fix(combos): guard isActive toggle against partial-state 400 (CAS on version)

[KooshaPari]

Summary

[gemini-code-assist]

Code Review

This pull request introduces several updates, including new environment variables in .env.example, the addition of comprehensive incident response, performance budget, and threat model documentation, and various CLI improvements such as better context forwarding in the logs command. It also modifies the OpenCode plugin to automatically prefix provider IDs with opencode- to comply with native-adapter gates, and updates the lazily installed systray2 runtime with permission fixes and child process cleanup. Review feedback highlights the need to guard against prefixing allowed native adapters like openai and anthropic in the OpenCode plugin, and to ensure a localhost fallback is provided in the logs command if getBaseUrl resolves to undefined.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The native-adapter gate allows openai and anthropic as valid provider IDs. Prefixing them with opencode- will break configurations that explicitly use these native adapters. We should guard against prefixing if the rawProviderId is already one of the allowed native adapters.

Suggested change

	const providerId = rawProviderId.startsWith("opencode-")
	? rawProviderId
	: `opencode-${rawProviderId}`;
	const providerId = rawProviderId.startsWith("opencode-") || rawProviderId === "openai" || rawProviderId === "anthropic"
	? rawProviderId
	: "opencode-" + rawProviderId;

[gemini-code-assist]

If getBaseUrl returns undefined (e.g., when no active context is configured and no environment variables are set), baseUrl will resolve to undefined. This will cause subsequent API calls or stream connections to fail. We should provide a fallback to the default localhost URL.

Suggested change

	const baseUrl = opts.baseUrl || opts["base-url"] || getBaseUrl({ context: opts.context });
	const baseUrl = opts.baseUrl || opts["base-url"] || getBaseUrl({ context: opts.context }) || "http://localhost:20128";

[KooshaPari]

Closing — base is stale at release/v3.8.34 (43 commits behind the current release/v3.8.36 tip a9ddef130). The PR carries 676 files / +46k LOC from a full-bulk-rebase attempt that won't merge cleanly into the current base. The fix logic itself was already merged into upstream via independent commits — opening this PR as a separate workstream would conflict with Diego's landed work.

Tracking continues on the 3 unique-value PRs (#4777 refactor, #4778 constants extraction, #4979 composite-tiers back-compat shim), all on release/v3.8.36.