ci(help): remind PRs that change UI labels to update the user help
The help drifted for a week because about forty user-visible PRs merged without touching it, while CI only checks the help's structure and links. The rule asking for help updates in the same PR was buried in the AGENTS.md i18n section; it now has its own short Pull Requests section next to the commit guidelines, which agents consult when committing and opening PRs.
A new non-blocking workflow, help-update-reminder.yml, catches the most common miss: when a PR changes English UI messages (packages/ui/src/lib/i18n/messages/en/) but no file under docs/help/, it posts one marked comment and a warning annotation; once the PR touches the help, the comment is removed. It runs on pull_request_target like the existing Restrict Non-Dev PRs workflow, but only reads the PR file list and comments through the API and never checks out pull request code, so the write-scoped token never runs PR content. Because pull_request_target uses the base branch's workflow, it starts on PRs opened after this merge. USER_HELP.md documents it.
Validation: replayed the filter read-only on past PRs: it would have flagged #1014, #1026 and #1052, which changed labels without updating the help, and stays quiet for #1043 and #1054, which updated it, and for #1057, #1063, #1079 and #1080. The workflow YAML parses, the step passes bash -n, the comment body has no leading indentation and the marker lookup returns the expected comment ID on a real PR. Behavior-only changes without label edits (such as #1063) are not detected; the AGENTS.md rule covers those.
Review follow-up: the reminder only matches comments authored by github-actions[bot], runs are serialized per PR so overlapping events cannot post twice, clearing removes every owned reminder, and the workflow keeps only pull-requests: write.
## Follow-up to #1076
Separate required-fresh outcomes from display refresh demand. Fresh
failure rejects only fresh callers, queued display work still runs, and
no fresh flag leaks into the next display read. Concurrent fresh calls
coalesce; cached completion cannot satisfy fresh recovery.
One serialized read/publication lane retains priorities and ordering.
Initial display fallback cannot erase a fresh snapshot; existing display
dirty/trailing coalescing retained. No backend/move safety change,
polling or mutation replay.
## Validation
Original queue fails deterministic fresh+fresh+display and
concurrent-fresh regressions. Fixed: relevant UI units82/82
(worktree-ready14/14), worktrees browser13/13, focused interruption-dock
recovery2/2, UI typecheck and diff check pass. Node24.20.0, private
dependencies; no full browser sweep or live app/shared daemon/userDB.
Server unchanged; native fixture not rerun.
Three focused files, none oversized.
Finding "what did the agent answer when I asked…" meant scrolling or hovering the timeline marker by marker. Two new commands, Previous User Message and Next User Message, appear in the command palette and in Settings → Keyboard shortcuts, bound by default to Shift+ArrowUp and Shift+ArrowDown. From the conversation (where focus lands after a send), they place the nearest user message before or after the reading position at the top, paging its history window in when it is not resident, like a timeline click. Text fields, arrow-key widgets, IME composition and modal dialogs keep the keys, so Shift+Arrow still selects text in the composer; key repeat does not repeat the jump.
components/user-message-navigation.ts searches the timeline's markers, including the structural index beyond the resident window, and uses list order for a current message without a marker. MessageSection handles the shortcut in the capture phase, before the transcript reads arrows as a scroll gesture; the palette commands reach it through JUMP_USER_MESSAGE_EVENT. The jump requests the index even while the timeline is hidden, and a jump finding nothing resident before it arrives runs once it does. The last target stays the reference while loading or shown, since the list cannot raise a message near the end to its top. Both are forgotten in cancelWindowNavigation, which every other navigation (First/Latest, sends, paging, session changes, deactivation) passes through, and on scroll gestures, so a late index never overrides a newer navigation.
The public help lists the shortcut in all ten locales and states the 74-action catalog (it said 49); HOTKEYS.md and AGENTS.md describe the dispatch; labels are translated in every locale.
Validation: unit tests for the target search and key guard plus the catalog count (now run in CI); browser regressions for resident and windowed jumps, the composer keeping Shift+ArrowUp, the deferred jump with a hidden timeline, an explicit Latest dropping it, and repeated jumps near the end (the last three fail without their mechanism). hotkeys-settings, header-windows and history-navigation suites pass; UI own-tsconfig typecheck, root typecheck and test:help pass. Gatekeeper review (GPT-6.1 Sol): one P2 (deferred jump surviving Latest) fixed, then zero actionable findings at 7ab3f17d3cac6be694f989fde8d217c313599f9d (rebased on dev as bf6e09990ba7b65789d5789fe00d87b5e1362625; only the help pages' catalog count conflicted).
Refs #1075
docs(help): bring the user guide back in line with the current app
The help was written on 2026-10-14 and about forty user-visible changes merged since without touching it, so several pages described controls that no longer exist: Missions still listed four playbooks and a Save step for preferences that now save on each change, the depth editor kept its old names, notifications still had their former switches, and voice input pointed to a microphone button that is not in the composer.
Every English page was re-checked claim by claim against the current labels (English UI messages) and behaviour, then the nine translations were updated to match, using each locale's own UI labels. Notable corrections: Missions (Compare two models, autosaving defaults with Apply to / Global / Reset, Subsession nesting depth, prepared hand-offs, retired-task interrupts, the named causes of "Mission Control is unavailable", standalone server support); conversations and history (reasoning/tool durations, token lines adding up the cleanup selection, presets including Nothing, timeline markers following Message content, in-place reveal of long text, Open in session, focus after send, Queue message / Steer now, Retrying); settings (notification routing table and defaults, Stats, Mode, info tips, Server setting badge, localized native menus); shortcuts (72 actions, Clear shortcut, Ctrl/Cmd+K); voice (More actions entries, Save status); files (live Workspace refresh, Show 200 more); OpenCode, install, server and updates (2.1.1 recommended, OpenCode 2 beside an older installation, version card first, private loopback listener for Missions, preview releases offered once all builds are published); providers, integrations, browser, SideCars, desktop and remote pages. Translations also repaired older drift, mainly the project-tab closing passages.
The Chat settings table header (Default state, its title, item column, the thinking row and its accessible label) was still English in eight locales; it is now translated so the help can cite what users see. AGENTS.md now asks every PR changing user-visible behavior to update the affected help pages in the same PR, since CI validates structure and links but not whether the text still matches the UI; it also corrects the needs-input notification default. USER_HELP.md no longer claims native menus stay English.
Validation: npm run test:help (all ten locales, 25 pages, heading ids unchanged), a full help build, and the i18n and transcript-visibility unit tests.
Raise the approved external runtime minimum and recommendation to 2.1.2 after reproducing incorrect native Code Mode job ordering on 2.1.0/2.1.1. Keep the independently qualified 2.1.0 client/plugin build pins and preserve bounded contract recognition for custom/future runtimes. Add the real isolated execute regression to the minimum/latest compatibility matrix, align supported installer fixtures without weakening assertions, and update setup/help in all ten locales. Two author-side review passes found no blockers; the final focused set passes 93/93 and native Code Mode passes. Qualification includes builds/typechecks, UI/browser, native pruning/Missions/recurrence, migrations and isolated installation/upgrade. Record the broad server shutdown timeout and its two unchanged isolated passes precisely. Admin merge explicitly authorized by the maintainer without waiting for CI.
## Problem and fix
A cached UI worktree descriptor can keep a removed idle directory
required after native/backend inventory healed. On inventory-only
missing/not-owned recovery failures, perform ONE fresh worktree
inventory read and retry ONLY directories that genuinely became optional
through the existing loaded-only pending broker.
The failed-move clue exposed another guard gap: preserve source/target
locations and pending move identity after failed/incomplete
reconciliation until complete family inventory plus fresh activity
succeeds. An old read cannot release a newer move, and mutations are
never replayed.
## Safety
- Root/catalogue selection, active sessions, known Forms/permissions and
uncertain move locations remain required.
- No blanket exclusion, directory/session deletion/move, daemon restart,
ordinary pending-list fallback, fake empty coverage or warning
suppression.
- Existing broker negative proofs and post-IO ownership/deletion fences
remain; successful sibling recovery and edited drafts retained.
- The precise12:58 warning in the screenshot is not proven causal: both
directories are now absent from live/Git inventory and not active.
Current healed state does not establish historical bad registration.
