fix(grok): add skills, plan mode, usage, and turn reliability

[rynfar]

Grok is Pylon's weakest provider today: no skill discovery, no reasoning control, no plan mode, no usage data, and turns that can sit on Working after the ACP connection stops responding. This adopts upstream #8358 (ead4ce52a) to fix all of that, and grafts back a Pylon decision the port would have silently reverted.

What the port brings

Grok skill discovery via grok inspect --json; an ACP-driven Reasoning control beside the model picker; plan mode that surfaces plan.md writes and _x.ai/exit_plan_mode as proposed-plan events while unblocking the native approval gate; a turn liveness watchdog that fails a turn after long silence instead of hanging on Working; xAI rate_limit completions mapped to usage limits; session-scoped auto-approval keyed by operation identity; and CLI argv that mirror Pylon's runtime permission modes. Web and mobile usage charts gain a Grok band.

Pylon adaptations

acceptAlways would have started rejecting approvals (second commit, kept separate so the port can be diffed against upstream). Pylon's ProviderApprovalDecision union carries acceptAlways on top of upstream's four literals, and every Pylon adapter treats it as at least session-wide — see acpPermissionOutcome. Upstream's rewrite of selectGrokPermissionOptionId only knows the upstream literals, so two of its new paths skipped it:

• The allow_once fallback for Grok builds that omit allow_always. Returning undefined reaches the permission handler as outcome "cancelled", so choosing Always allow would have rejected the call the user just approved.
• Registration in sessionApprovedOperations, so repeating the same operation would have prompted again.

Both now cover acceptAlways, with a focused test.

Four conflicts, resolved Pylon-first. GrokAdapter.ts (the acceptAlways mapping above, plus upstream's preferredKind rename), and branding in UsageService.ts, packages/contracts/src/usage.ts, and docs/user/install.md — each took upstream's substance (Grok transcript paths, the new Reasoning paragraph) in Pylon voice. docs/user/permission-modes.md auto-merged with Pylon's Prime Agent section intact. Seven further T3 references in comments and test names were rewritten; the t3-* ACP clientInfo identifiers were left alone, since those are Pylon's established compatibility names across Cursor, Grok, and text generation.

Blast radius

The shared ACP changes are not Grok-only. decideToolCallUpdateEmission now also emits on status change and measures content/rawOutput length rather than just detail, and tool output bounding was reworked — that layer is shared by Cursor, Grok, and Prime Agent. Expect somewhat more websocket traffic per in-progress tool call in exchange for live command output that previously stalled until the call completed. Cursor and Prime Agent suites are in the verification below for that reason.

Verification

• Grok, Grok skills, Grok ACP support/probe, xAI extension: 86 pass, 5 skipped (the skips are the opt-in real-CLI tests).
• The new acceptAlways test is confirmed executing, alongside upstream's keeps a Grok turn running when Always allow has no allow_always option and asks before a different command after Always allow this session.
• Shared ACP, Cursor probe, and usage suites: 104 pass, 3 skipped.
• Prime Agent daemon session/adapter plus Cursor adapter: 250 pass.
• Typechecks pass for t3, @t3tools/web, @t3tools/contracts, @t3tools/shared (4/4 tasks ran) and @t3tools/mobile (0 errors).
• Lint clean across all 31 changed TS files.

Not run: upstream's opt-in real-Grok CLI verification, which needs xAI credentials. The turn watchdog and rate-limit mapping are therefore covered by tests and the mock ACP agent, not by a live Grok session.

Model: Claude Opus 5. Harness: Claude Code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	+44 B (+0.3%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−10 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+54 B (+0.8%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.5 KiB	55.6 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	+18 B (+0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−5 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+23 B (+0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 2cdff74 · PR result: f8cd01e · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.