feat(ru-code): Add MCP UI, exceptions engine, model selection, and fix Git Cyrillic support

- Added MCP management UI: Introduced a new user interface to manage Model Context Protocol (MCP) settings.
- Added exceptions engine: Built a robust error-handling system to gracefully manage any application errors.
- Fixed VCS (Git) issues: Resolved bug causing errors with Cyrillic characters in repository names and paths.
- Enabled model selection: Added the ability for users to choose and switch between different AI models.

Author: ru-code-dev

apps/server/src/checkpointing/Layers/CheckpointStore.ts

@@ -269,6 +269,12 @@ const makeCheckpointStore = Effect.gen(function* () {
       }
 
       const diffArgs = [
+        // Emit raw UTF-8 pathnames instead of git's default octal-escaped,
+        // double-quoted form. The downstream diff parser only reads the
+        // unquoted capture groups of the `diff --git` header, so quoted
+        // (non-ASCII) paths crash it. ASCII paths are unaffected.
+        "-c",
+        "core.quotePath=false",
         "diff",
         "--patch",
         "--minimal",

apps/server/src/cli/config.ts

@@ -384,7 +384,11 @@ export const resolveServerConfig = (
       cwd,
       baseDir,
       // ru-fork: straight from the resolver — no dirname(baseDir) derivation.
-      cliJs: cli.cliJs,
+      // RU_FORK_CLI_JS is a DEV-ONLY override: point it at the built fake ACP
+      // server (tests/fixtures/fake-acp-server) to drive the real app against a
+      // scripted wire failure for manual UI checks. Combine with RU_FORK_FAKE_ACP
+      // (read by the fake itself) to pick which error to reproduce. See §9.5.
+      cliJs: process.env["RU_FORK_CLI_JS"] ?? cli.cliJs,
       cliConfigDir: cli.configDir,
       ...derivedPaths,
       host,

apps/server/src/orchestration/Layers/ProviderCommandReactor.ts

@@ -279,7 +279,7 @@ const make = Effect.gen(function* () {
   // detail → return its detail") is now `Z_CLEAN_REQUEST_ERROR` in
   // recognizers.ts. The old `Cause.pretty` fallback is replaced by
   // `UNRECOGNIZED_DECISION` — a fixed Russian fallback in UI plus the
-  // full pretty cause in the `[cli-error.unrecognized]` log line.
+  // full pretty cause in the `[runtime]` breadcrumb (code: "unrecognized").
 
   const setThreadSession = (input: {
     readonly threadId: ThreadId;
@@ -859,7 +859,16 @@ const make = Effect.gen(function* () {
     // Russian text in the UI, full `Cause.pretty` in the server log).
     // The old `formatFailureDetail` helper has been deleted — its fast
     // path now lives as the `Z_CLEAN_REQUEST_ERROR` recognizer.
-    const handleTurnStartFailure = (cause: Cause.Cause<unknown>) =>
+    // ru-fork: PRE-TURN failures only (buildSendTurnRequestForThread fails
+    // before sendTurn ever runs — most commonly B3 spawn, or an RPC error
+    // during the initialize/session.new handshake). No `turn.started` was
+    // emitted ⇒ no `turn.completed{failed}` will come ⇒ ingestion can't help ⇒
+    // the reactor is the SOLE writer here, and there is no competing
+    // `session.exited` (nothing live to exit). This is the only place the
+    // reactor writes turn-failure projection state. A TURN failure (sendTurn
+    // itself) goes through `handleTurnFailure` below (killAcp only) — its
+    // presentation is written by ingestion off the finalizer's turn.completed.
+    const handlePreTurnFailure = (cause: Cause.Cause<unknown>) =>
       Effect.gen(function* () {
         if (Cause.hasInterruptsOnly(cause)) return;
 
