Sync upstream v1.1.2 and remove duplicate goal implementation

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      # Check for updates to GitHub Actions every week
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -14,11 +14,11 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
-          node-version: '24'
-      - uses: oven-sh/setup-bun@v2
+          node-version: "24"
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
         with:
           bun-version: 1.3.11
       - name: Install dependencies

.github/workflows/codex-update.yml

@@ -2,17 +2,17 @@ name: Codex Update
 
 on:
   schedule:
-    - cron: '0 5 * * *' 
+    - cron: "0 5 * * *"
   workflow_dispatch:
 
 permissions:
   contents: read
   packages: read
 
 env:
-  CODEX_PACKAGE: '@openai/codex'
-  CODEX_UPDATE_LABEL: 'codex-update'
-  GITHUB_BOT_USERNAME: 'github-actions[bot]'
+  CODEX_PACKAGE: "@openai/codex"
+  CODEX_UPDATE_LABEL: "codex-update"
+  GITHUB_BOT_USERNAME: "github-actions[bot]"
 
 jobs:
   check:
@@ -22,7 +22,7 @@ jobs:
       version: ${{ steps.check.outputs.version }}
       branch: ${{ steps.check.outputs.branch }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -58,13 +58,13 @@ jobs:
       VERSION: ${{ needs.check.outputs.version }}
     steps:
       - name: Generate GitHub token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: generate-token
         with:
           app-id: ${{ secrets.RELEASE_PLZ_APP_ID }}
           private-key: ${{ secrets.RELEASE_PLZ_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           token: ${{ steps.generate-token.outputs.token }}
 
@@ -83,20 +83,21 @@ jobs:
 
       - name: Finalize update with Codex
         id: codex-finalize
-        uses: openai/codex-action@v1
+        uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56
         with:
           openai-api-key: ${{ secrets.OPENAI_API_KEY }}
           codex-version: ${{ env.VERSION }}
           output-file: pr-body.md
           codex-args: >-
             -c sandbox_workspace_write.writable_roots=["${{ github.workspace }}/.git"]
           prompt: >
-            Finalize the update using codex-update-compat skill. 
-            Commit the changes, the message should mention that types or/and tests after the update were fixed. 
+            Finalize the update using codex-update-compat skill.
+            Commit only tracked file changes, and never create an empty commit.
+            If there are changes, the commit message should mention that types or/and tests after the update were fixed.
             When creating the final message do not mention:
             * Validation run details.
             * Commits.
-            * Hyperlinks. 
+            * Hyperlinks.
             Mention only previously failed tests with failure reasons, also what you changed and why.
 
       - name: Push branch updates
@@ -141,6 +142,6 @@ jobs:
             fi
 
             gh pr close "$pr_number" \
+              --delete-branch \
               --comment "Closing obsolete update PR"
           done
-

.github/workflows/publish.yml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '24'
@@ -40,7 +40,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-node@v6
         with:
           node-version: '24'
@@ -54,14 +54,14 @@ jobs:
     permissions: {}
     steps:
       - name: Generate GitHub token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: generate-token
         with:
           app-id: ${{ secrets.RELEASE_PLZ_APP_ID }}
           private-key: ${{ secrets.RELEASE_PLZ_APP_PRIVATE_KEY }}
 
       - name: Create Release
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           token: ${{ steps.generate-token.outputs.token }}
           generate_release_notes: true

.github/workflows/version-bump.yml

@@ -19,13 +19,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Generate GitHub token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: generate-token
         with:
           app-id: ${{ secrets.RELEASE_PLZ_APP_ID }}
           private-key: ${{ secrets.RELEASE_PLZ_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           token: ${{ steps.generate-token.outputs.token }}
 

README.md

@@ -40,17 +40,20 @@ CODEX_PATH=/path/to/codex npx -y acp-extension-codex
 
 The adapter advertises ACP auth methods during initialization. Clients can authenticate with:
 
-- ChatGPT login.
-- OpenAI API key.
+- ChatGPT login. Set `NO_BROWSER=1` to hide this method in remote or browserless environments.
+- API key via `CODEX_API_KEY` or `OPENAI_API_KEY`.
 - A custom OpenAI-compatible gateway, when the client opts in to the gateway auth capability.
 
