mirror of
https://github.com/NeuralNomadsAI/CodeNomad.git
synced 2026-11-01 03:20:37 +00:00
306 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
heunghingwan
|
0d6629c129
|
fix(transcript): keep streaming live across shared-stream reconnects (#1088)
fix(transcript): keep streaming live across shared-stream reconnects
## Problem
Long model reasoning streams stop updating the transcript roughly 30
seconds in: the visible thinking text freezes, and the display only
catches up when the thinking phase ends. Shorter streams never freeze.
A diagnostic reproduction against the real SDK/dispatcher pinned the
freeze exactly: after a mid-stream `server.connected`, ten live
reasoning deltas left the store text frozen at its pre-reconnect value
and **zero** `message.list` reads were even attempted — even
`session.reasoning.ended` and the execution terminal events could not
recover it.
## Root causes
1. **~30 s trigger** — after `CONNECTION_RECHECK_INTERVAL_MS`, any
request through the shared OpenCode service re-runs discovery; a failed
or changed probe (a busy daemon is slow to answer) invalidates the
healthy connection. The shared event stream tears down and resubscribes,
and every subscription starts with `server.connected`.
2. **Reset mid-stream** — the UI treated `server.connected` as a full
data reset (`destroyOpenCodeData`). The fresh reducer starts empty:
reasoning deltas no-op (`editReasoning` cannot find the message) and
nothing repopulates the projection until a later `session.step.started`
inserts the assistant row again.
3. **Starving recovery** — repopulation requires one `message.list` read
to return with an unchanged event revision; each arriving delta restarts
the read (the guard that never merges an obsolete page into newer
streaming messages). During continuous streaming that read cannot
complete, so any reconciliation starves until the stream pauses.
## Changes
- `stores/opencode-data.ts`: `server.connected` now runs
`reconnectOpenCodeData` instead of a bare destroy. A shared-stream
reconnect is transport recovery, not a data reset:
- The reset semantics are kept (generation fences, observer rebinding,
REST state untouched) — every existing reconnect test passes unchanged.
- Before the reset, each live session's last projected page is captured
and seeded into the fresh reducer through the existing `syncMessages`
snapshot mechanism, so post-reconnect deltas keep applying and the
display keeps streaming.
- One trailing reconciliation is scheduled per session (new non-dropping
`reconnectResync` mode): it fetches only after the stream stays quiet
for 1 s with a stable revision, then swaps in the authoritative page to
repair anything the disconnect window missed. It never drops events and
defers to dropping-mode recovery when an overflow collapse or pruning
takes over.
- `stores/opencode-data-reconnect.test.ts` (new, in the CI unit list):
three regressions — the revision-race read invariant (obsolete pages
never merge), dropping-mode admission (frozen until the stream pauses),
and reconnect continuity (deltas keep displaying; the quiet snapshot
republishes).
## Behavior compatibility
Suites covering reconnect semantics (projection reset, inbox observer
rebinding, compaction reconnect fencing, replay fences, generation
recovery, request authority) pass without modification.
Dropping-mode resync semantics (overflow, pruning) are unchanged and now
pinned by a regression test.
`opencode-data.ts` is 978 lines after this change (over the ~800
target); splitting the reconnect path into its own module is a
reasonable follow-up.
## Pre-existing failures (not caused by this PR)
Four tests fail identically on a clean checkout (verified by stashing
this change and re-running): the pinned `@opencode/client` 2.1.0 /
event-manifest contracts drifted and the fixtures were not updated:
- `opencode-transcript-replay.test.ts` × 2:
`session.compaction.started`/`ended` fixtures no longer decode (the
manifest now requires `data.recent`); both integration tests die in
fixture construction before any assertion runs.
- `opencode-data.test.ts` ("preserves SDK step, snapshot, reasoning…"):
expects the old `native` field on reasoning parts; the 2.1 reducer maps
it to `state`.
- `session-pruning-projection.test.ts`: expects a provider
`reasoningField` mapping that the current contract no longer returns.
These are fixture/expectation updates against the pinned SDK, unrelated
to the streaming machinery; CI may already be red on them. They should
be repaired in a separate PR so this fix stays reviewable.
## Validation
- Red→green: the new reconnect regression fails on the pre-fix tree at
the frozen-store assertion (`'before '` vs `'before after0 after1 '`)
and passes with the fix.
- UI unit baseline (CI file list + new file): 552 tests, 548 pass, the
same 4 pre-existing failures before and after.
- `tsc --noEmit`: the same 4 pre-existing errors before and after.
- Browser: mission-control 24/24, provider-usage 13/13,
mission-task-reader 18/18, message-scroll 128/128. `part-durations`
page-load timeouts reproduce identically on a clean tree (Vite
cold-start environment issue).
|
||
Pascal André
|
1f0fc4fe9f
|
fix(worktrees): omit a checkout mid-removal instead of failing the whole inventory (#1089)
fix(worktrees): omit a checkout mid-removal instead of failing the whole inventory Removing a worktree with `git worktree remove` deletes its `.git` file first and the rest of the folder afterwards, which takes minutes when the checkout still holds `node_modules`. During that window the folder and its registration still exist, so the native inventory inspected the entry, `readCheckoutIdentity` hit ENOENT on `.git`, and the shared scan failed the entire inventory. Every ownership check depending on it failed too: conversations in other worktrees showed "Internal Server Error" for messages, timeline and permission receipts, and pending-request recovery reported every folder of the project as unverifiable, until the removal finished. The inventory now treats an entry whose Git layout no longer exists (missing `.git`, or a `.git` pointer whose administrative directory is gone after an interrupted removal) like a vanished folder: it is omitted and the other checkouts are listed normally. Any other identity failure keeps failing the inventory closed. A half-removed checkout is not a usable worktree, so conversations still placed there stay unowned until it is gone, while the rest of the project keeps working. Validation: a new isolated Git fixture registers healthy, mid-removal and orphaned worktrees, deleting the orphan's administrative directory during inspection (after Git's annotation snapshot) to cover that race. On the previous code it fails with `ENOENT: stat '<removing>/.git'`; with the fix the inventory lists only the root and the healthy checkout. The native custody, inventory, display fence, directory, session evacuation and event ownership suites pass (40/40), and the server typecheck is clean. |
||
|
Pascal André
|
1b97c7df8a
|
fix(transcript): jump between user messages with Alt+Up/Down, also from the composer (#1087)
Shift+Up/Down already selects text in every text field, so the user-message jump could not work from the composer, where people usually are. The defaults become Alt+Up/Down, and Cmd+Option+Up/Down on macOS, where Option+Up/Down moves to a paragraph's start or end in text fields. Neither edits text, so the jump now also works from the composer and other text fields, keeping the draft, its caret and focus; Shift+Up/Down selects text again everywhere. Saved custom bindings are unchanged. The key guard allows text fields and leaves modified arrows where they already mean something: code editors (Monaco moves lines) and terminals, arrow-key widgets, selects and popup triggers (Alt+Down opens them, such as the new-instance launcher), fields that move a list's active option (aria-activedescendant, input[aria-controls], such as the mission picker search), non-text inputs and IME composition. The composer's / and @ picker moves its selection with every arrow key, so its root carries data-prompt-picker and the jump yields while it is open. Platform defaults live in defaultHotkeyBindings, like prompt-alternate-send. The help shortcuts table (10 locales) and HOTKEYS.md describe the new defaults. Validation: unit tests for the platform defaults (no conflict on either platform) and the key guard; browser regressions jump with Alt from the conversation and the composer (draft, caret and focus kept; Shift+ArrowUp still selects), keep the key for an open composer picker, and, with a real MissionPicker for Alt and emulated-macOS Cmd+Option, move the picker search's option without moving the conversation (the guard checks fail without their selectors). hotkeys-settings and composer-picker-enter pass; UI own-tsconfig typecheck, root typecheck and test:help pass. Gatekeeper review (GPT-6.1 Sol): one P2 (mission picker search) fixed, then zero actionable findings at 7eb2cb081da4ebb1a04e5a7391322deaeb154dd4. Refs #1075 |
||
|
heunghingwan
|
c716f796d8
|
ui: keep the message token disclosure on one row in both states (#1084)
