-sync engine + write guards — durable-authoritative settlement so checkpoint diffs render correctly.
• Question/plan responses, revert ledger, model switch.
• Cloud port previews surfaced in the composer (public HTTPS, per-workspace token — no Tailscale).
• Cloud terminal — attach a real shell in the workspace VM, with reconnect on transient drops.

Shape

Built as a clean, reviewable commit chain:

1. provider driver skeleton — settings, registration, vendored catalog
2. REST task client + adapter session core
3. workspace attach, WS transport, full event mapper
4. turn lifecycle, mirror sync engine, write guards
5. question/plan responses, revert ledger, model switch
6. durable-authoritative turn settlement (checkpoint diffs)
7. cloud port previews in the composer
8. cloud terminal — attach a shell in the workspace VM (+ reconnect)

~86 files, largely isolated under apps/server/src/provider/Layers/aether/* plus a thin provider registration; packages/contracts additions are additive.

Opening as a draft to start the conversation — happy to split it or adjust to fit however you'd want this to land.

Note

Add Aether cloud provider to run T3 Code agents in isolated microVMs

• Introduces a new aether provider driver (AetherDriver.ts) that connects to the Aether cloud API, spawning agent tasks over REST and receiving real-time events via WebSocket.
• Adds an AetherAdapter (AetherAdapter.ts) implementing the full ProviderAdapterShape: session lifecycle, turn send/interrupt/resume, and git mirror sync that hard-resets local checkouts to match the remote VM state at turn settle.
• Adds AetherMirrorRegistry and mirror guards (AetherMirrorGuards.ts) that block local VCS and filesystem mutations while a cloud session owns the working directory, surfacing refusals as structured GitCommandError / ProjectWriteFileError.
• Adds AetherTerminalManager (AetherTerminalManager.ts) to route terminal RPCs (open, write, resize, close) to cloud VM PTY sessions; the WS layer routes per-thread to either the local or cloud manager.
• Introduces a thread.worktree.attach-managed orchestration command with concurrency guards, replaces the prior thread.meta.update dispatch for bootstrap worktrees, and tears down orphaned bootstrap worktrees when the attach does not apply.
• Adds port.opened runtime events that surface live port previews in the web and mobile timelines, including an embedded or external preview opener.
• Adds deterministic AetherTextGeneration for branch names, commit messages, PR content, and thread titles without external model calls.
• Risk: local VCS mutations (pull, stacked actions, worktree create/remove) will hard-fail with a structured error when an Aether session is active for that directory; this is a new behavioral constraint on the WS RPC layer.

^{Macroscope summarized 82149c7.}

---

Note

High Risk
Touches orchestration, persistence (new worktree_managed column), and VCS/file write paths with new refusal guards that can block mutations while an Aether session owns a checkout. Incorrect worktreeManaged handling could skip clean-tree preflight on user worktrees and discard uncommitted work.

Overview
Adds a first-class Aether provider so agents can run in isolated cloud microVMs, with local checkouts treated as one-way mirrors of the VM.

Server: new AetherDriver/adapter stack (REST + WS), mirror sync, and AetherMirrorRegistry/AetherMirrorGuards that refuse local VCS/file writes while a session owns the cwd. Introduces server-only thread.worktree.attach-managed plus a persisted worktreeManaged marker so only bootstrap-created worktrees skip clean-tree preflight. Cloud terminals close on thread deletion; port.opened activities surface live preview URLs.

Clients: Aether icon and model selection; new drafts with an Aether model default to worktree mode via a modeUserSet flag so incidental draft writes do not pin the wrong mode. Mobile work log makes port previews tappable.

Also gates upstream-only deploy/nightly jobs on pingdotgg/t3code and switches CI runners to stock GitHub images with longer timeouts.

^{Reviewed by Cursor Bugbot for commit 82149c7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5366a41b-f7da-48a8-a4de-abdd0d01d15b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Reviewed the new Aether provider service code against the Effect service conventions. Six concrete issues, all in files added by this PR: a standalone service-shape interface, service instances injected into a production factory, Effect.catchTag instead of Effect.catchTags, and three error-modeling sites that stringify a cause into detail/message or drop the underlying error entirely. Everything else (namespace subpath imports, make/layer exports, no ManagedRuntime/runPromise in domain code) looks consistent with the conventions.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Effect service conventions review of the Aether provider changes at this head.

The findings from the previous run (standalone AetherTerminalManagerShape, service instances passed into makeAetherAdapter, catchTag, and the errors that lost their cause) are unchanged at this commit and are not re-posted — later commits on this branch address them.