@@ -872,16 +881,21 @@ const make = Effect.gen(function* () {
             .interruptTurn({ threadId: event.payload.threadId })
             // Best-effort: if there's no live session to kill (already
             // dead, or never attached), don't fail the dispatch. The
-            // [cli-error.<id>] log line above already records the
-            // failure context.
+            // [runtime] breadcrumb above already records the failure context.
             .pipe(Effect.catch(() => Effect.void)),
           appendActivity: (detail: string) =>
             appendProviderFailureActivity({
               threadId: event.payload.threadId,
               kind: "provider.turn.start.failed",
               summary: "Provider turn start failed",
               detail,
-              turnId: null,
+              // ru-fork: bind to the PRIOR (settled) turn so the work-log
+              // filter (session-logic.ts:492 — activity.turnId === latestTurnId)
+              // keeps the row even when the thread already has turns. Falls back
+              // to null when there is no prior turn (then latestTurnId is
+              // undefined ⇒ the filter's `: true` branch shows it anyway).
+              // `latestTurn` is the settled prior turn, NOT the racy active turn.
+              turnId: thread.latestTurn?.turnId ?? null,
               createdAt: event.payload.createdAt,
             }),
           setLastError: (detail: string) =>
@@ -897,13 +911,31 @@ const make = Effect.gen(function* () {
         });
       });
 
-    const recoverTurnStartFailure = (cause: Cause.Cause<unknown>) =>
-      handleTurnStartFailure(cause).pipe(
-        Effect.catchCause((recoveryCause) =>
-          Effect.logWarning("provider command reactor failed to recover turn start failure", {
+    // ru-fork: TURN failures (sendTurn itself failed). The adapter's finalizer
+    // already emitted the one `turn.completed{failed}` carrying the classified
+    // text + surface + real turnId, and ingestion (single writer) has written
+    // the timeline row / banner / message-finalize from it. The reactor must
+    // NOT write any projection state here (doing so is the two-writer race this
+    // whole change removes) — its only job is to kill the session when the
+    // recognizer says so. `killAcp → stopSession` (not interruptTurn) so we
+    // don't set the adapter's cancel-intent flag on a genuine failure.
+    const handleTurnFailure = (cause: Cause.Cause<unknown>) =>
+      Effect.gen(function* () {
+        // Stop / teardown interrupts → ingestion already finalized as cancelled.
+        if (Cause.hasInterruptsOnly(cause)) return;
+        const error = cause.reasons.find(Cause.isFailReason)?.error;
+        const decision = classify(error, cause) ?? UNRECOGNIZED_DECISION;
+        if (decision.killAcp === true) {
+          yield* providerService
+            .stopSession({ threadId: event.payload.threadId })
+            .pipe(Effect.catch(() => Effect.void));
+        }
+      }).pipe(
+        Effect.catchCause((handlerCause) =>
+          Effect.logWarning("provider command reactor failed to handle turn failure", {
             eventType: event.type,
             threadId: event.payload.threadId,
-            cause: Cause.pretty(recoveryCause),
+            cause: Cause.pretty(handlerCause),
             originalCause: Cause.pretty(cause),
           }),
         ),
@@ -951,7 +983,7 @@ const make = Effect.gen(function* () {
       createdAt: event.payload.createdAt,
     }).pipe(
       Effect.map(Option.some),
-      Effect.catchCause((cause) => handleTurnStartFailure(cause).pipe(Effect.as(Option.none()))),
+      Effect.catchCause((cause) => handlePreTurnFailure(cause).pipe(Effect.as(Option.none()))),
     );
 
     if (Option.isNone(sendTurnRequest)) {
@@ -960,7 +992,7 @@ const make = Effect.gen(function* () {
 
     yield* providerService
       .sendTurn(sendTurnRequest.value)
-      .pipe(Effect.catchCause(recoverTurnStartFailure), Effect.forkScoped);
+      .pipe(Effect.catchCause(handleTurnFailure), Effect.forkScoped);
   });
 
   const processTurnInterruptRequested = Effect.fn("processTurnInterruptRequested")(function* (

apps/server/src/orchestration/Layers/ProviderRuntimeIngestion.ts

@@ -169,6 +169,12 @@ function truncateDetail(value: string, limit = ACTIVITY_DETAIL_MAX_CHARS): strin
   return value.length > limit ? `${value.slice(0, limit - 3)}...` : value;
 }
 