## Summary The token/cost line that closes every agent message previously turned into two rows when expanded: a bare `Tokens` label line (chevron + label) with the six metric chips on a second line below it. This PR keeps the disclosure on one row in both states — expanding swaps the collapsed summary chips for all six chips on the very same line as the chevron. ## Problem - Collapsed, the row is a compact single line: `› INPUT 3K · OUTPUT 54 · COST $0.76`. - Expanding it replaced that line with a label-only row (`› Tokens`) plus a separate chip row, so a one-line affordance grew to two rows and pushed the transcript content down twice as much. ## Change - **Expanded = same row.** The six chips (input, output, reasoning, cache read, cache write, cost) now render in place of the summary chips, beside the chevron. The `Tokens` label line and the separate content row are gone; at wide widths the expanded card is exactly as tall as the collapsed card. - **Wrapping is preserved.** Expansion exists to read the values, so the expanded row is never ellipsized: when width runs out, the chips wrap onto further lines in place (this wrapping behaviour is unchanged from before). - **Collapsed is untouched.** The collapsed summary keeps its single ellipsized line; its rendering is pixel-identical to before. **Expanded — wide layout** (before shows the label line + chip row; after is one row): <img width="884" height="344" alt="wide-expanded" src="https://github.com/user-attachments/assets/06abd5cd-b15d-4b29-ab39-1202d4c35ca5" /> **Expanded — narrow layout, 220 px** (both wrap instead of truncating; after drops the label line and starts the chips beside the chevron): <img width="390" height="339" alt="narrow-expanded" src="https://github.com/user-attachments/assets/e4e5fbe7-a37c-42f6-8f73-3628d21ac2c6" /> **Collapsed — unchanged** (wide and narrow; pixel-identical before/after, narrow still ellipsizes): <img width="884" height="310" alt="wide-collapsed" src="https://github.com/user-attachments/assets/71b40a15-6a19-4232-8eef-e0ce1327ff90" /> <img width="390" height="175" alt="narrow-collapsed" src="https://github.com/user-attachments/assets/f77ebdd9-0540-4c74-9f2b-3a3fb64a7d9a" /> ## Implementation notes - `packages/ui/src/components/message-usage.tsx`: the toggle now always renders `chevron + chips` — the collapsed state renders the three summary chips, the expanded state renders all six in the same slot. The separate expanded content `<div>` and its `aria-controls` wiring are removed. - `packages/ui/src/styles/messaging/message-usage.css`: `.message-step-usage` is the expanded wrapping row (`flex-wrap`, no truncation); the collapsed `.message-step-usage-summary` keeps its single-line ellipsis. The unused `.message-step-usage-label` / `.message-step-usage-content` rules are deleted. The chevron pins to the first chip row when the row wraps. - **Accessibility:** the button's `aria-label` carries all six full values when expanded (`aria-label` overrides the visible chips, so they are repeated there deliberately); the collapsed label is unchanged. The shared disclosure chevron rotation keeps working via the generic `aria-expanded` rule. - **dev-docs/TRANSCRIPT.md:** the message-token disclosure convention note is updated to describe the one-row layout. ## Help pages No help change needed: `docs/help/*/conversations.md` documents the line as *"expand it for reasoning and cache counts"*, which remains true — the documented behaviour is unchanged and the two-row layout was never documented. ## Validation - TDD red→green: the new assertions were watched failing first (`0 !== 6` chips on the row, stale `aria-controls`), then passing. - `tests/browser/usage-metrics.test.ts` — 5/5, now also covering: expanded chips on the toggle's row; single row at wide width; wrapping onto multiple rows at 220 px in LTR **and** RTL with no horizontal overflow and no ellipsis; chevron level with the first chip row; Space/Enter collapse restores the three-chip summary. - Related suites that render the usage row: `status-tokens` (4/4), `transcript-presets` (1/1), `search-highlight` (0 failures). - Visual: before/after screenshots captured from the real fixture at 900 px and 220 px (the composites above); collapsed rendering verified pixel-identical. |
||
|
Pascal André
|
7a1fc90310
|
docs(agents): keep AGENTS.md to universal rules and agent docs to the current state (#1082)
AGENTS.md loaded about 33,000 tokens into every agent session, subagent and reviewer, mostly per-feature contracts, and the agent documentation around it had accumulated duplicates, dated logs and history of removed designs. This PR makes AGENTS.md a short set of rules that apply everywhere plus an index of area documents, and leaves AGENTS.md, dev-docs and the repository skills describing only the current state. Three commits, reviewable separately: 1. **Move (lossless).** Every per-area rule moved verbatim from AGENTS.md into its area document (existing ones, or six new ones: UI_CONVENTIONS, UI_SHELL, COMPOSER, TRANSCRIPT, SETTINGS, PROJECTS). A script split the old file into 208 units, required one destination for each and checked all 199 content units verbatim at their destination. AGENTS.md went from 134,000 to 16,000 characters. 2. **Trim.** A per-area ponytail review removed rules stated two or three times (keeping the more precise copy), dated validation logs, per-version qualification sections below the current minimum, abandoned designs and self-references; seven documents whose surviving rules live elsewhere were deleted. It also fixed statements the code contradicts (locale registration, the Mission play/recovery condition, plugin package updates, cleanup progress UI, timeline index persistence, automation restart/targets, stale pins and minimums). 3. **Current state only.** The new AGENTS.md rule: no history (removed features and their names, former behavior, provenance, dated logs) and no denials; correct a contradicted statement at its source. DEVELOPER_MODE.md is merged into BROWSER_AUTOMATION.md and every Developer Mode mention is gone (including the README and the browser help page in ten locales). Names that only made sense against older designs are renamed with every reference updated, MISSIONS_ENVIRONMENT_ADMISSION is folded into SESSION_ENVIRONMENT, and INDEX lists every document. The server npm README now states the real OpenCode minimum (2.1.2). AGENTS.md is now about 14,000 characters (roughly 3,500 tokens); AGENTS.md, dev-docs and the vendor README went from about 11,200 lines to under 4,700. Validation: every relative Markdown link and every cited dev-docs path resolves; no reference to a renamed or deleted document remains; `npm run test:help` passes for all ten locales. Review: three independent GPT-6.1 Sol (high) reviews by area found binding rules lost in the trim and current-state passes; 25 were restored as present-tense facts or prohibitions and four contradicting statements corrected, each checked against code. A Fable 5.1 gatekeeper review of the whole PR passed; its follow-up routes session recovery from the index, points to dev-docs/INDEX.md and documents the family identity read. |
||
|
Pascal André
|
625e445bc2
|
ci(help): remind PRs that change UI labels to update the user help (#1081)
ci(help): remind PRs that change UI labels to update the user help The help drifted for a week because about forty user-visible PRs merged without touching it, while CI only checks the help's structure and links. The rule asking for help updates in the same PR was buried in the AGENTS.md i18n section; it now has its own short Pull Requests section next to the commit guidelines, which agents consult when committing and opening PRs. A new non-blocking workflow, help-update-reminder.yml, catches the most common miss: when a PR changes English UI messages (packages/ui/src/lib/i18n/messages/en/) but no file under docs/help/, it posts one marked comment and a warning annotation; once the PR touches the help, the comment is removed. It runs on pull_request_target like the existing Restrict Non-Dev PRs workflow, but only reads the PR file list and comments through the API and never checks out pull request code, so the write-scoped token never runs PR content. Because pull_request_target uses the base branch's workflow, it starts on PRs opened after this merge. USER_HELP.md documents it. Validation: replayed the filter read-only on past PRs: it would have flagged #1014, #1026 and #1052, which changed labels without updating the help, and stays quiet for #1043 and #1054, which updated it, and for #1057, #1063, #1079 and #1080. The workflow YAML parses, the step passes bash -n, the comment body has no leading indentation and the marker lookup returns the expected comment ID on a real PR. Behavior-only changes without label edits (such as #1063) are not detected; the AGENTS.md rule covers those. Review follow-up: the reminder only matches comments authored by github-actions[bot], runs are serialized per PR so overlapping events cannot post twice, clearing removes every owned reminder, and the workflow keeps only pull-requests: write. |
||
|
Pascal André
|
9fb6996576
|
fix(worktrees): separate fresh recovery and display refresh outcomes (#1080)
## Follow-up to #1076 Separate required-fresh outcomes from display refresh demand. Fresh failure rejects only fresh callers, queued display work still runs, and no fresh flag leaks into the next display read. Concurrent fresh calls coalesce; cached completion cannot satisfy fresh recovery. One serialized read/publication lane retains priorities and ordering. Initial display fallback cannot erase a fresh snapshot; existing display dirty/trailing coalescing retained. No backend/move safety change, polling or mutation replay. ## Validation Original queue fails deterministic fresh+fresh+display and concurrent-fresh regressions. Fixed: relevant UI units82/82 (worktree-ready14/14), worktrees browser13/13, focused interruption-dock recovery2/2, UI typecheck and diff check pass. Node24.20.0, private dependencies; no full browser sweep or live app/shared daemon/userDB. Server unchanged; native fixture not rerun. Three focused files, none oversized. |
||
|
Pascal André
|
ad844d0645
|
feat(transcript): jump to the previous or next user message with Shift+Up/Down (#1077)