One new item below, in packages/contracts/src/project.ts.

^{Posted via Macroscope — Effect Service Conventions}

[macroscopeapp]

Follow-up review of the convention fixes since the last run (4427f33, 8155f4c, 3ae2e17). Three items remain in the changed scope: two wrapper detail fields still derive their message from the stringified/underlying error, and the mirror-refusal refactor dropped the legacy decoded-message passthrough for the project file errors.

^{Posted via Macroscope — Effect Service Conventions}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:9bfa5c9ae1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Queue mobile tasks with the effective workspace mode

When a branch selection stores modeUserSet: false and the user subsequently changes providers—for example, selecting a branch under a local provider and then switching to Aether—the displayed workspaceMode changes to worktree, but buildPendingTaskMessage still prefers the stale workspaceSelection.mode. Fresh evidence is this newly added path that deliberately persists a provisional mode while the queue serializer ignores the marker. The task is consequently queued in local mode, bypassing the Aether isolation default and allowing its one-way mirror to claim the shared checkout; use the effective mode whenever modeUserSet is false.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Persist modeUserSet in the mobile draft schema

After the mobile app restarts, ComposerDraftWorkspaceSelectionSchema decodes persisted drafts without the newly added modeUserSet field, so Effect's struct decoder drops it and the flow interprets the resulting absence as true. Fresh evidence is that this flag now controls the Aether worktree safety default but was added only to the TypeScript interface, not the persistence schema. An incidental stored local mode can therefore become permanently user-pinned after hydration and prevent Aether from selecting an isolated worktree; add the optional field to the schema.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Retract preview activities when cloud ports close

When the workspace sends a port-close notification, this branch only removes the in-memory dedupe key; the persisted port.opened activity and its active-looking CTA remain visible on web and mobile, and reopening the same port appends another CTA while the stale one remains. Emit and project a close/removal state (and reconcile snapshots) so users do not keep opening dead preview URLs.

AGENTS.md reference: AGENTS.md:L73-L73

Useful? React with 👍 / 👎.

[macroscopeapp]

🟠 Highthreads/new-task-flow-provider.tsx:428

When the server config is unavailable, selectedProviderIsAether returns false even if the stored model selection targets an Aether driver, so defaultWorkspaceMode resolves to local instead of worktree. This lets a task be queued against the shared checkout before the config arrives, and when the Aether driver later settles its one-way mirror it discards the user's local work. The fallback option synthesized by buildModelOptions sets providerDriver to the provider instance ID rather than the actual driver kind, so the AETHER_DRIVER_KIND comparison fails. Consider tracking the driver kind alongside the stored selection or preventing queuing until the driver can be reliably classified.

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/mobile/src/features/threads/new-task-flow-provider.tsx around line 428:
When the server config is unavailable, `selectedProviderIsAether` returns `false` even if the stored model selection targets an Aether driver, so `defaultWorkspaceMode` resolves to `local` instead of `worktree`. This lets a task be queued against the shared checkout before the config arrives, and when the Aether driver later settles its one-way mirror it discards the user's local work. The fallback option synthesized by `buildModelOptions` sets `providerDriver` to the provider instance ID rather than the actual driver kind, so the `AETHER_DRIVER_KIND` comparison fails. Consider tracking the driver kind alongside the stored selection or preventing queuing until the driver can be reliably classified.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:5747a1e10c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Hold the claim lock while running stacked actions

In a multi-client race where one client starts git.runStackedAction while another starts the first Aether turn for the same checkout, this ownsCwd read completes before the callback executes and does not use whileClaimsFrozen; the adapter can therefore register the mirror between this check and a commit/reset performed by the stacked action. The action then mutates an owned one-way mirror, causing the next settlement to detect divergence and pause synchronization, so the claim must remain frozen for the lifetime of the stream action rather than only being checked up front.

AGENTS.md reference: AGENTS.md:L74-L74

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Guard pull-request checkout mutations

When an Aether thread owns the project's current checkout and another client opens a draft for that project and chooses Local in the pull-request dialog, the gitPreparePullRequestThread handler bypasses this new mutation guard; GitManager.preparePullRequestThread then calls checkoutChangeRequest with force: true on the same cwd. That replaces the branch beneath the active mirror and makes its next settle pause on divergence, so this handler must also run under the cwd mutation guard.

AGENTS.md reference: AGENTS.md:L74-L74

Useful? React with 👍 / 👎.