+// ru-fork: DEFENSIVE only. By contract the adapter always sets
+// `errorMessage = decision.text` (non-empty for every T/T+N recognizer and the
+// unrecognized fallback) on turn.completed{failed}, so this is unreachable in
+// practice — it exists so a malformed event can't produce an empty banner/row.
+const FALLBACK_TURN_FAILED_TEXT = "Шаг не выполнен";
+
 function normalizeProposedPlanMarkdown(planMarkdown: string | undefined): string | undefined {
   const trimmed = planMarkdown?.trim();
   if (!trimmed) {
@@ -1275,7 +1281,17 @@ const make = Effect.gen(function* () {
                 ? null
                 : (thread.session?.lastError ?? null);
 
-        if (shouldApplyThreadLifecycle) {
+        // ru-fork: a FAILED turn.completed is owned end-to-end by the dedicated
+        // single-writer block below (it writes the timeline row with the real
+        // turnId + the session error per surface). Skip the generic lifecycle
+        // session.set here so there is exactly ONE writer for failed-turn state
+        // (and so the legacy "Шаг не выполнен" + always-banner path no longer
+        // races it). Completed / cancelled turns still flow through here.
+        const isFailedTurnCompleted =
+          event.type === "turn.completed" &&
+          normalizeRuntimeTurnState(event.payload.state) === "failed";
+
+        if (shouldApplyThreadLifecycle && !isFailedTurnCompleted) {
           if (event.type === "turn.started" && acceptedTurnStartedSourcePlan !== null) {
             yield* markSourceProposedPlanImplemented(
               acceptedTurnStartedSourcePlan.sourceThreadId,
@@ -1315,6 +1331,59 @@ const make = Effect.gen(function* () {
             createdAt: now,
           });
         }
+
+        // ru-fork: SINGLE WRITER for a failed turn. Everything the user sees on
+        // a failure comes from this one event: the timeline error row carries
+        // the REAL turnId (event.turnId, set by the adapter when it created the
+        // turn) so the web work-log filter (activity.turnId === latestTurnId,
+        // session-logic.ts:492) keeps the row and it persists; the surface
+        // decides banner-or-not. The message-finalize loop further below still
+        // runs for failed turns and clears `message.streaming` (timer stops).
+        // No projection write for a failed turn happens on the reactor bus.
+        if (event.type === "turn.completed" && isFailedTurnCompleted && shouldApplyThreadLifecycle) {
+          const failedTurnId = toTurnId(event.turnId) ?? null;
+          const detail = event.payload.errorMessage ?? FALLBACK_TURN_FAILED_TEXT;
+          // true ⇒ T+N (row + notification); false ⇒ T (row only); absent ⇒
+          // notification (legacy default). The row is written unconditionally below.
+          const surfacesNotification = event.payload.showNotification ?? true;
+          // (1) timeline row, bound to the real turn id
+          yield* orchestrationEngine.dispatch({
+            type: "thread.activity.append",
+            commandId: providerCommandId(event, "turn-failed-activity"),
+            threadId: thread.id,
+            activity: {
+              id: event.eventId,
+              tone: "error",
+              kind: "provider.turn.start.failed",
+              summary: "Provider turn failed",
+              payload: { detail: truncateDetail(detail) },
+              turnId: failedTurnId,
+              createdAt: now,
+            } satisfies OrchestrationThreadActivity,
+            createdAt: now,
+          });
+          // (2) session error per surface — T+N ⇒ banner (status error +
+          // lastError); T ⇒ no banner (status ready + lastError null). Both
+          // clear activeTurnId so the "Работаю" timer stops.
+          yield* orchestrationEngine.dispatch({
+            type: "thread.session.set",
+            commandId: providerCommandId(event, "turn-failed-session"),
+            threadId: thread.id,
+            session: {
+              threadId: thread.id,
+              status: surfacesNotification ? "error" : "ready",
+              providerName: event.provider,
+              ...(event.providerInstanceId !== undefined
+                ? { providerInstanceId: event.providerInstanceId }
+                : {}),
+              runtimeMode: thread.session?.runtimeMode ?? thread.runtimeMode,
+              activeTurnId: null,
+              lastError: surfacesNotification ? detail : null,
+              updatedAt: now,
+            },
+            createdAt: now,
+          });
+        }
       }
 
       const assistantDelta =