## Validation
Red store and real-browser regressions reproduce on base. Green:146 UI
tests,78 server tests,2 focused browser cases; both typechecks and diff
check pass. Isolated real Git/filesystem fixture exercises external
removal with warm display/stale native registration. Read upstream2.1
refresh implementation/test (refresh prunes absent registrations; list
alone does not discover).
No full browser sweep/real-daemon fixture. WSL mocks pass, live
WSL/native hosts unverified. No installed app/shared daemon/user
database/config mutations.
Oversized touched sources: api-client.ts~820, instances.ts~2420,
session-api.ts~2050. Added tests extend existing CI-listed files.
The supersession regression from #1071 read Error.cause, which the server's own tsconfig library does not declare. Local checks had forced --lib ES2022 and missed it; the packaged build (tsc -p tsconfig.json in the server prebuild) failed with TS2550, breaking the Tauri Windows prerelease build and skipping every other build and the npm publication.
Read the cause through a structural type instead. Validation: server and UI typecheck with their own tsconfig report 0 diagnostics, root npm run typecheck passes, provisioning tests pass. Gatekeeper review (GPT-6.1 Sol): zero actionable findings at 5546acd6f1d228679310dbbe3995e30e45215e66, including a scan of the #1070/#1071 sources for other build-incompatible APIs.
test(pruning): expect response usage to keep tool steps in one group
#1059 changed the transcript's token lines from one per model step to one
per agent response. Steps that end with tools now pass their usage on to
the response text, so no line separates them and their tools stay in one
technical group. The native pruning UI scenario still expected the old
behaviour: it waited for visible per-step usage to split the last tool
group ("Shell: 2"), then hid usage to join it. That wait times out, and
tests-session-pruning-native has failed on every OS for each pull request
since #1059 (including #1059 itself).
The step now checks the new contract on the real native transcript. With
usage visible, the response's conclusion carries its usage line, the two
tool-only steps carry none, and their tools form a single "Shell: 3"
group across both messages. The rest of the scenario (whole-group,
cross-message response, reasoning-group and whole-session cleanup) now
runs with usage visible, the default, instead of hidden. Product code is
unchanged.
Validation: node scripts/run-session-pruning-native.mjs <cli> --ui against
an isolated @opencode/cli 2.1.2 on Windows passes every native and UI step,
including the updated one.
ci(help): pin the Pages workflow actions to exact current releases
After the Actions refresh, the help publishing workflow was the only one
still on floating major tags (checkout v4, setup-node v4,
upload-pages-artifact v3, configure-pages v5, deploy-pages v4). Dependabot
then proposed five separate bumps. Two of them also rewrote the exact pins
in every other workflow (checkout v7.0.1, setup-node v7.1.0) to the
floating v7 tags.
Pin help-pages.yml to the same exact releases as the other workflows
(checkout v7.0.1, setup-node v7.1.0) and to the current exact Pages
releases (upload-pages-artifact v5.0.0, configure-pages v6.0.0,
deploy-pages v5.0.1). With every workflow on exact versions, Dependabot's
weekly updates stay precise, and this change makes its pending proposals
unnecessary.
upload-pages-artifact v4+ leaves dotfiles out of the artifact. The help
build writes two of them. The first, .nojekyll, is not needed because
Actions-based Pages deployments never run Jekyll. The second,
.help-output.json, is the build's internal ownership record and should
not be published. The default is therefore kept rather than opting into
include-hidden-files.
Validation: this change triggers the workflow's own pull_request build
(npm ci, test:help, build-help and the artifact upload); the deploy job
runs on the dev push after merge.
Replacing the shared OpenCode connection aborts every request still in flight on the old one (the transport's lifetime signal is aborted without a reason). When that happened while the bundled plugins were being provisioned, the backend logged "[ERROR] Cannot provision bundled plugins without the connected daemon's discovery directory" with "This operation was aborted", although the new connection provisions them again. A standalone-server user on WSL reported exactly this line (#1069) and could not tell it apart from a real failure.
Provisioning moves out of index.ts into opencode/desktop-plugin-provisioning.ts. A failure while resolving the discovery directory or installing presence is reported at error level only when the connection is still current; on a replaced connection it is logged at debug as superseded. Behaviour is otherwise unchanged: both steps still return false and the next connection retries.
Validation: a regression drives the real OpenCodeSharedService with a client using the connection's own transport against a daemon that never answers, replaces the connection during the config.get read and requires one debug supersession (with the same abort) and no error; unit cases keep current-connection failures at error level for both steps and treat an install cut short by a replacement as superseded. Related plugin lifecycle, readiness, shared-service and standalone startup tests pass; server typecheck clean. Independent gatekeeper review (GPT-6.1 Sol): zero actionable findings at da387f019c548ed2b19405d1e068ab761176f7e1. Hosted CI was still running at merge.
Why the reporter's connection was replaced is not addressed here; the surrounding log lines were requested on the issue.
Refs #1069.
## Problem
Missions dispatch through the owning backend's loopback automation
bridge, not through the desktop window. Yet the bridge and the Missions
plugin were only provided when a desktop host launched the server. On
the standalone server (`npx @neuralnomads/codenomad…`, whose default
listener is HTTPS-only), Missions never loaded, and Mission Control told
users to "Reconnect CodeNomad", which cannot help (#1069). Tauri on
macOS/Linux sets no native parent and was affected the same way.
## Fix
- **Private loopback listener:** the HTTP listener always starts. When
HTTP was not requested, it is private and unannounced, on a random
`127.0.0.1` port.
- **Bridge and plugin:** the bridge is published whenever a loopback
HTTP listener exists, and the Missions plugin is provisioned once that
publication settles, so early connections never skip it.
- **Automation stays desktop-only:** without a desktop host, the
bridge's `browser-claim` answers only `purpose: "mission"`, which the
Missions plugin now sends. Browser tools therefore never select an owner
that cannot open a page. Remote Control keeps routing into the
application users reach.
- **One deletion fence per backend:** all listeners now share one
`WorktreeDeletionFence`, and with it the mission creation/recurrence
holds. Previously each listener had its own, so a deletion through HTTPS
could not drain a mission admitted through the HTTP bridge. This could
already happen in desktop dual-listener mode.
- **Exact unavailable causes,** localized in all ten locales:
- `host-unavailable`: this backend has no bridge; reported before
reading OpenCode.
- `plugin-unavailable`: OpenCode has not loaded the plugin. Refresh,
then use **Reload OpenCode configuration**.
- `plugin-failed`: OpenCode failed to load the plugin; its error is in
the Plugins list.
## Validation
- New real startup test: the actual entry point as a standalone
HTTPS-only server, isolated profile, no OpenCode. It proves the private
`127.0.0.1` bridge is published, authenticated (401 without token),
unannounced and removed on shutdown.
- Bridge route tests: mission-only claims without a desktop host,
ownership still required, native requests fail closed. The plugin test
asserts that the claim carries the purpose.
- Missions route tests cover each unavailable reason, and
`host-unavailable` reads nothing from OpenCode.
- The isolated native Missions fixture
(`scripts/test-missions-native.mjs`) passes on **OpenCode 2.1.2**
through the real bridge route with no desktop host.
- Server and UI typecheck: 0 diagnostics. Full server suite running.
Refs #1069
#1059 showed a token line only on agent messages whose model call ended with text, so in OpenCode V2, where an agent message is usually followed by tool calls in the same native message, most messages had no line.
Every agent message now shows a token line at the end of its final text, the row that already carries "delete tools and reasoning". It adds up the message's own native usage and that of every message holding a tool or reasoning part the cleanup selects, reusing that selection instead of a separate projection. Tool-only steps get no line and no line sits between tools, so technical groups stay whole and their Delete stays available; failed messages that show text keep their line; prompts, queued prompts and omitted-part gaps follow the cleanup scope because it is the same selection. A message whose text is followed by tools also counts in the next message's line, since its tools belong to that selection. The line renders inside the content row, so settling or the Tokens filter never shifts the positionally rendered items after it. projectUsageLines, the reserved usage item, its cache signature, hasVisibleUsage and the border sentinel are removed; sumMessageUsage is the only helper.
Validation: sumMessageUsage unit test; usage-metrics covers a line on a text-then-read message placed before its tools, an answer adding up the messages holding its selected reads, one deletable read group, line geometry, the Tokens filter and a settling text-then-tool step that keeps its expanded tool element (fails on the earlier insertion). usage-metrics, search-highlight, status-tokens, full-source-copy, reasoning-collapse, history-navigation, system-messages and render-cost browser tests, session-actions and message-part-grouping unit tests and the UI typecheck pass. Reviewed independently, including by GPT-6.1 Sol (high).