 ## Runtime options
 
+- `CODEX_API_KEY` - API key used when the API-key auth method is selected. Takes precedence over `OPENAI_API_KEY`.
+- `OPENAI_API_KEY` - fallback API key used when the API-key auth method is selected.
 - `CODEX_PATH` - run a specific Codex executable instead of the bundled package dependency.
 - `CODEX_CONFIG` - JSON object merged into the Codex session config.
 - `MODEL_PROVIDER` - model provider to pass to Codex for new sessions.
 - `DEFAULT_AUTH_REQUEST` - ACP auth request JSON used when Codex requires authentication.
 - `INITIAL_AGENT_MODE` - initial mode id: `read-only`, `agent`, or `agent-full-access`.
+- `NO_BROWSER` - hide browser-based ChatGPT auth when set.
 - `APP_SERVER_LOGS` - directory for adapter logs.
 
 ## Development

docs/superpowers/plans/2026-07-10-upstream-goal-fast-cleanup.md

@@ -0,0 +1,11 @@
+# Upstream Goal/Fast Cleanup Implementation Plan
+
+1. Remove fork goal ACP extension constants, request types, parsers, route registration, and server/client forwarding wrappers.
+2. Preserve upstream goal setters, runtime-effect tracking, session metadata, cancellation, and `/goal` orchestration.
+3. Remove raw goal notifications and restore upstream goal event tests/snapshots.
+4. Restore upstream no-argument `/goal` behavior and remove fork-only goal formatting/tests.
+5. Delete the fork goal extension test suite and scan for remaining fork goal symbols.
+6. Verify Plan Mode/proposed-plan code is unchanged.
+7. Verify Fast Mode source and behavior match upstream and the ACP SDK dependency/lock resolution matches upstream.
+8. Run targeted tests, typecheck, the complete test suite, npm build/package checks, and all CI Bun bundles.
+9. Review the final diff and commit the implementation.