[macroscopeapp]

Effect service conventions review. The previously flagged items are resolved at this head: the cloud-terminal errors and the REST-client wrappers now carry a stable structural detail plus the real cause, AetherTerminalManagerShape is inlined into the Context.Service declaration and referenced as AetherTerminalManager["Service"], the adapter's git/mirror dependencies are Effect requirements, catchTags replaced catchTag, and the mirror read-only refusal is modelled as a ProjectFileFailure literal with the legacy decode fallback restored.

One remaining item in the new driver module, noted inline.

^{Posted via Macroscope — Effect Service Conventions}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:a0ef50966f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Serialize first-turn task creation per thread

When two clients submit turns to a fresh Aether thread before the first createTask returns, both calls observe context.taskId === undefined and create separate paid cloud tasks; whichever response lands last overwrites context.taskId, orphaning the other task. Fresh evidence beyond the lost-response retry already reported is that ProviderCommandReactor.ts:1191-1193 forks each sendTurn, allowing the worker to dispatch the next request concurrently, while this adapter has no per-thread creation lock.

AGENTS.md reference: AGENTS.md:L74-L74

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Reject Aether checkpoint reverts before restoring files

When a user reverts a settled Aether thread, CheckpointReactor.ts:758-780 restores the local checkpoint before calling this method, which then always fails. The remote conversation and VM tree therefore remain at the newer turn while the checkout has already been rewritten; the next mirror settlement detects that as local divergence and pauses synchronization. Either prevent this provider from entering the generic revert flow before filesystem restoration or implement the remote rollback atomically with it.

AGENTS.md reference: AGENTS.md:L73-L73

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Revalidate the checkout while acquiring mirror ownership

If another client performs a guarded file/VCS mutation while startSession is resolving the Aether project or rebuilding a resume timeline, the mutation is allowed because this checkout is not registered until here. Registration merely waits for an in-flight guarded mutation to finish; it does not rerun the status/fingerprint checks captured at lines 1652-1704, so the session claims a checkout whose baseline is already stale and its first settlement pauses on divergence. Fresh evidence beyond the earlier mutation-lock report is the long preflight-to-registration gap: ownership acquisition and final validation still are not one atomic operation.

AGENTS.md reference: AGENTS.md:L74-L74

Useful? React with 👍 / 👎.

[macroscopeapp]

🟠 Highprovider/AetherMirrorRegistry.ts:159

lockFor inserts every canonical path it receives into the pathLocks map and never removes any entry. Every call to whileClaimsFrozen (and thus every guarded write) creates permanent Semaphore objects for the written path and all of its ancestors, so a server that processes many distinct file paths accumulates locks in pathLocks indefinitely — an unbounded memory leak that persists for the lifetime of the process. Consider evicting entries from pathLocks when the last permit is released, or use a weak/ephemeral lock store so unused semaphores can be garbage-collected.

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/server/src/provider/AetherMirrorRegistry.ts around line 159:
`lockFor` inserts every canonical path it receives into the `pathLocks` map and never removes any entry. Every call to `whileClaimsFrozen` (and thus every guarded write) creates permanent `Semaphore` objects for the written path and all of its ancestors, so a server that processes many distinct file paths accumulates locks in `pathLocks` indefinitely — an unbounded memory leak that persists for the lifetime of the process. Consider evicting entries from `pathLocks` when the last permit is released, or use a weak/ephemeral lock store so unused semaphores can be garbage-collected.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:713f2cd647

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Resolve removal targets before freezing claims

When vcs.removeWorktree receives a relative path, this freezes input.path relative to the server process directory, while ownsTargetPath resolves it relative to input.cwd; GitVcsDriverCore.removeWorktree then forwards that same <worktree> operand to git worktree remove under input.cwd (matching the git worktree remove [-f] <worktree> help). The actual target's claim lock is therefore not held, so another client can register that checkout after ownsTarget returns false and before Git deletes it. Freeze the cwd-relative resolved target, including any basename-matched claimed path.

AGENTS.md reference: AGENTS.md:L74-L74

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Serialize cloud-terminal restarts by session key

When two clients restart the same cloud terminal concurrently, both enter this unsynchronized existing-session path and call teardownConnection/establishConnection; each establish creates a standalone scope and assigns session.scope and session.connection, so the later assignment can orphan the first live socket or let one drain close the other restart's scope. Route restart (and competing open/close operations) through the same per-session lock used by open so only one connection lifecycle can replace the session at a time.