Finding "what did the agent answer when I asked…" meant scrolling or hovering the timeline marker by marker. Two new commands, Previous User Message and Next User Message, appear in the command palette and in Settings → Keyboard shortcuts, bound by default to Shift+ArrowUp and Shift+ArrowDown. From the conversation (where focus lands after a send), they place the nearest user message before or after the reading position at the top, paging its history window in when it is not resident, like a timeline click. Text fields, arrow-key widgets, IME composition and modal dialogs keep the keys, so Shift+Arrow still selects text in the composer; key repeat does not repeat the jump. components/user-message-navigation.ts searches the timeline's markers, including the structural index beyond the resident window, and uses list order for a current message without a marker. MessageSection handles the shortcut in the capture phase, before the transcript reads arrows as a scroll gesture; the palette commands reach it through JUMP_USER_MESSAGE_EVENT. The jump requests the index even while the timeline is hidden, and a jump finding nothing resident before it arrives runs once it does. The last target stays the reference while loading or shown, since the list cannot raise a message near the end to its top. Both are forgotten in cancelWindowNavigation, which every other navigation (First/Latest, sends, paging, session changes, deactivation) passes through, and on scroll gestures, so a late index never overrides a newer navigation. The public help lists the shortcut in all ten locales and states the 74-action catalog (it said 49); HOTKEYS.md and AGENTS.md describe the dispatch; labels are translated in every locale. Validation: unit tests for the target search and key guard plus the catalog count (now run in CI); browser regressions for resident and windowed jumps, the composer keeping Shift+ArrowUp, the deferred jump with a hidden timeline, an explicit Latest dropping it, and repeated jumps near the end (the last three fail without their mechanism). hotkeys-settings, header-windows and history-navigation suites pass; UI own-tsconfig typecheck, root typecheck and test:help pass. Gatekeeper review (GPT-6.1 Sol): one P2 (deferred jump surviving Latest) fixed, then zero actionable findings at 7ab3f17d3cac6be694f989fde8d217c313599f9d (rebased on dev as bf6e09990ba7b65789d5789fe00d87b5e1362625; only the help pages' catalog count conflicted). Refs #1075 |
||
|
Pascal André
|
1dabb5110f
|
docs(help): bring the user guide back in line with the current app (#1079)
docs(help): bring the user guide back in line with the current app The help was written on 2026-10-14 and about forty user-visible changes merged since without touching it, so several pages described controls that no longer exist: Missions still listed four playbooks and a Save step for preferences that now save on each change, the depth editor kept its old names, notifications still had their former switches, and voice input pointed to a microphone button that is not in the composer. Every English page was re-checked claim by claim against the current labels (English UI messages) and behaviour, then the nine translations were updated to match, using each locale's own UI labels. Notable corrections: Missions (Compare two models, autosaving defaults with Apply to / Global / Reset, Subsession nesting depth, prepared hand-offs, retired-task interrupts, the named causes of "Mission Control is unavailable", standalone server support); conversations and history (reasoning/tool durations, token lines adding up the cleanup selection, presets including Nothing, timeline markers following Message content, in-place reveal of long text, Open in session, focus after send, Queue message / Steer now, Retrying); settings (notification routing table and defaults, Stats, Mode, info tips, Server setting badge, localized native menus); shortcuts (72 actions, Clear shortcut, Ctrl/Cmd+K); voice (More actions entries, Save status); files (live Workspace refresh, Show 200 more); OpenCode, install, server and updates (2.1.1 recommended, OpenCode 2 beside an older installation, version card first, private loopback listener for Missions, preview releases offered once all builds are published); providers, integrations, browser, SideCars, desktop and remote pages. Translations also repaired older drift, mainly the project-tab closing passages. The Chat settings table header (Default state, its title, item column, the thinking row and its accessible label) was still English in eight locales; it is now translated so the help can cite what users see. AGENTS.md now asks every PR changing user-visible behavior to update the affected help pages in the same PR, since CI validates structure and links but not whether the text still matches the UI; it also corrects the needs-input notification default. USER_HELP.md no longer claims native menus stay English. Validation: npm run test:help (all ten locales, 25 pages, heading ids unchanged), a full help build, and the i18n and transcript-visibility unit tests. |
||
|
Pascal André
|
f314123dd1
|
fix(opencode): qualify and require 2.1.2 for correct Code Mode execution (#1078)
Raise the approved external runtime minimum and recommendation to 2.1.2 after reproducing incorrect native Code Mode job ordering on 2.1.0/2.1.1. Keep the independently qualified 2.1.0 client/plugin build pins and preserve bounded contract recognition for custom/future runtimes. Add the real isolated execute regression to the minimum/latest compatibility matrix, align supported installer fixtures without weakening assertions, and update setup/help in all ten locales. Two author-side review passes found no blockers; the final focused set passes 93/93 and native Code Mode passes. Qualification includes builds/typechecks, UI/browser, native pruning/Missions/recurrence, migrations and isolated installation/upgrade. Record the broad server shutdown timeout and its two unchanged isolated passes precisely. Admin merge explicitly authorized by the maintainer without waiting for CI. |
||
|
Pascal André
|
8c6a90922e
|
fix(recovery): reconcile removed worktrees without hiding live interruptions (#1076)
## Problem and fix A cached UI worktree descriptor can keep a removed idle directory required after native/backend inventory healed. On inventory-only missing/not-owned recovery failures, perform ONE fresh worktree inventory read and retry ONLY directories that genuinely became optional through the existing loaded-only pending broker. The failed-move clue exposed another guard gap: preserve source/target locations and pending move identity after failed/incomplete reconciliation until complete family inventory plus fresh activity succeeds. An old read cannot release a newer move, and mutations are never replayed. ## Safety - Root/catalogue selection, active sessions, known Forms/permissions and uncertain move locations remain required. - No blanket exclusion, directory/session deletion/move, daemon restart, ordinary pending-list fallback, fake empty coverage or warning suppression. - Existing broker negative proofs and post-IO ownership/deletion fences remain; successful sibling recovery and edited drafts retained. - The precise12:58 warning in the screenshot is not proven causal: both directories are now absent from live/Git inventory and not active. Current healed state does not establish historical bad registration. ## Validation Red store and real-browser regressions reproduce on base. Green:146 UI tests,78 server tests,2 focused browser cases; both typechecks and diff check pass. Isolated real Git/filesystem fixture exercises external removal with warm display/stale native registration. Read upstream2.1 refresh implementation/test (refresh prunes absent registrations; list alone does not discover). No full browser sweep/real-daemon fixture. WSL mocks pass, live WSL/native hosts unverified. No installed app/shared daemon/user database/config mutations. Oversized touched sources: api-client.ts~820, instances.ts~2420, session-api.ts~2050. Added tests extend existing CI-listed files. |
||
|
Pascal André
|
92ba215254
|
fix(missions): run Missions on the standalone server and name each unavailable cause (#1070)
## Problem Missions dispatch through the owning backend's loopback automation bridge, not through the desktop window. Yet the bridge and the Missions plugin were only provided when a desktop host launched the server. On the standalone server (`npx @neuralnomads/codenomad…`, whose default listener is HTTPS-only), Missions never loaded, and Mission Control told users to "Reconnect CodeNomad", which cannot help (#1069). Tauri on macOS/Linux sets no native parent and was affected the same way. ## Fix - **Private loopback listener:** the HTTP listener always starts. When HTTP was not requested, it is private and unannounced, on a random `127.0.0.1` port. - **Bridge and plugin:** the bridge is published whenever a loopback HTTP listener exists, and the Missions plugin is provisioned once that publication settles, so early connections never skip it. - **Automation stays desktop-only:** without a desktop host, the bridge's `browser-claim` answers only `purpose: "mission"`, which the Missions plugin now sends. Browser tools therefore never select an owner that cannot open a page. Remote Control keeps routing into the application users reach. - **One deletion fence per backend:** all listeners now share one `WorktreeDeletionFence`, and with it the mission creation/recurrence holds. Previously each listener had its own, so a deletion through HTTPS could not drain a mission admitted through the HTTP bridge. This could already happen in desktop dual-listener mode. - **Exact unavailable causes,** localized in all ten locales: - `host-unavailable`: this backend has no bridge; reported before reading OpenCode. - `plugin-unavailable`: OpenCode has not loaded the plugin. Refresh, then use **Reload OpenCode configuration**. - `plugin-failed`: OpenCode failed to load the plugin; its error is in the Plugins list. ## Validation - New real startup test: the actual entry point as a standalone HTTPS-only server, isolated profile, no OpenCode. It proves the private `127.0.0.1` bridge is published, authenticated (401 without token), unannounced and removed on shutdown. - Bridge route tests: mission-only claims without a desktop host, ownership still required, native requests fail closed. The plugin test asserts that the claim carries the purpose. - Missions route tests cover each unavailable reason, and `host-unavailable` reads nothing from OpenCode. - The isolated native Missions fixture (`scripts/test-missions-native.mjs`) passes on **OpenCode 2.1.2** through the real bridge route with no desktop host. - Server and UI typecheck: 0 diagnostics. Full server suite running. Refs #1069 |
||