docs/superpowers/specs/2026-07-10-upstream-goal-fast-cleanup-design.md

@@ -0,0 +1,96 @@
+# Upstream Goal/Fast Cleanup Design
+
+## Objective
+
+Remove the fork-specific goal implementation added by commit `20f61f9` now that upstream implements goal behavior. Keep the fork-only Plan Mode because upstream does not implement it. Keep Fast Mode as an upstream-owned feature and align the ACP SDK dependency with upstream.
+
+## Historical Boundary
+
+The fork-specific goal layer was introduced by `20f61f9` after the shared base `37a98b3`. It added ACP extension routes for `thread/goal/get`, `thread/goal/set`, and `thread/goal/clear`; raw goal notifications; a custom no-argument `/goal` view; and corresponding tests.
+
+Fast Mode was introduced before the fork diverged by upstream commit `64d3bc2`. The fork has no independent Fast Mode implementation to remove. Later upstream commits `fbc8f84` and `ef5e169` own model-capability filtering and boolean config support.
+
+Upstream does not contain `PlanModeConfig.ts` or the fork's collaboration-mode plumbing, so Plan Mode remains fork-owned.
+
+## Selected Approach
+
+Use a symbol-level cleanup based on the historical diff rather than replacing entire files with upstream versions. This removes only the duplicated goal layer while preserving unrelated fork extensions and Plan Mode.
+
+Whole-file replacement was rejected because files such as `AcpExtensions.ts`, `CodexAcpServer.ts`, and `CodexEventHandler.ts` also contain retained fork behavior for usage, rate limits, proposed plans, packaging identity, and Plan Mode.
+
+Reverting all of `20f61f9` was rejected because it would remove retained features and create a substantially larger reconstruction diff.
+
+## Runtime Changes
+
+### Remove fork goal extensions
+
+- Remove the `THREAD_GOAL_GET_METHOD`, `THREAD_GOAL_SET_METHOD`, and `THREAD_GOAL_CLEAR_METHOD` ACP extension constants and request types.
+- Remove their Zod request parsers and server route registration from `src/index.ts`.
+- Restore extension-method dispatch to the upstream-supported authentication and legacy model methods.
+- Remove fork-only goal parameter parsing and wrapper methods from `CodexAcpServer` and `CodexAcpClient`.
+- Remove only `threadGoalGet` from `CodexAppServerClient`. Retain upstream's `threadGoalSet`, `threadGoalClear`, `runGoalSet`, and `runGoalClear` implementation.
+
+### Use upstream goal behavior exclusively
+
+- Restore the upstream `/goal` command behavior, including the no-argument usage message.
+- Remove the fork-only goal summary formatting and direct goal lookup.
+- Stop forwarding `thread/goal/updated` and `thread/goal/cleared` as raw ACP notifications.
+- Retain upstream `session_info_update` goal metadata, duplicate suppression, continuation-turn routing, grace periods, and cancellation behavior.
+
+### Retain Plan Mode
+
+- Keep `src/PlanModeConfig.ts` and its tests.
+- Keep `planModeEnabled` and `planModeExplicitlySet` session state.
+- Keep the `collaborationMode` turn parameter and plan/default mode switching.
+- Keep `_acp_ext:codex_proposed_plan` streaming/completion notifications.
+- Keep `experimentalApi: true` and `requestAttestation: false` as the existing fork capability configuration required by the retained Plan Mode integration.
+
+### Retain unrelated fork extensions
+
+- Keep `_acp_ext:session_usage_update`.
+- Keep `_acp_ext:session_rate_limits`.
+- Keep authentication extensions, the legacy session-model extension, fork package identity, and fork binary names.
+
+## Fast Mode and SDK Alignment
+
+Fast Mode remains enabled and should behave exactly like upstream:
+
+- expose Fast Mode only for models with a fast speed tier;
+- use boolean config options when the ACP client advertises support;
+- otherwise use the upstream select option;
+- retain the selected preference across model switches but apply the service tier only to supported models.
+
+`src/FastModeConfig.ts` must have no fork-only behavioral diff from `upstream/main`. Adjacent `CodexAcpServer` changes may differ only where Plan Mode is inserted.
+
+The dependency range for `@agentclientprotocol/sdk` must match `upstream/main` exactly (`^1.2.1` at design time). The resolved SDK package and transitive dependency graph in `package-lock.json` must follow upstream; only fork root metadata such as package name, version, and binary name may differ.
+
+## Tests and Fixtures
+
+- Delete `thread-goal-ext-methods.test.ts`.
+- Restore upstream `thread-goal-events.test.ts` expectations and its three goal metadata snapshots.
+- Remove the fork-only no-argument goal-view test and restore the upstream missing-input test.
+- Keep upstream goal runtime, routing, cancellation, deduplication, and metadata coverage.
+- Keep Plan Mode and proposed-plan tests unchanged except for mechanical fixture updates if required.
+- Keep upstream Fast Mode tests unchanged.
+
+## Error Handling and Compatibility
+
+Requests to the removed fork-only goal extension routes will no longer be registered. Goal operations remain available through upstream's `/goal` command and app-server flow.
+
+No compatibility shim or deprecation response will be added because the requested outcome is complete removal of the local implementation.
+
+## Verification
+
+1. Confirm no fork goal constants, parsers, wrappers, raw notifications, or tests remain.
+2. Compare Fast Mode source and behavior with `upstream/main`.
+3. Compare the SDK dependency range and resolved package with `upstream/main`.
+4. Run targeted goal, Plan Mode, proposed-plan, Fast Mode, and initialization tests.
+5. Run `npm run typecheck` and `npm test`.
+6. Run `npm run build`, `npm pack --dry-run`, and `npm run bundle:all` with the CI Bun version.
+
+## Success Criteria
+
+- Goal behavior is provided only by upstream code paths.
+- Fast Mode and the ACP SDK follow upstream.
+- Plan Mode and unrelated fork extensions remain functional.
+- The repository passes the full verification workflow with a clean working tree after commit.