The rail doubled the gap wherever a tool marker started a different message, a collapsed tool group ended or a prompt followed an assistant with tools: a V1 notion of tools belonging to their assistant message. OpenCode V2 records each model call as its own message, so almost every tool started a new group while tools called together stayed tight, giving irregular, pronounced gaps that meant nothing to the reader. Every visible marker now follows the previous one by one uniform gap, and the message-tool bookkeeping is removed.
Validation: render-cost checks the exact 10,000-marker extent with uniform gaps; timeline-tool-filters, history-navigation and system-messages browser tests and the UI typecheck pass.
The Windows runtime handle regression builds a copy with the counter fix reverted and required that negative control to crash within ten processes before the corrected build's five runs. The race is timing-dependent: of the last ten PR builds, five runners reproduced it (1 to 8 crashes in ten) and five never did, so tests-tauri-windows failed about every other pull request, unrelated to the change under test.
The negative control now runs up to fifty processes (about 0.16 s each) and stops at the first native fault. On GitHub Actions, a runner that never reproduces it emits a warning naming its CPU instead of failing; local --baseline runs still fail, so a change to the fix cannot pass on a machine that never races. The corrected build's runs, the accepted fault codes and the clean-teardown check for surviving processes are unchanged; the counter-boundary and vendored-Tao checks guard the fix on every runner. Docs state that corrected runs on a warning machine provide no timing evidence.
Validation: syntax check and two independent reviews; the sample comes from the tests-tauri-windows logs of the ten most recent PR Build Validation runs.
ci(linux): compare Electron deb owners by numeric ID
The PR build proves the dev-version rewrite of the Electron deb on a copy and checks that it keeps the same files, modes and owners. It compared dpkg-deb --contents listings textually, and the artifact's archive now lists its owners as 0/0 (IDs only) while the dpkg-deb --root-owner-group rebuild lists root/root, so every line differed and build-linux failed on every pull request although both are root.
The check now lists both data archives with GNU tar --numeric-owner, which prints IDs whatever the archive stores, and sorts the listings so only content can differ.
Validation: an isolated WSL Ubuntu reproduction (dpkg-deb 1.22.6, GNU tar 1.35) builds a deb with numeric-only owners and runs the workflow's rewrite: the previous check fails with the same 0/0 versus root/root diff as CI, the new check passes, and it still detects an owner change to 1000:1000.
fix(transcript): show one token line per agent response so tool groups stay whole
OpenCode V2 records every model call as its own assistant message, and the transcript closed each one with its own token/cost line. Those lines ended technical groups, so a run of commands or reads became a series of one-tool groups, and a group's Delete action, which needs at least two tools, disappeared.
Token lines now follow the scope of the response's "delete tools and reasoning" cleanup, as the transcript showed them before V2: a line closes at the end of each settled step whose last tool, reasoning or text item is response text, summing that step and every settled step since the previous line or prompt. Steps ending with tools pass their usage on to the next response, so no line appears between them and their tools form one group again. A turn ending without a response (interrupted or failed) shows no line. projectUsageLines in message-part-grouping is the pure projection; the message section feeds it the loaded transcript (prompts and native idle records end a turn) and each message block renders its line, with the summed values in its cache signature. The cleanup boundary predicate is shared as isResponseTextPart.
Validation: message-part-grouping unit tests cover folding, unanswered and open turns, prompt boundaries and the closing predicate; the usage-metrics browser fixture gains a tool-only step and checks a single summed line, no line on the tool steps, one deletable read group, the line geometry and the Tokens filter; it fails on the previous per-step lines. full-source-copy, reasoning-collapse, status-tokens, history-navigation, system-messages, render-cost and timeline-tool-filters browser tests, session-actions unit tests and the UI typecheck pass.
fix(timeline): stop adding an empty agent marker after every tool step
In OpenCode V2 each agent step is its own assistant message, and most steps only call tools. The timeline's structural index for history knew an assistant message's tool and reasoning counts but not whether it had text, so the projection drew a tool marker followed by an agent marker for every step. For tool-only and reasoning-only steps that agent marker was empty: no hover preview, and clicking it reached a message showing nothing but its tools, or nothing when tools are hidden in Message content. Resident (loaded) messages already dropped such markers.
The outline index now also counts an assistant message's non-blank text parts that are neither synthetic nor ignored, the same text the hover preview shows. The projection draws an assistant marker only when that count (or the resident segments) shows visible text, so a tool-only step keeps its tool marker alone and a reasoning-only step has none. The count is optional in the contract: an older plugin copy still loaded by the daemon reports no count, and its markers stay as before. Persisted indexes saved without the count display immediately and then revalidate every checkpoint once, like the representative tool names. The unused message-timeline-group-* classes, which no stylesheet or test referenced, are removed; the group spacing that still uses tool membership is kept.
Validation: navigation.test covers text counts for text, tool-only and blank/synthetic/ignored/reasoning-only steps; session-outline-projection covers tool-only, reasoning-only, text, unknown-count, shell and resident cases; session-outline-persistence covers validation and the one-time refresh of indexes without counts; the native navigation script now asserts the counts on real native storage (CI). history-navigation, timeline-tool-filters, system-messages and render-cost browser tests, the session-outline tests and the UI typecheck pass.
Shortcut hints belong in tooltips, but only a few buttons appended their binding, each through its own copy of the same expression. A shared withHotkey(label, id) in lib/hotkeys.ts now returns the label followed by the effective binding (or the label alone when unbound), and every tooltip uses it. The header's command palette and chat search buttons, new session, Info, the composer's agent/model/thinking selectors, search previous/next, the home page Browse button and the active instance or sidecar tab's close button now name their shortcut; the collapsed header menu and the composer's history/Clear items show it as their description. Accessible names are unchanged, and a hint appears only where the shortcut performs that action in the control's current context (Ctrl+W only on the active tab).
Ctrl+K and the palette's Clear input command only blanked the textarea's DOM value, so the controlled composer kept the old draft: Send stayed enabled and Enter sent the text the user had just cleared. Both now ask the active instance to clear its shown composer, which dispatches PROMPT_CLEAR_EVENT so the composer runs its own Clear action (undoable, resets history navigation and the picker). The request is never kept pending, so a late clear cannot erase text typed afterwards. The selector shortcuts and Ctrl+K also work in the no-session draft composer, which shows the same selectors.
Validation: header-windows checks the palette, search and selector tooltips with default and overridden bindings, and a new test clears a conversation draft and a first-prompt draft with Ctrl+K (Send becomes disabled) and opens the agent selector with Ctrl+Shift+A in both states; it fails on the previous shortcut code. header-windows, shell-navigation, tab-chrome, hotkeys-settings, session-interrupt, project-tab-close and composer-alternate-send browser tests and the UI typecheck pass.
Recommend the qualified external OpenCode 2.1.1 runtime while retaining minimum 2.1.0 and the unchanged locked client/plugin build. Align setup/update regression expectations and the recommended-version help tables in all ten locales; preserve authenticated contract recognition and mutation/ownership fences.
Record isolated Windows native runtime, session/account/usage, pruning UI/history, four historical migrations and all eleven recurring Mission journeys. Server units pass 2442 with seven skips, UI units 1635 and focused browser tests 125; final dev Settings/preview-offer deltas and retained-minimum controls are revalidated.
Two review passes found no actionable issue in the PR. Admission/update tests and explicit isolated 1.x-to-2.1.1 replacement pass. The user explicitly authorized administrator merge despite the unrelated Tauri Windows negative-control race test failure, the general test job still running at inspection and the required GitHub review. No stable release is published by this merge.
The composer's More actions menu now offers the follow-up delivery Enter does not use: Queue message when Enter steers, Steer now when Enter queues. It is enabled only in normal mode while the session runs and a draft can be sent, and it goes through the same delivery resolution as the shortcut, so an idle session always sends normally.
Alt+Enter becomes the default alternate-send shortcut on Windows and Linux, with Ctrl+Shift+Enter kept as a second binding. On macOS Option+Return is the native line break in text fields, so only Cmd+Shift+Return sends there; the platform check lives once in hotkey-definitions. The file/command picker now ignores any modified Enter, so Alt+Enter never selects the highlighted item. The menu tooltip shows the effective shortcuts, the help tables note Alt+Enter is for Windows and Linux, and the menu rebuilds only when its enabled states flip.