|
Pascal André
|
00f39ada16
|
fix(timeline): space every marker evenly (#1062)
The rail doubled the gap wherever a tool marker started a different message, a collapsed tool group ended or a prompt followed an assistant with tools: a V1 notion of tools belonging to their assistant message. OpenCode V2 records each model call as its own message, so almost every tool started a new group while tools called together stayed tight, giving irregular, pronounced gaps that meant nothing to the reader. Every visible marker now follows the previous one by one uniform gap, and the message-tool bookkeeping is removed. Validation: render-cost checks the exact 10,000-marker extent with uniform gaps; timeline-tool-filters, history-navigation and system-messages browser tests and the UI typecheck pass. |
||
|
Pascal André
|
da0dc279a7
|
ci(tauri): stop the refcount negative control at its first crash and warn when a runner never races (#1061)
The Windows runtime handle regression builds a copy with the counter fix reverted and required that negative control to crash within ten processes before the corrected build's five runs. The race is timing-dependent: of the last ten PR builds, five runners reproduced it (1 to 8 crashes in ten) and five never did, so tests-tauri-windows failed about every other pull request, unrelated to the change under test. The negative control now runs up to fifty processes (about 0.16 s each) and stops at the first native fault. On GitHub Actions, a runner that never reproduces it emits a warning naming its CPU instead of failing; local --baseline runs still fail, so a change to the fix cannot pass on a machine that never races. The corrected build's runs, the accepted fault codes and the clean-teardown check for surviving processes are unchanged; the counter-boundary and vendored-Tao checks guard the fix on every runner. Docs state that corrected runs on a warning machine provide no timing evidence. Validation: syntax check and two independent reviews; the sample comes from the tests-tauri-windows logs of the ten most recent PR Build Validation runs. |
||
|
Pascal André
|
f3c0fe671e
|
fix(timeline): stop adding an empty agent marker after every tool step (#1058)
fix(timeline): stop adding an empty agent marker after every tool step In OpenCode V2 each agent step is its own assistant message, and most steps only call tools. The timeline's structural index for history knew an assistant message's tool and reasoning counts but not whether it had text, so the projection drew a tool marker followed by an agent marker for every step. For tool-only and reasoning-only steps that agent marker was empty: no hover preview, and clicking it reached a message showing nothing but its tools, or nothing when tools are hidden in Message content. Resident (loaded) messages already dropped such markers. The outline index now also counts an assistant message's non-blank text parts that are neither synthetic nor ignored, the same text the hover preview shows. The projection draws an assistant marker only when that count (or the resident segments) shows visible text, so a tool-only step keeps its tool marker alone and a reasoning-only step has none. The count is optional in the contract: an older plugin copy still loaded by the daemon reports no count, and its markers stay as before. Persisted indexes saved without the count display immediately and then revalidate every checkpoint once, like the representative tool names. The unused message-timeline-group-* classes, which no stylesheet or test referenced, are removed; the group spacing that still uses tool membership is kept. Validation: navigation.test covers text counts for text, tool-only and blank/synthetic/ignored/reasoning-only steps; session-outline-projection covers tool-only, reasoning-only, text, unknown-count, shell and resident cases; session-outline-persistence covers validation and the one-time refresh of indexes without counts; the native navigation script now asserts the counts on real native storage (CI). history-navigation, timeline-tool-filters, system-messages and render-cost browser tests, the session-outline tests and the UI typecheck pass. |
||
|
Pascal André
|
f5c5eefefc
|
chore(opencode): qualify and recommend runtime 2.1.1 (#1055)
Recommend the qualified external OpenCode 2.1.1 runtime while retaining minimum 2.1.0 and the unchanged locked client/plugin build. Align setup/update regression expectations and the recommended-version help tables in all ten locales; preserve authenticated contract recognition and mutation/ownership fences. Record isolated Windows native runtime, session/account/usage, pruning UI/history, four historical migrations and all eleven recurring Mission journeys. Server units pass 2442 with seven skips, UI units 1635 and focused browser tests 125; final dev Settings/preview-offer deltas and retained-minimum controls are revalidated. Two review passes found no actionable issue in the PR. Admission/update tests and explicit isolated 1.x-to-2.1.1 replacement pass. The user explicitly authorized administrator merge despite the unrelated Tauri Windows negative-control race test failure, the general test job still running at inspection and the required GitHub review. No stable release is published by this merge. |
||
|
Pascal André
|
64ff1a8fc6
|
fix(settings): show OpenCode version first and drop the Runtime header (#1052)
fix(settings): show OpenCode version first and drop the Runtime header Settings > OpenCode now starts with the OpenCode version card (status, install/update and service actions), followed by the executable selection and then the log level card. The executable card loses its separate "Runtime" heading and server-setting badge: the binary selector already carries its own "OpenCode binary" heading and description, so the extra row only repeated it. The startup recovery dialog shares the same card and drops the duplicate heading too. The two unused strings are removed from all ten locales and AGENTS.md records the new order. Validation: the opencode-setup browser suite (33 tests) passes, including the settings layout test now asserting the version card first, the selector second without a header, collapsed disclosures and logs last; a capture confirmed the order. UI typecheck passes. |
||
|
Pascal André
|
7d9093de68
|
feat(timeline): follow Message content tool visibility (#1049)
Timeline tool markers now follow the Message content filters: a marker disappears when the tool type it shows (its icon; the outline's representative tool for indexed history) is hidden there, and the Nothing preset removes every tool marker. As with hidden tools before, the transcript's active marker and markers with an active permission stay visible, so highlighting and reveal keep following the transcript. Collapsed tools keep their marker. Because the rail now follows those filters, the separate "Show tool calls in the timeline" preference is removed everywhere it surfaced: Settings > General, the View menu item in the renderer, Electron and Tauri hosts, the palette command, its shortcut catalog entry (72 actions, 23 initially unbound) and its strings in all ten locales and the help. Saved values are ignored; the server schema passes unknown keys through, and hosts ignore an extra field from older renderers. The never-updated expandedMessageIds timeline input is dropped. Intended default change: tool markers are visible with the Balanced preset unless their type is hidden in Message content. Validation: new timeline-tool-filters browser test (hidden, Other-routed and collapsed tools, Nothing/Everything presets, a hidden active marker shown and highlighted); view-menu, a real Electron View menu, hotkeys-settings, transcript-presets, render-cost, history-navigation and other timeline suites (one local-environment failure that also fails on unmodified dev); related unit tests; UI typecheck; rustfmt check of view_menu.rs. Independent review approved after the active-marker fix. |
||
|
Pascal André
|
6f8881d5ae
|
fix(stats): restore cached totals and refresh only while visible (#1041)
## Summary
Replace the renderer-only workspace-ID cache with bounded validated
display snapshots in backend-owned state.ui.serviceUsage. Cache survives
recreated renderer/backend/workspace identity, keyed by authenticated
service/discovery/execution-host/folder fingerprint and period/timezone.
Eight entries, 1 MiB maximum; no plaintext credentials or paths.
Preferences does not write the opener's client-state journal.
Show previous totals/charts immediately with a cached-state label while
revalidating; preserve them on error. Hidden/unmounted Stats starts no
reads, cancels trailing work and fences late results. Visibility resumes
one read; execution hints use the existing activity cooldown instead of
one native scan per descendant. Manual refresh, period, reconnect and
deletion/pruning paths retained.
