Merge remote-tracking branch 'origin/main' into factory/onboarding-app-shell

# Conflicts:
#	factory/CLAUDE.md
#	factory/packages/backend/package.json
#	factory/packages/client/package.json
#	pnpm-lock.yaml
#	research/acp/friction.md

factory/CLAUDE.md

@@ -109,7 +109,11 @@ For all Rivet/RivetKit implementation:
    - Do not add `workspaceId`/`repoId`/`handoffId` columns just to "namespace" rows for a given actor instance; use actor state and/or the actor key instead.
    - Example: the `handoff` actor instance already represents `(workspaceId, repoId, handoffId)`, so its SQLite tables should not need those columns for primary keys.
 3. Do not use backend-global SQLite singletons; database access must go through actor `db` providers (`c.db`).
-4. Use published RivetKit npm packages (`"rivetkit": "^2.1.6"` or later). Do not use `link:` dependencies pointing outside the workspace.
+4. Use published RivetKit npm packages (`"rivetkit": "2.1.6"` by default). Do not use `link:` dependencies pointing outside the workspace unless you are doing a temporary local RivetKit debugging pass.
+5. Temporary local relink is allowed only when actively debugging RivetKit against the local checkout at `/Users/nathan/conductor/workspaces/handoff/rivet-checkout`.
+   - Preferred link target: `../rivet-checkout/rivetkit-typescript/packages/rivetkit`
+   - Before using the local checkout, build RivetKit from that repo so the linked package has fresh output.
+   - After the debugging pass, switch dependencies back to the published package version.
 
 ## Inspector HTTP API (Workflow Debugging)
 

factory/packages/backend/package.json

@@ -22,7 +22,7 @@
     "drizzle-orm": "^0.44.5",
     "hono": "^4.11.9",
     "pino": "^10.3.1",
-    "rivetkit": "^2.1.6",
+    "rivetkit": "2.1.6",
     "sandbox-agent": "workspace:*",
     "uuid": "^13.0.0",
     "zod": "^4.1.5"

factory/packages/backend/src/integrations/sandbox-agent/client.ts

@@ -172,7 +172,7 @@ export class SandboxAgentClient {
     // and waiting here can stall session creation long enough to trip task init
     // step timeouts even though the session itself was created.
     if (modeId) {
-      void session.send("session/set_mode", { modeId }).catch(() => {
+      void session.rawSend("session/set_mode", { modeId }).catch(() => {
         // ignore
       });
     }
@@ -243,7 +243,7 @@ export class SandboxAgentClient {
     const modeId = modeIdForAgent(this.agent);
     // Keep mode update best-effort and non-blocking for the same reason as createSession.
     if (modeId) {
-      void session.send("session/set_mode", { modeId }).catch(() => {
+      void session.rawSend("session/set_mode", { modeId }).catch(() => {
         // ignore
       });
     }
@@ -290,7 +290,7 @@ export class SandboxAgentClient {
     }
 
     const session = await sdk.resumeSession(sessionId);
-    await session.send("session/cancel", {});
+    await session.rawSend("session/cancel", {});
     this.setStatus(sessionId, "idle");
   }
 

factory/packages/client/package.json

@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "@sandbox-agent/factory-shared": "workspace:*",
-    "rivetkit": "^2.1.6"
+    "rivetkit": "2.1.6"
   },
   "devDependencies": {
     "tsup": "^8.5.0"