Validation: composer-alternate-send and composer-picker-enter browser tests (including Alt+Enter with the picker open), hotkey-bindings unit tests for macOS and other defaults, usePromptKeyDown, submitPrompt, hotkeys-settings, help test and UI typecheck pass.
fix(timeline): highlight the message's visible marker instead of a hidden tool
The transcript reports a message's first timeline marker as active, and that marker is often a tool. Since #1049 a hidden tool marker reappeared whenever it became active, so tools hidden in Message content kept popping into the rail while scrolling, for no visible reason. A hidden tool marker now stays hidden; the active highlight and the rail reveal move to the first visible marker of the same message (activeVisibleId), and a message with no visible marker highlights nothing. Markers with an active permission still stay visible.
Validation: timeline-tool-filters checks that a hidden active tool stays hidden, its message's assistant marker is highlighted, a message without visible markers highlights nothing, and a visible tool keeps its own highlight; history-navigation (61 tests) and the render-cost timeline test pass; UI typecheck passes.
fix(updates): offer a preview release only once all its builds are published
Release publication creates the GitHub release first and uploads its builds over the next 40 minutes or so; the complete updater manifest (latest.json) is uploaded only after every platform build. The preview monitor offered the newest published release as soon as it was created, so the update notification appeared before any build existed. It is shown once per version, so no second notification came when the release became installable, and the desktop updater, which requires latest.json, opened the release page instead of installing.
The monitor now offers only releases carrying latest.json, the same rule the native updater applies. A newer release that is still building no longer hides the newest ready one, and the installed release is still recognised for publication order whether or not it has a manifest. A notification therefore appears only when the release is complete, and its install action works.
Validation: dev-release-monitor unit tests cover releases still building, a release becoming ready and an installed release without a manifest; existing feed and lookup tests pass.
fix(settings): show OpenCode version first and drop the Runtime header
Settings > OpenCode now starts with the OpenCode version card (status, install/update and service actions), followed by the executable selection and then the log level card. The executable card loses its separate "Runtime" heading and server-setting badge: the binary selector already carries its own "OpenCode binary" heading and description, so the extra row only repeated it. The startup recovery dialog shares the same card and drops the duplicate heading too. The two unused strings are removed from all ten locales and AGENTS.md records the new order.
Validation: the opencode-setup browser suite (33 tests) passes, including the settings layout test now asserting the version card first, the selector second without a header, collapsed disclosures and logs last; a capture confirmed the order. UI typecheck passes.
Publish the proposed SignPath Foundation policy with Shantur Rathore as project owner and Pascal Andre as signing operator and approver. Describe source/build provenance, manual signing approval, MFA requirements and artifact verification, with links from the README and to the privacy policy.
Native Preferences showed "The CodeNomad window that opened Preferences is no longer available" with disabled startup controls whenever its opener was unknown (Preferences restored at launch) or closed, even with CodeNomad windows open. Startup state (restore previous state, saved snapshot, Clear) is each window's own, so the host now adopts the most recently used local window as the opener in that case: Electron through PreferencesWindowRegistry.adoptOpener (startupStateTargetId), Tauri through set_opener (startup_state_target). The epoch rotates on adoption, so a change prepared for another window degrades to a read of the adopted one before any write. The warning and its string in all ten locales are removed; the card re-reads up to three times while the adopted window starts and stays disabled only when no local window can answer. Code contracts, AGENTS.md and the public help in all ten locales describe the opener, otherwise the most recently used window.
Stats' text Refresh button becomes the shared icon button sized like the period select, keeping its localized accessible name and tooltip; the icon spins while a read runs.
Validation: Electron unit tests for live/closed/unknown openers, adoption, epoch rotation and fenced changes; Tauri unit test for adoption and fencing; preferences-startup-state (Electron and Tauri hosts), other-profiles and service-usage browser tests; UI and Electron typechecks; help test; rustfmt check. Independent review: the first pass found that startup state is per window and that the fence no longer followed the target; the adoption fix was re-reviewed and approved, with two trivial notes applied.
Publish PRIVACY.md and link it from the README footer for the SignPath application. Describe local data handling, automatic network requests and user-initiated integrations. Documentation only.
Timeline tool markers now follow the Message content filters: a marker disappears when the tool type it shows (its icon; the outline's representative tool for indexed history) is hidden there, and the Nothing preset removes every tool marker. As with hidden tools before, the transcript's active marker and markers with an active permission stay visible, so highlighting and reveal keep following the transcript. Collapsed tools keep their marker.
Because the rail now follows those filters, the separate "Show tool calls in the timeline" preference is removed everywhere it surfaced: Settings > General, the View menu item in the renderer, Electron and Tauri hosts, the palette command, its shortcut catalog entry (72 actions, 23 initially unbound) and its strings in all ten locales and the help. Saved values are ignored; the server schema passes unknown keys through, and hosts ignore an extra field from older renderers. The never-updated expandedMessageIds timeline input is dropped. Intended default change: tool markers are visible with the Balanced preset unless their type is hidden in Message content.
Validation: new timeline-tool-filters browser test (hidden, Other-routed and collapsed tools, Nothing/Everything presets, a hidden active marker shown and highlighted); view-menu, a real Electron View menu, hotkeys-settings, transcript-presets, render-cost, history-navigation and other timeline suites (one local-environment failure that also fails on unmodified dev); related unit tests; UI typecheck; rustfmt check of view_menu.rs. Independent review approved after the active-marker fix.
test(status): find the Tokens trigger when its summary is shown
Since #1037 a collapsed Tokens section keeps its compact input/output/cost summary in the disclosure trigger, so the trigger's accessible name becomes "Tokens Input: …". The status-panel test still looked for a button named exactly "Tokens", so its second click (re-expanding after a collapse) timed out and the browser suite failed on every PR.
The test now matches the trigger by its leading "Tokens" label, which also excludes the neighbouring "Token usage…" info button, and asserts that the collapsed summary appears, covering the behavior #1037 introduced.
Validation: reproduced the timeout on unmodified dev locally (and in CI on unrelated PRs); status-panel.test.ts now passes 3/3.
Align root/workspace manifests and lock entries, Tauri configuration and Cargo versions for the 1.0.0 stable and preview family. Require a 1.0.0 server for the separately published remote UI while retaining every third-party dependency and the existing local remote-tunnel link.
Check committed manifest/lock consistency and stable/prerelease offline workspace installation. OpenCode dependencies, minimum and recommendation remain at 2.1.0; 2.1.1 qualification is deferred by explicit user request.
The user explicitly authorized administrator merge and subsequent dev prerelease dispatch. This does not merge #1028 into main or publish a stable release.
## Cause
Remaining recurring-day CI failures observe a coordinator before its
awaited admission/error publication. The fixture clock advance
previously waited four timer ticks, not a completed clock turn.
Production recurrence correctly awaits those operations.
## Fix
Track each Job's own live sleep or terminal exit and await bounded
quiescence on each wake. Stale race sleepers no longer mask active work.
Existing five-second deadline and parked model/Form semantics retained;
no production recurrence changes.
## Evidence
Held-admission success/refusal regressions fail with original advance
and pass fixed. Four fixture callers36/36; recurring-day with
controlled25ms and75ms admission delays25/25 each; clock units7/7;
server typecheck and diff check pass. No assertion
weakening/skips/timeout increases. Full server CI not rerun locally. All
fixtures isolated; no shared daemon/user DB.
Oversized touched source: recurring-day-fixture.ts ~560 lines; test452
lines.
Transcript presets are now Nothing, Minimal, Balanced and Everything. Nothing hides every message-content row, including all registered, historical and unknown tools, thinking, diagnostics, tool inputs, tokens and system messages. Detailed is retired: saved Detailed choices load as Custom with Detailed's effective tool column (only read, skill and invalid collapsed, other tools expanded) and the same legacy thinking fallback, so existing transcripts keep their appearance.
The Message content popup gains a native select under its title with the four presets. A disabled Custom entry appears only after a manual row change, and the saved preference always drives the shown value, so refused or failed saves never leave a stale choice. Escape closes an open list before the popup. Preset recognition and patches move from Chat settings into the shared transcript-visibility module used by both surfaces; the tool-output command reuses the shared Other-tools resolution.