## Validation
- Rebased on current dev
|
||
|
Pascal André
|
6a6367b560
|
chore(opencode): retire adaptations for runtimes and events OpenCode V2 no longer produces (#1034)
## Summary This PR removes OpenCode compatibility code that nothing can reach any more: - Code that was already dead at the former 2.0.27 minimum, and is still dead at the current 2.1.0 minimum (#1029). - Handlers for events and data shapes that OpenCode V2 never produces. Each item was checked against the upstream 2.0.27 and 2.1.0 sources before removal. Kept on purpose: - Workarounds for upstream bugs or limits that are still present in 2.1.0. - Code that reads conversations written by older runtimes: V1-migrated tool names and metadata, `workspaceID` data, task summary titles, `session-legacy` replay. - Code that recognises and upgrades old CLIs and live older daemons: 1.x replacement, beta recognition, 2.0.11 service discovery, 2.0.15 native upgrade, `/api/status` and `/api/health` identification. ## Removed or changed **Server** - Negotiation: one "not modern → `canonical_api`" rule replaces the pre-2.0.4 legacy schema recognition, and runs before #1029's `native_contract` check. - The transport no longer rewrites `/api/status`. - Desktop skills no longer send the pre-2.0.4 `location` and `slash` fields. - The legacy `auth.json` usage fallback for daemons without `credential.list` (pre-2.0.20) is removed, along with its UI reason and the i18n key in 10 locales. A missing endpoint still fails safely. - Workspace selectors are rejected up front, without a native resolution request. - CLI service probes try `/api/info` first. An admitted daemon no longer costs two authenticated 404s on every check. **UI** - Remaining V1 `session.idle`/`session.status` branches: Missions store, pending discovery (UI and server), `eventAffectsMessages`. - `server.instance.disposed` and the now-unused `rehydrateInstance`. - The V1 `worktree.ready` envelope (the handler now reads the V2 shape). - V1 tool-state titles and the `success` status alias. - Part `time.start` and `time.end`. - Text stored as objects or segment arrays. - `deriveMessageStatus`. - The V1 `error.data.message` shape. - `projectID` and `location` fallbacks on `session.created`. - The replay-only `session.message.content.updated`. - The unreachable `output.answers` fallback. **Fixtures, Missions and docs** - Legacy branches removed from the location, fork, families, pruning and automation native fixtures. The WSL setup fixture now compares against the reported version instead of 2.0.11. - Unused 2.0.21 launch helpers removed. - The Missions native and trajectory fixtures also run on the minimum lane. - The capability proof checks the reported version. - Stale 2.0.2x labels now say "as of the 2.1.0 minimum". **Follow-ups from the #1029 post-merge review** - Test fixtures no longer send the ignored `recent: ""` compaction field (18 sites). - The manual compaction-isolation fixture accepts any published version at or above the minimum. - `CONTRIBUTING.md` wording updated. 114 files, +319 / −1117: source +90 / −487, tests/fixtures/CI +214 / −604, i18n −10, docs +15 / −16. ## Validation (rebased on dev with #1029) **Typechecks:** server and UI pass. **Server tests** - Touched areas: 480/480. - Full server CI step: 2430 pass, 0 fail, 7 skipped, 1 cancelled. The cancelled test is the `index.test.ts` real-process shutdown test; it hit its 5 s timeout under load. It passes alone (4/4), and that file is unchanged versus dev. **UI unit tests** - Touched files: 230/230. - CI steps: 574/574, 200/200 and 519/519. **Browser suites**, one at a time: - Provider and service usage: provider-usage 13/13, service-usage 3/3. - Missions: mission-visibility 3/3, mission-control-feedback 5/5, mission-lifecycle-revision 10/10, mission-lifecycle-navigation 10/10, mission-current-passage 1/1, mission-native-family 11/11. - Transcript and rendering: compaction-responsiveness 5/5, session-rendering 47/47, reasoning-collapse 3/3, render-cost 17/17, tool-images 4/4, system-messages 10/10. - Other: search-highlight 11 pass (1 skipped by its env gate), panel-extensions 13/13. **Native fixtures on an isolated 2.1.0 CLI:** location, session-fork, automation, session-pruning, missions native, missions trajectory, provider-usage, Missions capability proof and compaction-isolation all pass. The WSL setup fixture was not run (it needs a WSL distro with a Linux CLI). ## Left for later - `RuntimeIdentity.discovery` is now write-only. - `ownsLocation` has an unused `_client` parameter (about 30 callers). - A test-only V1 translation in `auto-accept-manager.test.ts`. - Out of scope: HTML-entity decoding (a product decision), the `MutableHashMap` loop, the pruning-UI import-order workaround, unused log-based Missions readers, and the unshipped managed-owner module with its 2.0.24-pinned test. Oversized source files touched: `stores/instances.ts` ~2,209, `message-block.tsx` ~1,601, `workspaces/manager.ts` ~1,104, `tool-call.css` ~1,047, `tool-call.tsx` ~865, `opencode-data.ts` ~865, `api-types.ts` ~784, `session-events.ts` ~606, `recurring-day-fixture.ts` ~535. |
||
|
Pascal André
|
d6a890fba7
|
chore(opencode): qualify 2.1.0 and adopt its native contracts (#1029)
Adopt the OpenCode 2.1 native replay and compaction contracts, align client/plugin pins and set minimum and recommended runtime to 2.1.0. Preserve authenticated contract recognition for future/custom runtimes and explicit installation/restart boundaries. Preserve historical conversations through official projection-based pruning revisions and independently checked migrations from 2.0.3, beta-19271 and 2.0.32. Retain ownership, execution claims, stale-selection checks and transaction fences. Update setup, help and qualification evidence. Isolated Windows native qualification and integration checks cover pruning UI, historical reimport, Compare/Wayfinder, recurring Missions, builds and typechecks. Document broad-suite limitations and outstanding platform/package/mobile acceptance; this merge does not publish CodeNomad 1.0.0. |
||
|
Pascal André
|
73c0621d0d
|
fix(sessions): wire finish, retry and usage signals to OpenCode V2 events (#1033)
## What changes for the user
Four things that silently stopped working with OpenCode V2 work again:
- **"A session finished" notifications** arrive again. A successful or
failed run notifies. A run you stopped yourself does not.
- **Provider retries** show the retrying status and the countdown toast
again.
- **Usage statistics** refresh after each run.
- **The token usage line** under assistant replies (preference,
transcript filter row and hotkey) shows each settled reply's tokens and
cost again.
Per-session transcript reducers are also released again once a run has
settled.
## Why
OpenCode V2 declares `session.idle` and `session.status` in its schema,
but core never publishes them. Runs end with
`session.execution.{succeeded,failed,interrupted}`, and retries arrive
as `session.retry.scheduled`. These features were still keyed only to
the V1 events.
The token usage line had a second problem: it was drawn from V1
`step-finish` parts, which V2 never produces. V2 stores tokens and cost
on each assistant message instead.
A new isolated native fixture,
`scripts/test-session-lifecycle-native.mjs`, confirms this on CLI 2.1.0.
It uses its own storage, port and fake provider, and never the shared
service. In its complete, retry, fail and interrupt scenarios, it sees
no `session.idle` or `session.status` event. Upstream 2.0.27 sources
show the same: these events are declared but never published.
## How
- **Finish notification:** sent from the V2 terminal path after
`session.active` confirms the run ended.
- Succeeded and failed runs notify.
- User and shutdown interrupts stay silent; idle-timeout interrupts
notify.
- Subsessions and unknown sessions stay silent.
- A stray `session.idle` cannot cause a duplicate.
- **Retry:** `session.retry.scheduled` sets the retry state and the
transient toast. The next attempt or the end of the run clears them.
- **Run-end detection:** a shared `lib/native-execution-events.ts`
drives the usage refresh and reducer retirement.
- **Reducer retirement:** it also waits for queued prompts, so prompts
left in the inbox after an interrupt stay listed.
- **Usage line:** moves to `components/message-usage.tsx` with the
existing classes.
- **Removed:**
- the dead V1 `StepCard`, its step-part types and CSS;
- the V1 `session.idle`/`session.status` handlers.
- **AGENTS.md:** one bullet so future features wire to V2 lifecycle
events.
Left for the follow-up cleanup PR: the remaining dead `session.idle`
fallbacks in pending discovery, Missions triggers and test fixtures.
## Validation
New tests that fail on unmodified dev and pass here:
| Suite | dev | this PR |
|---|---|---|
| lifecycle unit | 3/4 fail | 4/4 |
| retirement | 8/9 fail | 9/9 |
| browser `usage-metrics` | 3/3 fail | 3/3 |
| browser `service-usage` | 2/3 fail | 3/3 |
- UI typecheck is clean.
- **Passing unit suites:**
- opencode-data-idle 9, runtime-contract 4, session-native-events 8,
message-part-grouping 6
- opencode-transcript-replay 17, opencode-compaction 11,
session-pruning-projection 2, session-pruning-pagination 6
- session-request-authority 77, opencode-data 30, message-timeline-v2 2,
transcript-visibility 8
- missions 1, instances-pending-compaction 7
- **Passing browser suite:** `system-messages` 10/10.
- The native lifecycle capture passes.