AGENTS.md reference: AGENTS.md:L74-L74

Useful? React with 👍 / 👎.

[macroscopeapp]

🟠 Highprovider/AetherMirrorRegistry.ts:170

register canonicalizes cwd twice: once in withClaimsExclusive to acquire the path lock and again inside the generator to key the claim map. If a symlink in cwd is retargeted between those two async realpath calls, the registration holds the lock for the old canonical path but publishes the claim under the new canonical path. A concurrent whileClaimsFrozen guard on the new path acquires a different lock, does not conflict with this one, and can pass its ownership check while the claim is still being installed — defeating the check-then-mutate freeze.

deregister recomputes the canonical key from current filesystem state rather than reusing the key that register stored. If a session was registered through a symlink that is later removed or retargeted, canonicalize(cwd) returns a different path, so claims.get(normalized) misses the original entry. The checkout stays falsely claimed and all guarded writes and VCS operations against it are refused until the server restarts.

Both defects stem from canonicalizing the same cwd multiple times. Consider canonicalizing once per call and threading the result (or the original key string) through register/deregister so the lock and the claim map always agree.

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/server/src/provider/AetherMirrorRegistry.ts around line 170:
`register` canonicalizes `cwd` twice: once in `withClaimsExclusive` to acquire the path lock and again inside the generator to key the claim map. If a symlink in `cwd` is retargeted between those two async `realpath` calls, the registration holds the lock for the old canonical path but publishes the claim under the new canonical path. A concurrent `whileClaimsFrozen` guard on the new path acquires a different lock, does not conflict with this one, and can pass its ownership check while the claim is still being installed — defeating the check-then-mutate freeze.
`deregister` recomputes the canonical key from current filesystem state rather than reusing the key that `register` stored. If a session was registered through a symlink that is later removed or retargeted, `canonicalize(cwd)` returns a different path, so `claims.get(normalized)` misses the original entry. The checkout stays falsely claimed and all guarded writes and VCS operations against it are refused until the server restarts.
Both defects stem from canonicalizing the same `cwd` multiple times. Consider canonicalizing once per call and threading the result (or the original key string) through `register`/`deregister` so the lock and the claim map always agree.

[macroscopeapp]

🟠 Highprovider/AetherMirrorRegistry.ts:42

whileClaimsFrozen calls canonicalize on each write path, and canonicalize's realpathIfExists rethrows any errno other than ENOENT/ENOTDIR. A path with a symlink loop (ELOOP) or a permission error (EACCES) therefore rejects the Promise inside Effect.promise. Per Effect's contract for promise, an unexpected rejection is a defect, so the RPC dies with an untyped defect instead of letting the underlying filesystem/VCS operation surface its normal typed error. Consider catching additional transient/path-related errnos (e.g. ELOOP, EACCES) in realpathIfExists and treating them as a failure to canonicalize rather than rethrowing.

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/server/src/provider/AetherMirrorRegistry.ts around line 42:
`whileClaimsFrozen` calls `canonicalize` on each write path, and `canonicalize`'s `realpathIfExists` rethrows any `errno` other than `ENOENT`/`ENOTDIR`. A path with a symlink loop (`ELOOP`) or a permission error (`EACCES`) therefore rejects the `Promise` inside `Effect.promise`. Per Effect's contract for `promise`, an unexpected rejection is a defect, so the RPC dies with an untyped defect instead of letting the underlying filesystem/VCS operation surface its normal typed error. Consider catching additional transient/path-related errnos (e.g. `ELOOP`, `EACCES`) in `realpathIfExists` and treating them as a failure to canonicalize rather than rethrowing.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:64ff102ade

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Serialize follow-ups across the model-switch await

When one client submits a model-changing follow-up while another client sends to the same idle thread, both reactor fibers can pass this pendingSend check before the model-changing call resumes from getTask/updateTask. They then dispatch different payloads with the same ordinal and client_message_id; Aether deduplicates one away, while both callers may advance sentCount and record the same returned turn inconsistently. Serialize sendTurn per thread or atomically recheck and claim the ordinal immediately before every /respond.

AGENTS.md reference: AGENTS.md:L74-L74

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve executable bits for added files

When the cloud agent adds an executable script or binary, this unconditionally reconstructs it as mode 100644. The settled local mirror and checkpoint therefore differ from the VM tree, and invoking the mirrored file directly fails with permission denied; the existing modeOnlySkipped warning does not cover added files. Carry the file mode through the workspace diff, or at least pause/warn instead of silently synthesizing a non-executable mode.

