feat(native): run Claude Code, Codex, and OpenCode in xterm terminals

[tlgimenes]

Summary

Replace Studio Native's structured AI SDK chat path with real interactive Claude Code, Codex, and OpenCode processes running in PTYs rendered by xterm.js. Hosted web remains on the existing structured Decopilot chat flow.

What changed

• Add a Rust terminal-session owner with bounded replay, input/resize, reconnect, interruption/termination, generation fences, and process-tree cleanup.
• Add authenticated native REST/WebSocket terminal routes scoped by account, organization, thread, and generation.
• Launch all three agents with Studio instructions, the selected cms MCP, lifecycle hooks, exact provider-session checkpoints, and restart-safe resume/recovery.
• Add OpenCode 1.18.10+ readiness detection, exact --session resume, provider-owned model selection, and provider-owned titles.
• Start Codex in YOLO mode, suppress its Desktop promotion, and pre-trust only Studio-managed hooks/workspaces; Claude and Codex no longer show folder-trust prompts.
• Replace the native composer/message UI with a keyboard-accessible agent picker, loading state, and one matching xterm surface after launch—no Studio terminal toolbar.
• Remove the executable native Decopilot queue/run path. Stale native chat endpoints fail closed, and sessions are reaped on stop, chat deletion/archive, account changes, logout, and app shutdown.

Hosted/native boundary

• Hosted web keeps structured Decopilot + AI SDK chat; Claude Code, Codex, and OpenCode are native terminal identities only.
• Hosted selectors, model catalogs, adapters, and legacy desktop-link chat mechanics no longer expose CLI agents. Historical Claude/Codex provider-key rows remain listable/deletable for compatibility, but new keys cannot be created or selected for hosted execution.
• Native terminal protocol code is selected only by the Tauri runtime and remains excluded from the hosted production bundle.
• The cloud sandbox /_sandbox/dispatch contract remains intact; the native PTY backend does not implement that retired native route.

Validation

• bun run test — 5,689 passed across 617 files.
• Native black-box contract — 109 passed, covering all three agents, lifecycle, exact resume, missing-session fallback, restart recovery, and account fencing.
• Native/cloud daemon parity — 156 tests; all 27 documented differences match the pinned set.
• Hosted runtime-boundary E2E — 7 passed.
• cargo test --workspace, cargo clippy --workspace --all-targets -- -D warnings, bun run check, bun run lint, bun run knip, bun run fmt:check, and cargo fmt --all -- --check.
• Hosted and native production builds; the hosted bundle guard found no desktop runtime.
• Tauri DevTools acceptance covered the three-agent picker, keyboard navigation, loading/xterm styling, real Claude startup/resume, Codex YOLO startup, and credential/console scans.

Review history

This PR now contains the former #5562 diff. All 23 review threads on that PR were answered and resolved before consolidation; the closed PR is retained for traceability.

Migration notes

Native SQLite advances from schema 10 to 12:

• 10 → 11: creates terminal-session history, archives the retired executable queue, preserves the newest valid provider checkpoint, and marks chats with abandoned queued prompts as requiring attention. Archived prompts are never executed.
• 11 → 12: adds rejected_provider_session_id, clears legacy null-checkpoint barriers, and preserves confirmed provider checkpoints.

Upgrades from schema 10 run both migrations. There is no hosted Postgres migration or hosted chat-contract expansion.

OpenCode local database caveat

OpenCode 1.18.10 works with a fresh isolated state, but an existing local database previously migrated from pre-1.18 OpenCode may contain an incomplete upstream migration. Studio does not modify that user-owned database: its bounded readiness probe marks OpenCode as Try anyway and fails closed instead of opening a broken blank terminal.

Architecture details and the validation record are in apps/native/docs/terminal-agents-plan.md.

[cubic-dev-ai]

This PR is large and would use a significant portion of your monthly review quota. Comment @cubic-dev-ai review this to confirm that you want cubic to review it.

[tlgimenes]

@cubic-dev-ai review this

[cubic-dev-ai]

@cubic-dev-ai review this

@tlgimenes I can't start this review because your workspace has reached its free monthly review limit. cubic has reviewed 42,059 of the 40,000 allowed lines of code this month. Reviews resume on 1 September 2026 (in 29 days). Paid plans include much higher monthly review limits. Upgrade now to resume reviews.

To help optimise your usage, you can tune cubic to get the most out of your usage limits:

• Stop reviewing test files
• Turn off incremental reviews
• Use the cubic CLI locally
• Skip non-default base branches

Learn more →