Oversized files touched:
| File | Lines |
|---|---|
| `message-block.tsx` | ~1,760 (down ~240) |
| `message-section.tsx` | ~1,630 |
| `opencode-data.ts` | ~905 |
| `session-events.ts` | ~670 |
| `message-timeline.tsx` | ~645 |
| `message-base.css` | ~675 |
| `session-request-authority.test.ts` | ~2,400 |
| `opencode-data.test.ts` | ~1,215 |
|
||
|
Pascal André
|
debbdce33f
|
feat(missions): add a "Compare two models" Mission template (#1026)
## Summary Adds a fifth Mission template, **Compare two models** (`compare`). It runs the same bounded task on two different models and ends with a blind verdict. - **Creation:** the user picks **model A** and **model B** in the main creation form. Both are required and must name different models (provider + model id; a reasoning variant alone is not a different model). This is enforced on every creation path: HTTP, prepare, recurrence create and agent-started missions. - **Roles:** `model-a`, `model-b` and `comparator`. - A and B share one instruction text and report contract. - The coordinator writes the task, inputs and criteria once, and gives both byte-identical briefs. - The server refuses a run task whose brief differs from its sibling's, or whose per-task execution would change its role's model. - **Blind judge, always on:** the comparator works on neutral X/Y labels. - It reports one versioned `comparison` artifact: the A/B task references, per-criterion scores for both runs, sourced observations, and a verdict `a | b | equivalent | inconclusive`. - Completion requires both runs and that comparison. - **Judge model:** frozen once at creation, like every other role. - An explicit judge is kept; otherwise the judge copies the coordinator's effective model. When that model is unknown, both stay on the native default. - Replays and retries therefore reuse the stored profile. - The editor warns when the judge's model equals A or B. - **Readers:** the verdict, both model names, a score table and evidence by path. Hashes stay under Technical details, for current and archived recurring passages. The template came out of evaluating Harness2's comparison loop. It deliberately has **no** lesson, human approval, budget or duration handling, and leaves the Wayfinder human gate unchanged. Up to five models, per-run worktrees and launching from the composer's model picker (OpenChamber-style multi-run) are left for later. `AGENTS.md` records the single editor exception: the A/B selectors sit outside the collapsed Options disclosure. All ten locales are updated. ## Size and upkeep 62 files, +837/-96: | Part | Lines | |---|---| | Product code (about 16 files are one-line template-list hooks) | +280/-57 | | Locales (13 keys × 10) | +131 | | Tests | +409 | | Docs | +17 | `missions/control.ts` stays oversized (~1,500 lines). ## Validation - Full server suite: 2,426 tests pass, 7 existing skips. Root and server typechecks, the server build and the plugin build pass. - UI: 45 unit tests and 36 browser tests pass. - The native trajectory fixture, extended with a compare case, passes on OpenCode 2.0.31. It checks two distinct models, a one-newline brief difference refused with the journal unchanged, a real blind judgment and a completed mission. The native contract and recurring Q fixtures also pass. - Regressions cover: - distinct-model refusals on every creation path; - brief and override refusals; - artifact validation and the completion policy; - judge freezing at creation, revision replay, and retry after a coordinator model change; - editor inheritance and readable evidence. - Independent review rounds ended with no P0-P3 findings. - The editor and reader were checked from screenshots of the real Solid components in the browser harness, not in a packaged app. |
||
|
Pascal André
|
ee035ad272
|
fix(files): refresh Workspace with scoped, rate-limited invalidations (#1030)
Fix Workspace listings that stayed stale until manual refresh or F5. Reproduced the issue in the attached Tauri application: a host-created file was absent until the panel's Refresh button reread it. OpenCode filesystem events were the only invalidation source, not a subscription to every browsed directory. Observe authorized listed directories on the host through bounded, non-recursive native watches, registered before listing. Preserve physical containment, inode and workspace-lifetime checks and close watches on removal or shutdown. Forward actual directory observations through the existing SSE event bus, without inventing native OpenCode events or adding polling, recursive scans or an independent service. Coalesce passive cache invalidations before readers wake: a short isolated- change delay, then at most one publication every five seconds during sustained activity, as requested. Only pending observations create a timer. Explicit mutation/recovery invalidations remain immediate. Scope tree versions by browsing root and listed directory, so only stale visible directories reread; other worktrees, unchanged siblings and hidden/collapsed folders do not scan. Retain existing read budgets, cache-first rows and coalesced in-flight demand. Keep logical listing aliases separate from physical watch targets, so every internal junction/symlink subscriber receives its own cache invalidation. Directory listings include an opaque device/inode identity: when a parent detects removal or replacement, discard only that child's cached subtree, cancel its old reads and reload still-expanded paths to bind new observations. Ordinary mtime changes never force a subtree scan. Validation covers real filesystem create/edit/rename/unlink, ownership, replacement, aliases, watcher budgets/disposal, continuous cache bursts and immediate explicit mutations. A real Chromium regression exercises the whole filesystem-to-watch-to-SSE-to-Workspace path without F5, including parent-only replacement and multiple junction aliases. Existing Files/Git browser checks, the full server suite and targeted UI checks pass; typecheck diagnostics remain at baseline. No installed application or shared OpenCode daemon was replaced or restarted. Final server validation: 2,415 tests pass, seven existing skips. Two independent gatekeeper rounds; the final review reports zero actionable P0-P3 findings at 728bf59861d063863c6bb3351d5ce0a030ce6866. The hosted CI is still running at merge. Closes #1027. |
||
|
Pascal André
|
362efb5911
|
test(missions): fold the one-time decision journey into the trajectory fixture (#1024)
## Summary #1023 fixed one-time Wayfinder decisions with about 85 lines of product code but 410 lines of tests. Its 248-line native script re-implemented the daemon, bridge and workspace setup that `test-missions-native-trajectory.mjs` already has. `native-invocation.test.ts` also carried overlapping cases. - The decision journey is now one case of the trajectory fixture, reusing its private daemon, shipped plugin, bridge, workspace and real subagents. The case covers: - refusal before an answer, with no journal mutation; - a native child question answered through the authenticated UI route; - completion by discovery without a supplied artifact. - `scripts/test-missions-wayfinder-decision-native.mjs` is deleted. - `native-invocation.test.ts` (162 to 90 lines) keeps one test per distinct behaviour: - concurrent isolation and stale invocations; - exact `Exit.fail`/`Exit.die` preservation; - interruption joining a raw read that ignores abort, through the real `acquireNativeHumanAnswers` adapter; - the per-check deadline between two successful checks and after an expired one. - No product code changes. Net -260 lines. ## Validation - With the pre-#1023 `managed-owner-plugin.ts` substituted in memory, the trajectory case fails after the UI reply with `Native human answer graph unavailable`. Restored, all 9 checks pass on OpenCode 2.0.31. - Detaching reads from the runner, or converting errors to defects, makes the unit tests fail. - The full server suite passes (2,410 tests, 7 existing skips), as do the server typecheck, the plugin build and bundle test, and the native contract fixture. - An independent review ended with no P0-P3 findings. |
||
|
Pascal André
|
c42cfe740a
|
fix(missions): run the one-time human gate in the invoking native graph (#1023)
## Summary A one-time Wayfinder mission could never complete a decision task. The decision child asks its native question, the human answers it in CodeNomad (authenticated UI reply, durable mark confirmed `via: "ui"`), and the coordinator's decision report is still refused with `Native human answer graph unavailable`. The one-time human gate is built in `managed-owner-plugin.ts` from the plugin setup graph. That graph lacks the Location, Form and Database services that `acquireNativeHumanAnswers` requires. Recurring passages build their own gate in the Job's Location graph (`native-recurrence-due.ts`), so they were not affected. This is why the recurring Wayfinder journey (Q) kept passing while the one-time path was broken. ## Fix - `native-invocation.ts` captures each invoking native graph with `AsyncLocalStorage` around the plugin's tool executes and forwarded Missions RPC handlers. The one-time gate runs its reads in that graph. - Concurrent invocations stay isolated. A missing or finished invocation is refused, never served by another invocation's graph or the setup graph. - Each complete human check gets its own 10 s budget, the bound `native-human-evidence.ts` already uses. Its nested SQL/Form/storage reads share that budget, which is not reset per query. - Interruption or expiry aborts those reads. The borrowed graph is released only after every started read has settled. A truly non-interruptible native finalizer must still finish first; this is documented. - Expiry surfaces as an ordinary refusal. - Recurring runners are unchanged. ## Validation - New native fixture `scripts/test-missions-wayfinder-decision-native.mjs`. It drives the shipped plugin on a private daemon with a synthetic provider: a real child asks a native question, and the reply goes through the authenticated UI route. - Before the answer, the decision report is refused with no journal mutation. - After it, the decision completes by discovery, without a supplied artifact. - On unmodified `dev` it fails with the error above; with this change it passes (OpenCode 2.0.31). - Unit regressions in `native-invocation.test.ts` use the real `acquireNativeHumanAnswers`. They cover invocation isolation, missing or stale invocations, Effect errors, interrupted and blocked reads, and successive checks separated by slow work. Each new regression fails on the earlier code. - The full server suite passes (2,413 tests, 7 existing skips), as do typechecks, the plugin build and bundle test, and the native `test-missions-native`, contract, trajectory, family-control and recurring Q fixtures. After rebasing onto #1022 (UI preferences only), the server typecheck and the 34 targeted human-answer tests pass again. - An independent review loop ended with no P0-P3 findings. |
||
|
Pascal André
|
e32d9331f4
|
refactor(automation): unify native browser previews on the shared page engine (#1020)