Preset names and descriptions were English in most locales; they are now translated in all ten, along with the accent-less French, German and Spanish card strings. The public help lists the new localized presets.
Validation: new transcript-presets browser test (popup order, choices, Custom after a manual change, pointer choice keeps the popup, Escape order, French labels) plus existing status-tokens tests; unit tests for preset round-trips, Nothing visibility and the Detailed migration; behavior-registry tests; help test; key parity across locales; UI typecheck with the pinned 2.1.0 client. Independent review approved with no P0-P2 findings; its two trivial P3 notes were applied.
## Summary
Replace the renderer-only workspace-ID cache with bounded validated
display snapshots in backend-owned state.ui.serviceUsage. Cache survives
recreated renderer/backend/workspace identity, keyed by authenticated
service/discovery/execution-host/folder fingerprint and period/timezone.
Eight entries, 1 MiB maximum; no plaintext credentials or paths.
Preferences does not write the opener's client-state journal.
Show previous totals/charts immediately with a cached-state label while
revalidating; preserve them on error. Hidden/unmounted Stats starts no
reads, cancels trailing work and fences late results. Visibility resumes
one read; execution hints use the existing activity cooldown instead of
one native scan per descendant. Manual refresh, period, reconnect and
deletion/pruning paths retained.
## Validation
- Rebased on current dev 7a2ee897e, retaining #1037 shared fixture
cache/shutdown and token UI plus #1039 launcher changes.
- Server/UI typechecks pass; cache/scheduler units 8/8; browser
service-usage 5/5, usage-metrics 4/4, status-tokens 4/4, sequentially.
- Real renderer AND backend recreation with a two-second stats delay:
2098 ms cold / 68 ms restored, then fresh totals replace cached values.
- Hidden-start regression: base makes one unwanted read; fixed makes
zero. Tests cover hidden events, visibility, burst scheduling, identity
changes, retention/errors and malformed cache bounds.
- Isolated native fixture with four synthetic sessions passes; repeated
native reads ~15–19 ms. OpenCode still repeats aggregation; no claim to
optimize large-history scans.
- No app/shared daemon/user data touched. Live installed app and
non-Windows native acceptance not tested.
## Oversized touched files
http-server.ts ~2446 lines; api-client.ts ~817; 10 locale settings.ts
files ~735–749. No unrelated refactor.
## Cause and correction
Native pruning CI timeout on all three OSes was a fixture mismatch:
visible per-step token usage splits technical groups, but the journey
still expected the second cross-message prune request. It reproduces on
BOTH OpenCode 2.1.0 and 2.1.1.
Assert the visible grouping boundary, then explicitly hide message usage
before testing cross-message cleanup. Use immutable config fixture
responses so Solid updates. Add SSE/HTTP replay-metadata parity
assertions to the existing native fixture.
## Validation
- Base native UI journeys timeout on 2.1.0 and 2.1.1; corrected complete
journeys pass both (completed:true).
- UI tests 97/97; server pruning/broker tests 21/21; UI/server
typechecks and diff check pass.
- Local Windows only; Linux/macOS CI acceptance still pending.
- The two reported metadata unit failures are from stale local client
2.0.27; they reproduce with that dependency and pass unchanged with
lockfile client 2.1.0. No metadata or contract workaround introduced.
- No production code, guard, timeout, dependency pin or shared
app/daemon/state changed.
Largest changed file ~428 lines.
Use the existing primary selector treatment for OpenCode install/update and the post-update service restart, the Info page update/install or download action, and Remote Control start/pairing-link actions. Sharing OpenCodeSetupPanel applies the same emphasis to required-update startup recovery. Colors continue to come from the selected theme accent and on-accent text tokens.
Make Remote Control header refresh an icon-only window button. Keep its localized accessible label and tooltip, disabled behavior and loading spinner. No action handlers or update/restart admission logic change; AGENTS.md records the action hierarchy.
Validation: 64 existing browser tests pass across opencode-setup, remote-control-settings, desktop-updates and server-info. An isolated visual check rendered the real components in French on the Classic dark palette, verified accent/text colors and square corners, and captured settings/startup update and restart states, both Info update surfaces and wide/narrow Remote Control. UI typecheck passes against the pinned 2.1.0 client declarations; git diff --check passes.
## Summary
This PR removes OpenCode compatibility code that nothing can reach any
more:
- Code that was already dead at the former 2.0.27 minimum, and is still
dead at the current 2.1.0 minimum (#1029).
- Handlers for events and data shapes that OpenCode V2 never produces.
Each item was checked against the upstream 2.0.27 and 2.1.0 sources
before removal.
Kept on purpose:
- Workarounds for upstream bugs or limits that are still present in
2.1.0.
- Code that reads conversations written by older runtimes: V1-migrated
tool names and metadata, `workspaceID` data, task summary titles,
`session-legacy` replay.
- Code that recognises and upgrades old CLIs and live older daemons: 1.x
replacement, beta recognition, 2.0.11 service discovery, 2.0.15 native
upgrade, `/api/status` and `/api/health` identification.
## Removed or changed
**Server**
- Negotiation: one "not modern → `canonical_api`" rule replaces the
pre-2.0.4 legacy schema recognition, and runs before #1029's
`native_contract` check.
- The transport no longer rewrites `/api/status`.
- Desktop skills no longer send the pre-2.0.4 `location` and `slash`
fields.
- The legacy `auth.json` usage fallback for daemons without
`credential.list` (pre-2.0.20) is removed, along with its UI reason and
the i18n key in 10 locales. A missing endpoint still fails safely.
- Workspace selectors are rejected up front, without a native resolution
request.
- CLI service probes try `/api/info` first. An admitted daemon no longer
costs two authenticated 404s on every check.
**UI**
- Remaining V1 `session.idle`/`session.status` branches: Missions store,
pending discovery (UI and server), `eventAffectsMessages`.
- `server.instance.disposed` and the now-unused `rehydrateInstance`.
- The V1 `worktree.ready` envelope (the handler now reads the V2 shape).
- V1 tool-state titles and the `success` status alias.
- Part `time.start` and `time.end`.
- Text stored as objects or segment arrays.
- `deriveMessageStatus`.
- The V1 `error.data.message` shape.
- `projectID` and `location` fallbacks on `session.created`.
- The replay-only `session.message.content.updated`.
- The unreachable `output.answers` fallback.
**Fixtures, Missions and docs**
- Legacy branches removed from the location, fork, families, pruning and
automation native fixtures. The WSL setup fixture now compares against
the reported version instead of 2.0.11.
- Unused 2.0.21 launch helpers removed.
- The Missions native and trajectory fixtures also run on the minimum
lane.
- The capability proof checks the reported version.
- Stale 2.0.2x labels now say "as of the 2.1.0 minimum".
**Follow-ups from the #1029 post-merge review**
- Test fixtures no longer send the ignored `recent: ""` compaction field
(18 sites).
- The manual compaction-isolation fixture accepts any published version
at or above the minimum.
- `CONTRIBUTING.md` wording updated.
114 files, +319 / −1117: source +90 / −487, tests/fixtures/CI +214 /
−604, i18n −10, docs +15 / −16.
## Validation (rebased on dev with #1029)
**Typechecks:** server and UI pass.
**Server tests**
- Touched areas: 480/480.
- Full server CI step: 2430 pass, 0 fail, 7 skipped, 1 cancelled. The
cancelled test is the `index.test.ts` real-process shutdown test; it hit
its 5 s timeout under load. It passes alone (4/4), and that file is
unchanged versus dev.
**UI unit tests**
- Touched files: 230/230.
- CI steps: 574/574, 200/200 and 519/519.
**Browser suites**, one at a time:
- Provider and service usage: provider-usage 13/13, service-usage 3/3.
- Missions: mission-visibility 3/3, mission-control-feedback 5/5,
mission-lifecycle-revision 10/10, mission-lifecycle-navigation 10/10,
mission-current-passage 1/1, mission-native-family 11/11.
- Transcript and rendering: compaction-responsiveness 5/5,
session-rendering 47/47, reasoning-collapse 3/3, render-cost 17/17,
tool-images 4/4, system-messages 10/10.
- Other: search-highlight 11 pass (1 skipped by its env gate),
panel-extensions 13/13.