Useful? React with 👍 / 👎.

[cursor]

Sentinel held during path wait

Medium Severity

withClaimsExclusive takes a claimSentinel reader permit before waiting on the path exclusive lock. A register blocked behind a slow path-scoped mutation (push/pull) therefore keeps a sentinel permit, so whileAllClaimsFrozen cannot gather all permits and every vcs.removeWorktree stalls until that unrelated I/O finishes. The adjacent comment claims a path-blocked registration does not hold what the location-independent guard needs, but the acquisition order does exactly that.

Additional Locations (1)

• apps/server/src/provider/AetherMirrorGuards.ts#L80-L96

^{Reviewed by Cursor Bugbot for commit 64ff102. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 511c5d9. Configure here.}

[cursor]

Create failure loses root cause

Medium Severity

ProviderDriverError.detail is now a fixed phrase while the real failure sits only on cause. The instance registry logs and builds the unavailable shadow from failure.detail alone and never reads cause, so Aether create failures surface as a generic reason with no actionable root cause. Sibling drivers still embed cause.message in detail.

^{Reviewed by Cursor Bugbot for commit 511c5d9. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:511c5d9324

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Resolve absolute WebSocket paths against the API origin

When a custom API base URL contains a path, this concatenates that path with a websocket_path that the function itself treats as absolute. For example, https://host/aether plus /workspaces/ws-1/ws becomes wss://host/aether/workspaces/ws-1/ws rather than wss://host/workspaces/ws-1/ws; a server returning an already-prefixed path similarly gets the prefix duplicated. The REST probe can therefore succeed through a path-based reverse proxy while agent streaming and cloud terminals continually fail to connect, so resolve websocket_path against the API URL's origin instead of concatenating it with the full base.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Convert WebSocket constructor throws into typed open failures

If the runtime WebSocket constructor or an injected factory throws synchronously—for example because a custom endpoint produces a URL the constructor rejects—this call becomes an Effect defect rather than AetherSocketOpenError. The agent reconnect handler therefore cannot retry it, and, more seriously, the cloud-terminal lifecycle only catches typed failures before awaiting its ready deferred, so the terminal-open RPC can remain pending indefinitely. Wrap factory construction in Effect.try and map the exception to the existing typed open error.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:872dc5f1ee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Serialize durable reconciliation per session

When the settle poll and a socket callback invoke context.reconcile concurrently, both requests can start from the same cursor and complete out of order. Although old rows are skipped by sequence, reconcileDelta still applies the older response's task status; for example, a delayed awaiting_input response arriving after a newer processing response can settle the newly active turn and run mirror/checkpoint settlement while that turn is still executing. Protect the complete fetch-and-apply exchange with a per-session single-flight lock.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Make mirror ownership exclusive per checkout

When two Aether threads select the same Current checkout, this adds both keys to one claim instead of rejecting the second session. The registry blocks local RPC mutations but does not serialize the two mirror engines, so each task can independently reset --hard and apply its own cloud diff to the same tree; one session can overwrite the other's result or permanently pause it as divergent. Permit repeat registration only for the same owner and reject a distinct owner for an already-claimed checkout.

AGENTS.md reference: AGENTS.md:L74-L74

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Derive the cloud base from the validated upstream

When a local branch tracks a differently named branch or a remote other than origin, the preflight still passes because it checks only that some upstream exists and is in sync, but this sends the local branch name to the Aether project matched from remote.origin.url. That ref need not exist in the linked repository, so the first task fails to start with a missing remote ref despite passing preflight; validate an origin/<branch> upstream or derive a base branch that is known to exist in the matched origin.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:82149c740e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the last good mirror tree when synchronization fails

When rebuilding or applying the cumulative diff fails after this reset—for example, git apply rejects a hunk or a binary transfer/write fails—the previous successfully mirrored tree has already been discarded, but the PauseSync path performs no rollback and makes the pause sticky. The adapter subsequently emits turn.completed, allowing CheckpointReactor to capture this base-only or partially applied checkout as the turn result; users therefore lose the last good mirrored state locally and receive a corrupt checkpoint. Stage the replacement transactionally or restore the pre-sync tree before returning a paused/skipped outcome.

AGENTS.md reference: AGENTS.md:L122-L124

Useful? React with 👍 / 👎.

[t3dotgg]

Note

🤖 GPT-5.6 Sol responding on behalf of Theo

Closing this PR after an automated pass over open pull requests. Adds a separate Aether cloud and microVM hosting platform across 94 files.