Unify application-window and session-preview automation on the same server-side page engine. BrowserPage serializes per-session operations, binds refs to the exact native guest/document generation, fences cancelled and late results and always attempts exact lease cleanup. Both tools share page-action validation and budgeted, scoped plain-text outlines, without arbitrary model evaluation. Replace Electron and Windows Tauri snapshot/ref/click/type implementations with the private browser.page.begin/send/check/end channel. Native hosts keep guest ownership, visibility, URL policy, storage, history, emulation, navigation and screenshots. Bounded operation leases and fixed protocol allowlists check identity before native effects and after IO; hidden, ambiguous, replaced, navigated or expired targets refuse rather than selecting another guest. Cleanup never detaches another owner's persistent emulation overrides. No renderer IPC, guest capabilities or legacy page-action fallback is added. Electron uses WebContents.insertText and sendInputEvent for embedded guest text and keyboard input: direct CDP input can report success while silently dropping it before the first pointer click. Preserve key modifiers and text events without showing or raising a window. ContextMenu is explicitly refused with Shift+F10 guidance rather than emitted as an unknown native key. Validation includes native ownership/expiry/deadline/concurrency regressions, 20 Rust browser-controller checks and cargo check --tests, 24 Electron controller tests, full server validation and isolated OpenCode 2.0.31 plugin and bundle checks. The real hidden-window Electron integration drives both production ends through replacing type, select, printable keys, Ctrl+A and Backspace, Tab, Enter, pointer clicks, waits, scoped snapshots, hidden targets and stale refs after navigation. Three independent gatekeeper rounds reached zero actionable P0-P3 findings; subsequent parent-only rebases preserve the identical reviewed patch. At merge, the CI tests job failed only an unchanged client-state process timing assertion (661 ms against a 500 ms ceiling). Its isolated regression passes, including the affected live-registration case in about 47 ms; native platform and compatibility jobs passed. No installed app or shared OpenCode daemon was changed or restarted. Refs #1008. |
||
|
Pascal André
|
b2d5b722ec
|
feat(automation): complete safe native window interactions (#1018)
Complete application-window interaction on the shared page engine introduced by #1015, while preserving native window/run and document-scoped ref authority. Add real pointer clicks, hover, stepped pointer dragging, wheel scrolling, keyboard chords and bounded text waits. Flat tool commands are validated at both bridge boundaries. Clicks refuse covered targets; press(ref) refuses a target that cannot acquire focus, so Enter never reaches an unrelated draft. Drag requires both ends visible instead of scrolling under a measured source. Preferences remains outside automation; focusing Preferences or a remote window falls back to the most recently used local application window. Trusted native input carries monotonic provenance intervals. Human Form decisions check the originating event timestamp, not the time a stalled renderer handles it; delayed keys and their implicit submit clicks remain automated after lease expiry. Fixed page functions keep their depth marker. Native events use the page's epoch clock, and cleanup preserves the original press timestamp, independently of configured command timeouts. Failed sequences best-effort release held buttons and keys, including when the cleanup mark write itself times out. An admitted input timeout is reported as an unknown outcome with inspection-before-retry guidance: the renderer may deliver the input or finish the click later. Never replay these inputs. Validation covers the actual Mission editor and InterruptionDock in isolated Chromium, including a 16-second renderer freeze and a control human click. Targeted server tests cover key mapping, both bridge parsers, focus/target fences, failure cleanup and late input outcomes. Full server validation, isolated OpenCode 2.0.31 automation, bundle regression and Tauri compilation also pass; typecheck diagnostics remain at baseline. No installed application or shared daemon was changed or restarted. Four independent gatekeeper passes; the final review reports zero actionable P0-P3 findings at 0ffb5a53b425500336854902c7068cd2233695f4. Refs #1008. |
||
|
Pascal André
|
1932da9307
|
feat(automation): shared page engine with budgeted outlines, select and replacing type (#1015)
codenomad.inspect/act could not fill real forms (#1008): type appended to a prefilled field, native <select> could not be changed, and inspections were a flat JSON list silently cut after 750 nodes. Page automation now lives in a transport-agnostic engine under packages/server/src/automation/page/, used by DeveloperCdp for the CodeNomad window and designed to carry the browser preview next: - snapshot.ts renders the accessibility tree as an indented plain-text outline with refs. Wrappers, unnamed images and text repeating a name computed from contents are dropped; fields show their value (numeric ones included) instead of inner nodes; native selects list options with selected/disabled. A 32 000-character budget is shared among siblings: small parts stay whole, large ones collapse in place with "(+N hidden)" or keep their first and last items around "(+N more)". inspect accepts ref (one subtree) and query (exact role, or text in name/value/description, with contents and ancestors). - refs.ts names a DOM node per target, run and navigation epoch; a ref keeps its name and stays usable for the whole page generation. - actions.ts acts through fixed page functions whose inputs travel as protocol arguments. type refuses disabled fields and fields that cannot take focus (closed disclosure, modal dialog), so text never lands in another field; it replaces the field's text by default, clear: false appends (email/number through their value). Date/time/number/range/color values are validated before anything changes and keep the browser's normalization. select picks options by label, else value, dispatching input/change only on a change; clicking an option ref picks that exact option. Results return the field value or chosen labels; page exceptions are reported. The trust model is unchanged and documented: in the CodeNomad window page functions run under __codenomadAutomationDepth, clicks stay programmatic and native text insertion yields only input events, so automation can never produce the trusted dock interaction a human Form answer requires. Validation: snapshot unit tests (exact outlines, query, scope, fair collapse, budget property), updated controller/plugin/route tests, and a real-Chromium regression driving DeveloperCdp over the DevTools endpoint, including the real Mission editor (title replaced, chosen playbook reaches the created mission) and every reviewed edge case. Full server suite green apart from a load-only 5 s timeout in index.test.ts that passes alone; isolated native automation fixture passes on OpenCode 2.0.31. Three gatekeeper rounds; the last found no P0-P3 issue. Closes #1008. |
||
|
Pascal André
|
8cecb08704
|
feat(settings): compact Settings, unified notification routing and autosaving Missions preferences (#1014)
Settings had grown long captions, inconsistent groups and two separate notification circuits, and Missions preferences used an explicit draft with Save/Reset/Reload that no other section needed. This pass makes the screen shorter and the behaviour uniform without changing what is stored. Compact layout. Rows keep a title; secondary explanations move behind a focusable "i" tip (settings-info-tip.tsx). Folded parts share one quiet disclosure style (settings-disclosure.css). In-group row lines use a new --border-row token, fainter than the --border-divider between groups. Providers splits Models and Web search into folded cards; Web search starts closed and mounts nothing until opened, so its metadata is read on demand. The separator between them spans the content pane. A global `details > :not(summary)` box-sizing rule fixes folded content inheriting the details slot's content-box, which made full-width selects overflow. Unused messages are removed in all ten locales. Notifications. Every showToastNotification declares a category, and Settings > Notifications routes each category to On screen / History / System from one table (lib/notification-routing.ts). Errors always reach the screen and History so a rejection is never lost; transient progress messages stay on screen only. Session needs-input and completion use the same routing. Saved legacy choices (OS notifications off, needs-input/idle toggles) seed the table until it is first saved. The tab-bar bell now always opens History. Keyboard shortcuts. The catalog lists the 24 initially unbound palette commands too (73 actions), reusing their translated names and keeping existing aliases as one row. Missions preferences. Each choice is written at once, compare-and-swapped against the value stored at its turn. Edits made during a write stay enabled (disabling a focused control drops keyboard focus) and queue behind it. A rejected or unconfirmed write is never resent: later queued edits built on it are dropped and a read-only reload shows the stored values. Reload appears only when that read fails or the document is unreadable. Agent/model choices now use one Agent/Model/Reasoning row per role in every scope and at creation, with no second selector level, sub-fold or Debugging special case. In a mission type, rows show the inherited global values with a "Global" mark. Editing a field customizes the role from those values, and a revert icon inherits again. Inherit, explicit native default and a selected profile stay distinct. Reset (confirmed) lives in that fold and clears only the shown scope's agents and models. The project depth saves on Enter or blur; invalid values are flagged and never written. Reads and writes make the field read-only so focus stays, and refreshing is offered only after an error or an unconfirmed write. The depth group is titled "Subsession nesting depth" and shows "OpenCode effective depth"; scope badges are gone. Validation: typecheck; unit tests for notification routing, mission i18n alignment and profile summaries; browser suites mission-defaults-models (new autosave, conflict, queue, reset and inherited-row tests), mission-control, mission-editor-profiles, mission-editor-lifetime, mission-create-*, mission-panel-*, websearch-settings, preferences-startup(-state), plugin-controls, project-tab-close, new-instance-launcher, tab-chrome, appearance, git-history and hotkeys-settings. Review fixes. Missions defaults: a queued edit now touches one role, or one scope's task-session policy, and is refused when that stored value is no longer the one it was made from. A choice made while a rejected write was being reread could otherwise copy the whole scope from a stale view, resend the rejected choice and erase another window's change. Independent edits still apply to the value stored at their turn. The Settings rows report one role at a time (MissionProfileControls.onRoleChange); creation keeps its whole-request change. Project depth: pressing Inherit keeps focus in the field, so leaving the field for the button no longer saves the typed value first and loses the click; it stays focusable while a read or write runs. A write acknowledged after the section was left is accepted and reread on the next activation instead of being shown as unconfirmed. Escape discards an unsaved value without writing. Notifications: the routing table builds a quick second click on the pending table instead of reverting the first. Routing is read untracked so effects that notify do not rerun on every settings change. The link-open error goes through routing. Web notifications without permission are skipped silently. Wording that still mentioned a global enable switch now names the System column. A never-saved former system switch deliberately takes the new defaults (product decision); a unit test records it. Settings: info tips toggle on tap for touch screens (Kobalte tooltips ignore touch hover and close on click, and a tap first focuses the trigger, so the target state is decided at press time). Settings switches expose role=switch. The palette strip remeasures when it mounts late. AGENTS.md now records the measured palette layout, the Settings switch round exception and the shared OpenCode disclosure styles; dev-docs/MISSIONS.md the autosave semantics. Removed dead CSS and the unused MissionTaskModeControls children prop; the depth input uses the field surface and its info tip sits outside the heading. Validation: typecheck; unit tests for routing, profile role edits and mission i18n; browser suites mission-defaults-models (new queued-role and touch tip tests, updated rejection test), mission-control (Inherit after typing, write acknowledged after leaving, Escape), mission-editor-profiles, appearance, hotkeys-settings, mission-settings-brief, notification-icon-badge, plugin-controls, preferences-startup(-state), preferences-window, provider-accounts, git-history, remote-access/control-settings, websearch-settings. |