**Native fixtures on an isolated 2.1.0 CLI:** location, session-fork,
automation, session-pruning, missions native, missions trajectory,
provider-usage, Missions capability proof and compaction-isolation all
pass. The WSL setup fixture was not run (it needs a WSL distro with a
Linux CLI).
## Left for later
- `RuntimeIdentity.discovery` is now write-only.
- `ownsLocation` has an unused `_client` parameter (about 30 callers).
- A test-only V1 translation in `auto-accept-manager.test.ts`.
- Out of scope: HTML-entity decoding (a product decision), the
`MutableHashMap` loop, the pruning-UI import-order workaround, unused
log-based Missions readers, and the unshipped managed-owner module with
its 2.0.24-pinned test.
Oversized source files touched: `stores/instances.ts` ~2,209,
`message-block.tsx` ~1,601, `workspaces/manager.ts` ~1,104,
`tool-call.css` ~1,047, `tool-call.tsx` ~865, `opencode-data.ts` ~865,
`api-types.ts` ~784, `session-events.ts` ~606,
`recurring-day-fixture.ts` ~535.
## Summary
Remove the three bottom actions (Servers, SideCar, Full home) from the
project-tab plus launcher. Also remove its server disclosure, profile
hook/loading, local expansion state, server actions/dialog binding,
unused props/icons/CSS and four keys in all locales. This is not just
hidden chrome.
Recent search/list, Browse, Temporary and Clone remain. A normal plus
click still opens home. All long-press/context/keyboard gestures and
Escape focus remain. Home keeps remote server and SideCar functionality;
shared server setup is mounted only for its caller.
## Validation
UI typecheck passed. Real new-instance-launcher browser suite 8/8:
retained actions/gestures/focus, no server requests from launcher even
with saved profiles, home remote/SideCar controls retained.
Desktop/narrow captures inspected. git diff --check passed. No
app/daemon/state touched.
## Scope
48 files (+110/-190), largely 10-locale help and removed translations.
App.tsx remains oversized (~915 lines); only obsolete launcher props
changed.
## User-visible behavior
- Message token usage hidden in Minimal/Balanced/Detailed; shown in
Everything/Complet. Factory defaults and absent-value command fallbacks
aligned, explicit saved choices retained.
- Status Tokens independent of transcript usage preferences. Collapsed
header: session input/output/cost, one line with ellipsis on narrow
widths. Expanded: session metrics then descendant-inclusive totals in
two groups, no metrics duplicated in header.
- Message Tokens follows the same disclosure pattern: input/output/cost
in collapsed header; six existing metrics only in expanded body; hidden
renders nothing.
- Full-value accessible names/titles, keyboard, narrow/RTL and
subscription Included behavior retained.
## Implementation
Focused status collapsedSummary slot, shared metric rendering, scoped
token CSS. Existing usage styles moved out of message-base.css; shared
product fixture now owns an optimizer cache and drained shutdown.
## Validation
- UI typecheck passed; 39 targeted UI units and 3 server schema tests
passed.
- Browser status-tokens 4/4 and usage-metrics 4/4, individually, real
components/native stores.
- Desktop/narrow/RTL collapsed and expanded captures inspected.
- git diff --check passed.
- No installed-app/shared-daemon/user-storage changes; no Stats refresh
or notification changes.
## Oversized touched files
preferences.tsx ~1591 lines; behavior-registry.ts ~514; message-base.css
~615. No unrelated refactor.
Follow-up to #1036: beforeEach is typed TestContext | SuiteContext, so
context.mock failed typechecking. Use node:test's module mock tracker
with explicit restoration in finally. Same fixture network block and
assertions; no product changes. UI typecheck and all 11
lifecycle/routing tests pass with current 2.1 dependencies.
## Summary
Test-only follow-up to #1035: the lifecycle delivery tests must
explicitly enable history instead of relying on the old default. Add a
real-event regression for default-off history, retain the once-per-run
and suppression assertions, block fixture network access, and restore
in-memory settings/mocks after each test.
## Validation
- Node 24 targeted lifecycle and routing tests: 11/11.
- Exact ownership CI list: 519/521. The two replay metadata failures
reproduce on unchanged tests at opencode-data.test.ts:339 and
session-pruning-projection.test.ts:116; not fixed or hidden by this
test-only PR.
- No production or dependency changes, no access to shared
app/daemon/storage.
- git diff --check passes.
## Summary
- Default History off for both needs-input and session-finished
notifications. Other session events already default to History off.
- Session states can become stale after an answer or a resumed V2 run;
they should not accumulate in the bell history by default.
- Preserve saved explicit routing, screen/system settings, and the
existing mandatory error visibility. No migration or deletion of
existing history.
- No changes to tokens, statistics, update notices or notification
timing.
## Validation
- Two routing regressions fail before the change; all 5 routing tests
pass after it.
- Covers absent/partial settings, all three session categories, explicit
history opt-ins, legacy system settings and error overrides.
- git diff --check passes.
## Scope
Two small files only; no dependencies or styling changes.
Adopt the OpenCode 2.1 native replay and compaction contracts, align client/plugin pins and set minimum and recommended runtime to 2.1.0. Preserve authenticated contract recognition for future/custom runtimes and explicit installation/restart boundaries.
Preserve historical conversations through official projection-based pruning revisions and independently checked migrations from 2.0.3, beta-19271 and 2.0.32. Retain ownership, execution claims, stale-selection checks and transaction fences. Update setup, help and qualification evidence.
Isolated Windows native qualification and integration checks cover pruning UI, historical reimport, Compare/Wayfinder, recurring Missions, builds and typechecks. Document broad-suite limitations and outstanding platform/package/mobile acceptance; this merge does not publish CodeNomad 1.0.0.
## What changes for the user
Four things that silently stopped working with OpenCode V2 work again:
- **"A session finished" notifications** arrive again. A successful or
failed run notifies. A run you stopped yourself does not.
- **Provider retries** show the retrying status and the countdown toast
again.
- **Usage statistics** refresh after each run.
- **The token usage line** under assistant replies (preference,
transcript filter row and hotkey) shows each settled reply's tokens and
cost again.
Per-session transcript reducers are also released again once a run has
settled.
## Why
OpenCode V2 declares `session.idle` and `session.status` in its schema,
but core never publishes them. Runs end with
`session.execution.{succeeded,failed,interrupted}`, and retries arrive
as `session.retry.scheduled`. These features were still keyed only to
the V1 events.
The token usage line had a second problem: it was drawn from V1
`step-finish` parts, which V2 never produces. V2 stores tokens and cost
on each assistant message instead.
A new isolated native fixture,
`scripts/test-session-lifecycle-native.mjs`, confirms this on CLI 2.1.0.
It uses its own storage, port and fake provider, and never the shared
service. In its complete, retry, fail and interrupt scenarios, it sees
no `session.idle` or `session.status` event. Upstream 2.0.27 sources
show the same: these events are declared but never published.
## How
- **Finish notification:** sent from the V2 terminal path after
`session.active` confirms the run ended.
- Succeeded and failed runs notify.
- User and shutdown interrupts stay silent; idle-timeout interrupts
notify.
- Subsessions and unknown sessions stay silent.
- A stray `session.idle` cannot cause a duplicate.
- **Retry:** `session.retry.scheduled` sets the retry state and the
transient toast. The next attempt or the end of the run clears them.
- **Run-end detection:** a shared `lib/native-execution-events.ts`
drives the usage refresh and reducer retirement.
- **Reducer retirement:** it also waits for queued prompts, so prompts
left in the inbox after an interrupt stay listed.
- **Usage line:** moves to `components/message-usage.tsx` with the
existing classes.
- **Removed:**
- the dead V1 `StepCard`, its step-part types and CSS;
- the V1 `session.idle`/`session.status` handlers.
- **AGENTS.md:** one bullet so future features wire to V2 lifecycle
events.
Left for the follow-up cleanup PR: the remaining dead `session.idle`
fallbacks in pending discovery, Missions triggers and test fixtures.
## Validation
New tests that fail on unmodified dev and pass here:
| Suite | dev | this PR |
|---|---|---|
| lifecycle unit | 3/4 fail | 4/4 |
| retirement | 8/9 fail | 9/9 |
| browser `usage-metrics` | 3/3 fail | 3/3 |
| browser `service-usage` | 2/3 fail | 3/3 |
- UI typecheck is clean.
- **Passing unit suites:**
- opencode-data-idle 9, runtime-contract 4, session-native-events 8,
message-part-grouping 6
- opencode-transcript-replay 17, opencode-compaction 11,
session-pruning-projection 2, session-pruning-pagination 6
- session-request-authority 77, opencode-data 30, message-timeline-v2 2,
transcript-visibility 8
- missions 1, instances-pending-compaction 7
- **Passing browser suite:** `system-messages` 10/10.
- The native lifecycle capture passes.
Oversized files touched:
| File | Lines |
|---|---|
| `message-block.tsx` | ~1,760 (down ~240) |
| `message-section.tsx` | ~1,630 |
| `opencode-data.ts` | ~905 |
| `session-events.ts` | ~670 |
| `message-timeline.tsx` | ~645 |
| `message-base.css` | ~675 |
| `session-request-authority.test.ts` | ~2,400 |
| `opencode-data.test.ts` | ~1,215 |
## Summary
Adds a fifth Mission template, **Compare two models** (`compare`). It
runs the same bounded task on two different models and ends with a blind
verdict.
- **Creation:** the user picks **model A** and **model B** in the main
creation form. Both are required and must name different models
(provider + model id; a reasoning variant alone is not a different
model). This is enforced on every creation path: HTTP, prepare,
recurrence create and agent-started missions.
- **Roles:** `model-a`, `model-b` and `comparator`.
- A and B share one instruction text and report contract.
- The coordinator writes the task, inputs and criteria once, and gives
both byte-identical briefs.
- The server refuses a run task whose brief differs from its sibling's,
or whose per-task execution would change its role's model.
- **Blind judge, always on:** the comparator works on neutral X/Y
labels.
- It reports one versioned `comparison` artifact: the A/B task
references, per-criterion scores for both runs, sourced observations,
and a verdict `a | b | equivalent | inconclusive`.
- Completion requires both runs and that comparison.
- **Judge model:** frozen once at creation, like every other role.
- An explicit judge is kept; otherwise the judge copies the
coordinator's effective model. When that model is unknown, both stay on
the native default.
- Replays and retries therefore reuse the stored profile.
- The editor warns when the judge's model equals A or B.
- **Readers:** the verdict, both model names, a score table and evidence
by path. Hashes stay under Technical details, for current and archived
recurring passages.
The template came out of evaluating Harness2's comparison loop. It
deliberately has **no** lesson, human approval, budget or duration
handling, and leaves the Wayfinder human gate unchanged. Up to five
models, per-run worktrees and launching from the composer's model picker
(OpenChamber-style multi-run) are left for later.
`AGENTS.md` records the single editor exception: the A/B selectors sit
outside the collapsed Options disclosure. All ten locales are updated.
## Size and upkeep
62 files, +837/-96:
| Part | Lines |
|---|---|
| Product code (about 16 files are one-line template-list hooks) |
+280/-57 |
| Locales (13 keys × 10) | +131 |
| Tests | +409 |
| Docs | +17 |
`missions/control.ts` stays oversized (~1,500 lines).
## Validation
- Full server suite: 2,426 tests pass, 7 existing skips. Root and server
typechecks, the server build and the plugin build pass.
- UI: 45 unit tests and 36 browser tests pass.
- The native trajectory fixture, extended with a compare case, passes on
OpenCode 2.0.31. It checks two distinct models, a one-newline brief
difference refused with the journal unchanged, a real blind judgment and
a completed mission. The native contract and recurring Q fixtures also
pass.
- Regressions cover:
- distinct-model refusals on every creation path;
- brief and override refusals;
- artifact validation and the completion policy;
- judge freezing at creation, revision replay, and retry after a
coordinator model change;
- editor inheritance and readable evidence.
- Independent review rounds ended with no P0-P3 findings.
- The editor and reader were checked from screenshots of the real Solid
components in the browser harness, not in a packaged app.
After a send, desktop focus deliberately moves to the conversation stream so the transcript can be read with the keyboard, and touch-only devices keep the virtual keyboard closed. The global type-to-focus listener treated that focusable scroller as an ordinary control, so typing after a send did nothing until the composer was clicked or Ctrl+P pressed (#1031).
The decision now lives in prompt-input/type-to-focus.ts. The exact conversation stream of the composer's own session view is a reading surface: arrows, paging, Home/End and Space keep scrolling it, while a printable character (Shift allowed) focuses the composer during keydown so the browser inserts it once. Fields, controls, nested focusable scrollers, IME composition and plain-key shortcuts keep their keys. Ctrl/Alt/Meta chords, including AltGr and macOS Option characters, intentionally never reactivate the composer, so a shortcut cannot re-enter the prompt; missing such a character after a send is accepted. No preference, delayed refocus timer or mobile keyboard reopening.
Validation: unit coverage for the decision rules and a real SessionView browser regression (send, reading keys, resuming with the first character, focused controls) that fails without the fix; existing composer draft/IME, picker, aside, device upload and copy-focus browser tests pass; UI typecheck baseline unchanged. Gatekeeper review reported one P3 (AltGr), waived by the maintainer as intended behaviour. Native CI jobs failing against today's OpenCode 2.1.0 release are unrelated.
Closes#1031.
Fix Workspace listings that stayed stale until manual refresh or F5. Reproduced
the issue in the attached Tauri application: a host-created file was absent
until the panel's Refresh button reread it. OpenCode filesystem events were
the only invalidation source, not a subscription to every browsed directory.
Observe authorized listed directories on the host through bounded,
non-recursive native watches, registered before listing. Preserve physical
containment, inode and workspace-lifetime checks and close watches on removal
or shutdown. Forward actual directory observations through the existing SSE
event bus, without inventing native OpenCode events or adding polling,
recursive scans or an independent service.
Coalesce passive cache invalidations before readers wake: a short isolated-
change delay, then at most one publication every five seconds during sustained
activity, as requested. Only pending observations create a timer. Explicit
mutation/recovery invalidations remain immediate. Scope tree versions by
browsing root and listed directory, so only stale visible directories reread;
other worktrees, unchanged siblings and hidden/collapsed folders do not scan.
Retain existing read budgets, cache-first rows and coalesced in-flight demand.
Keep logical listing aliases separate from physical watch targets, so every
internal junction/symlink subscriber receives its own cache invalidation.
Directory listings include an opaque device/inode identity: when a parent
detects removal or replacement, discard only that child's cached subtree,
cancel its old reads and reload still-expanded paths to bind new observations.
Ordinary mtime changes never force a subtree scan.
Validation covers real filesystem create/edit/rename/unlink, ownership,
replacement, aliases, watcher budgets/disposal, continuous cache bursts and
immediate explicit mutations. A real Chromium regression exercises the whole
filesystem-to-watch-to-SSE-to-Workspace path without F5, including parent-only
replacement and multiple junction aliases. Existing Files/Git browser checks,
the full server suite and targeted UI checks pass; typecheck diagnostics remain
at baseline. No installed application or shared OpenCode daemon was replaced
or restarted.
Final server validation: 2,415 tests pass, seven existing skips. Two independent
gatekeeper rounds; the final review reports zero actionable P0-P3 findings at
728bf59861d063863c6bb3351d5ce0a030ce6866. The hosted CI is still running at merge.
Closes#1027.
## Summary
#1023 fixed one-time Wayfinder decisions with about 85 lines of product
code but 410 lines of tests. Its 248-line native script re-implemented
the daemon, bridge and workspace setup that
`test-missions-native-trajectory.mjs` already has.
`native-invocation.test.ts` also carried overlapping cases.
- The decision journey is now one case of the trajectory fixture,
reusing its private daemon, shipped plugin, bridge, workspace and real
subagents. The case covers:
- refusal before an answer, with no journal mutation;
- a native child question answered through the authenticated UI route;
- completion by discovery without a supplied artifact.
- `scripts/test-missions-wayfinder-decision-native.mjs` is deleted.
- `native-invocation.test.ts` (162 to 90 lines) keeps one test per
distinct behaviour:
- concurrent isolation and stale invocations;
- exact `Exit.fail`/`Exit.die` preservation;
- interruption joining a raw read that ignores abort, through the real
`acquireNativeHumanAnswers` adapter;
- the per-check deadline between two successful checks and after an
expired one.
- No product code changes. Net -260 lines.
## Validation
- With the pre-#1023 `managed-owner-plugin.ts` substituted in memory,
the trajectory case fails after the UI reply with `Native human answer
graph unavailable`. Restored, all 9 checks pass on OpenCode 2.0.31.
- Detaching reads from the runner, or converting errors to defects,
makes the unit tests fail.
- The full server suite passes (2,410 tests, 7 existing skips), as do
the server typecheck, the plugin build and bundle test, and the native
contract fixture.
- An independent review ended with no P0-P3 findings.
## Summary
A one-time Wayfinder mission could never complete a decision task. The
decision child asks its native question, the human answers it in
CodeNomad (authenticated UI reply, durable mark confirmed `via: "ui"`),
and the coordinator's decision report is still refused with `Native
human answer graph unavailable`.
The one-time human gate is built in `managed-owner-plugin.ts` from the
plugin setup graph. That graph lacks the Location, Form and Database
services that `acquireNativeHumanAnswers` requires. Recurring passages
build their own gate in the Job's Location graph
(`native-recurrence-due.ts`), so they were not affected. This is why the
recurring Wayfinder journey (Q) kept passing while the one-time path was
broken.
## Fix
- `native-invocation.ts` captures each invoking native graph with
`AsyncLocalStorage` around the plugin's tool executes and forwarded
Missions RPC handlers. The one-time gate runs its reads in that graph.
- Concurrent invocations stay isolated. A missing or finished invocation
is refused, never served by another invocation's graph or the setup
graph.
- Each complete human check gets its own 10 s budget, the bound
`native-human-evidence.ts` already uses. Its nested SQL/Form/storage
reads share that budget, which is not reset per query.
- Interruption or expiry aborts those reads. The borrowed graph is
released only after every started read has settled. A truly
non-interruptible native finalizer must still finish first; this is
documented.
- Expiry surfaces as an ordinary refusal.
- Recurring runners are unchanged.
## Validation
- New native fixture
`scripts/test-missions-wayfinder-decision-native.mjs`. It drives the
shipped plugin on a private daemon with a synthetic provider: a real
child asks a native question, and the reply goes through the
authenticated UI route.
- Before the answer, the decision report is refused with no journal
mutation.
- After it, the decision completes by discovery, without a supplied
artifact.
- On unmodified `dev` it fails with the error above; with this change it
passes (OpenCode 2.0.31).
- Unit regressions in `native-invocation.test.ts` use the real
`acquireNativeHumanAnswers`. They cover invocation isolation, missing or
stale invocations, Effect errors, interrupted and blocked reads, and
successive checks separated by slow work. Each new regression fails on
the earlier code.
- The full server suite passes (2,413 tests, 7 existing skips), as do
typechecks, the plugin build and bundle test, and the native
`test-missions-native`, contract, trajectory, family-control and
recurring Q fixtures. After rebasing onto #1022 (UI preferences only),
the server typecheck and the 34 targeted human-answer tests pass again.
- An independent review loop ended with no P0-P3 findings.
Native Preferences can reopen with a backend workspace ID saved before restart. Those IDs are ephemeral, so Providers and Web search were reading an obsolete proxy and remaining in an error state even after the project restored. Resolve the project through the existing metadata-only inventory and wait for its ready event before reading project settings.
Prefer the exact record while it exists; otherwise choose only one unambiguous exact-folder match. Persist the opened backend-host workspacePath separately from the selected native directory so WSL and worktree requests retain their execution-host Location. Both Electron and Tauri accept and store the optional field. Legacy requests without it retain the conservative exact-directory fallback; no path translation or ancestor is guessed.
Reads follow visible section demand, matching lifecycle events and reconnects, without polling or hydrating other workspaces. Record deletion tombstones before candidates are known, revalidate ambiguity after deletion, and fence stale responses and newer explicit Preferences requests. Rebinding uses the existing persistence queue and preserves scrolling performed while the native write is pending.
Validation: 28 browser tests across startup restoration, Preferences lifetime/opener state, Web search and the native Missions entry point; 44 TypeScript request-contract and Electron client-state tests; UI typecheck and diff check. New startup regressions cover both hosts, delayed readiness, obsolete IDs, unresolved deletion, ambiguous folders, WSL paths, reconnects and newer view intent. Tauri validation and persistence tests cover the updated request contract. Independent review approved the follow-up after its deletion, WSL and scroll findings were addressed.
CI also exposed an existing Markdown completion stopwatch failure (178 ms versus 150 ms). A test-only follow-up verifies immediate warm parser dispatch before timers instead of measuring highlighting/observation latency, then checks exactly one final parse and highlighted final text. All 11 tests pass and a deliberate 200 ms dispatch-delay mutation fails; production Markdown remains unchanged.
Unify application-window and session-preview automation on the same server-side
page engine. BrowserPage serializes per-session operations, binds refs to the
exact native guest/document generation, fences cancelled and late results and
always attempts exact lease cleanup. Both tools share page-action validation
and budgeted, scoped plain-text outlines, without arbitrary model evaluation.
Replace Electron and Windows Tauri snapshot/ref/click/type implementations
with the private browser.page.begin/send/check/end channel. Native hosts keep
guest ownership, visibility, URL policy, storage, history, emulation, navigation
and screenshots. Bounded operation leases and fixed protocol allowlists check
identity before native effects and after IO; hidden, ambiguous, replaced,
navigated or expired targets refuse rather than selecting another guest.
Cleanup never detaches another owner's persistent emulation overrides. No
renderer IPC, guest capabilities or legacy page-action fallback is added.
Electron uses WebContents.insertText and sendInputEvent for embedded guest
text and keyboard input: direct CDP input can report success while silently
dropping it before the first pointer click. Preserve key modifiers and text
events without showing or raising a window. ContextMenu is explicitly refused
with Shift+F10 guidance rather than emitted as an unknown native key.
Validation includes native ownership/expiry/deadline/concurrency regressions,
20 Rust browser-controller checks and cargo check --tests, 24 Electron
controller tests, full server validation and isolated OpenCode 2.0.31 plugin
and bundle checks. The real hidden-window Electron integration drives both
production ends through replacing type, select, printable keys, Ctrl+A and
Backspace, Tab, Enter, pointer clicks, waits, scoped snapshots, hidden targets
and stale refs after navigation. Three independent gatekeeper rounds reached
zero actionable P0-P3 findings; subsequent parent-only rebases preserve the
identical reviewed patch.
At merge, the CI tests job failed only an unchanged client-state process
timing assertion (661 ms against a 500 ms ceiling). Its isolated regression
passes, including the affected live-registration case in about 47 ms; native
platform and compatibility jobs passed. No installed app or shared OpenCode
daemon was changed or restarted.
Refs #1008.
Complete application-window interaction on the shared page engine introduced
by #1015, while preserving native window/run and document-scoped ref authority.
Add real pointer clicks, hover, stepped pointer dragging, wheel scrolling,
keyboard chords and bounded text waits. Flat tool commands are validated at
both bridge boundaries. Clicks refuse covered targets; press(ref) refuses a
target that cannot acquire focus, so Enter never reaches an unrelated draft.
Drag requires both ends visible instead of scrolling under a measured source.
Preferences remains outside automation; focusing Preferences or a remote
window falls back to the most recently used local application window.
Trusted native input carries monotonic provenance intervals. Human Form
decisions check the originating event timestamp, not the time a stalled
renderer handles it; delayed keys and their implicit submit clicks remain
automated after lease expiry. Fixed page functions keep their depth marker.
Native events use the page's epoch clock, and cleanup preserves the original
press timestamp, independently of configured command timeouts.
Failed sequences best-effort release held buttons and keys, including when
the cleanup mark write itself times out. An admitted input timeout is reported
as an unknown outcome with inspection-before-retry guidance: the renderer may
deliver the input or finish the click later. Never replay these inputs.
Validation covers the actual Mission editor and InterruptionDock in isolated
Chromium, including a 16-second renderer freeze and a control human click.
Targeted server tests cover key mapping, both bridge parsers, focus/target
fences, failure cleanup and late input outcomes. Full server validation,
isolated OpenCode 2.0.31 automation, bundle regression and Tauri compilation
also pass; typecheck diagnostics remain at baseline. No installed application
or shared daemon was changed or restarted.
Four independent gatekeeper passes; the final review reports zero actionable
P0-P3 findings at 0ffb5a53b425500336854902c7068cd2233695f4.
Refs #1008.