||
|
Pascal André
|
b4f1dde4f8
|
feat(missions): coordinator hand-offs, task interrupts and native decision evidence (#1013)
Completes the coordinator frictions of #1009 left after #1011 (points 4 to 9) and repairs the recurring Wayfinder human-mark journey checks. mission.interrupt({ taskKey }) stops a retired native task's conversations through the authenticated bridge: the coordinator's direct children whose first user message carries that task's canonical assignment header. Each family is interrupted deepest first, then the conversation, with lifecycle Stop's post-interrupt recheck, settle and quiet verification; queued inputs are cancelled under the worktree-deletion fence. It refuses while any open task lives in that conversation's family (reuse or nesting chains, or its actor), and never touches the coordinator, other tasks or the plan. mission.prepare creates a paused one-time hand-off through the editor's prepareMissionCreation pipeline, holds and fences, and never starts it. A trusted preparedBy gives the preparing coordinator read-only visibility (inspect({ missionID }), inspect({ list: true })), never control. Retries read the journal's creation event first and are reported uncertain, never as nothing created. mission.inspect({ taskKey }) adds the task's observed native conversations as advisory evidence; the task-key parser is shared with the UI. A native Wayfinder decision readout may omit its artifact: the gate's discover() derives candidates from exact native structure only and verifies each; only a complete discovery with exactly one candidate fills it. requestID "auto" briefings may let the server pick the revision. One replacement may merge several retired tasks, and the task reader lists every predecessor. Scheduled passages, which have no backend route, are not offered the new tools. The Q and N journeys queried a retired human-marks key pattern; they now read HUMAN_MARK_STORAGE_PREFIX, and the Q UI run exercises discovery natively. Validation: the full server suite passes (2,383 tests, 7 existing skips). Isolated native fixtures pass against a private OpenCode 2.0.31: test-missions-native, trajectory, contract, family-control, and recurring journeys ABCD and QN. The task-reader browser suite and bundle regression pass; typechecks show only existing diagnostics. Three gatekeeper rounds; the last found no P0-P3 issue. Closes #1009. |
||
|
Pascal André
|
1173beb37c
|
fix(missions): compact coordinator tool results and state the decision rule (#1011)
Coordinators driving a real Wayfinder mission hit three costly frictions (#1009): every mission tool mutation echoed the whole map (about 50 KB after ten tasks), the canonical assignment prompt only existed inside that response, and the decision role read as a self-contained analysis although completing it requires the human's own answer to a native question. mission.delegate, revise, report and briefing now return a compact readout (missions/tool-result.ts): disposition, current revision, status, run state, frontier and the affected tasks, plus the contract and exact assignment prompt for a declared native task. Briefs, reports and the objective stay out; mission.inspect keeps the full map, and mission.inspect({ taskKey }) rereads one task with its contract and current prompt. The returned revision feeds expectedRevision and basedOnRevision directly. Reports name the task the control actually resolved, including an independent actor's omitted taskKey. The native Wayfinder decision role, the coordinator contract and native decision declarations state the rule verifyHumanDecision enforces: the task's own conversation asks through the native question tool and the user answers in CodeNomad; self-contained analysis belongs to research. Independent-mode coordinators, which that gate does not check, do not get it. The refusal shows the exact provenance shape the gate validates, kept aligned with nativeDecisionProvenance by a test. Refusals for a withdrawn readout and unsettled withdrawn work explain what to do, a briefing citing missing or retired tasks names them, and the Missions skill matches. No journal, gate, ownership, RPC or UI contract changes. Interrupting a retired task's native child, multi-task replacement, a paused-mission creation tool, native execution visibility and Form IDs remain open. Validation: 1,104 Missions server tests pass (one existing skip), with new compact-result, task reread, retired readout, briefing source, implicit report key, refusal shape and decision-rule tests. The isolated native Missions, trajectory and contract fixtures pass against OpenCode 2.0.31. Server typechecks show only the existing diagnostics. Two gatekeeper rounds; the second found no P0-P3 issue. Refs #1009. |
||
|
Pascal André
|
d840271d6b
|
fix(files): keep large Changes lists responsive across refreshes (#1006)
## What changes for the user Files → Changes stays responsive on checkouts with thousands of changes. - **Long lists show 200 files per section.** The rest is behind a "N files not shown · Show 200 more" line, which moves focus to the first newly shown file. Section counts stay the full totals. - **Selected files stay reachable.** The current, previewed and bulk-selected files always appear, right after the first 200 if needed. - **Refreshes no longer rebuild the list.** When a filesystem change leaves the status unchanged, nothing is redrawn. When a file changes, only its row updates. ## Why On the installed build, a checkout with 2,680 git changes froze the app while Files was open: clicks took about a minute and WebView2 reached 4–8 GB. CDP showed: - about 62k of the page's 66k DOM nodes under the Changes list; - 38% of a CPU profile in DOM `insertBefore`/`remove`. Every native `filesystem.changed` refresh produced fresh objects, so the keyed `<For>` recreated every row. Each row also scanned the selection twice. The body stays mounted while hidden in Workspace/Commits, so the cost applied there too. ## How - `reuseUnchanged()` in `git-changes-model.ts`: - an identical status keeps the previous array, so nothing recomputes; - a changed status reuses the objects of unchanged records. - The new `git-change-window.ts` holds the 200-row window and its reveal state. The reveal survives refreshes and resets on worktree change. - `createSelector` gives each row its selection state without a per-row scan. Shift-ranges follow the rendered rows. - The unused `entry` back-reference on `GitChangeListItem` is removed, since it would go stale once items are reused. ## Measurements Real `FilesPanel` fixture with 2,770 rows (700 staged, 2,070 unstaged), Chromium. These are dev builds, so absolute times are pessimistic. | | Before | After | |---|---|---| | DOM nodes after opening Changes | 63,197 | 9,216 | | Refresh with nothing changed | 63,010 nodes replaced, 32.7 s blocking | 0 nodes, ~3 ms | | Refresh with one file changed | 63,010 nodes replaced | that row only (23 nodes), ~10 ms | | Selecting a row | 2,777 attribute changes | 4 attribute changes, plus the auto-selected row leaving | ## Validation - **UI typecheck:** clean. - **Unit tests:** 23/23 (model, row window, hook, files-panel state). - **Browser:** - new `git-changes-scale` 3/3: row cap, zero mutations on an identical refresh, single-row update, Show more focus and persistence, worktree reset, cross-section ranges, stage button, preview past the limit, drag-and-drop; - `git-history` 20/20; - `git-init` 3/3. Oversized files touched: - `useGitChanges.ts`, ~580 lines; - `git-history.test.ts`, 980 lines. |
||
|
Pascal André
|
87639f0275
|
fix(transcript): reveal display-truncated text in place instead of a copy-only suffix (#1000)
## Summary #890 replaced the copy-only footer for **omitted message parts**. A second display bound from #648 remained: every rendered text block was cut at 10,000 characters with "[Output truncated for rendering; copy to access the full output]". Long subagent reports, assistant prose and tool outputs could only be read by copying, even though the model received everything. **Now:** a truncated block shows its prefix, then at the exact cut a localized line, "N more characters hidden to keep this message responsive", with **Show all**. Above a ¼ MB remainder the button reads **Show 250,000 more**. It reveals the rest in place. - **Reveal state** sits next to #890's part reveals (`record-display-cache`), keyed by instance/message/part/section. It survives virtualization and session switches and resets with the instance. - **Reading position** is held while the text grows. Tool outputs grow inside their own pane, and focus moves to the revealed text. - **Copy, search and speech** keep reading native content. ## Bounds (from measured Chromium render cost) | Content | Shown before reveal | |---|---| | Prose: text parts, compaction summaries, subagent prompts/reports, skills | 50,000 chars (was 10,000) | | Tool output: shell, read, write, diffs, edit/patch, execute, webfetch, inputs, errors | 10,000 chars (unchanged) | | Each reveal step | up to 250,000 chars | | Syntax highlighting | off above 100,000 chars | ## Implementation - **Where bounding happens:** it moved from each renderer into the rendering components: `renderMarkdown` (with a `codeLanguage` option), `renderDiff` and a new `BoundedText`. They use a pure window helper (`lib/render-text-window.ts`) that cuts on nearby line breaks and never splits a surrogate pair. - **New pieces:** - `components/hidden-text.tsx`; - shared `reveal-focus.ts` (also used by #890's reveal); - `transcript-alignment.ts`, which holds the reveal point through the list's existing `alignElement`. - **Removed:** the dead `renderAnsi` path and the copy-only Markdown source button (with its now-unused i18n key). - **Docs:** `dev-docs/TEXT_DISPLAY_BOUNDS.md`; `AGENTS.md` extends the hidden-parts bullet. ## Validation - Unit tests: - `render-text-window`; - `record-display-cache` / instance store. - New `reveal-truncated-text` browser suite: - reveal in place; - anchor held while following the bottom; - tool pane reveal; - persistence across scrolling and session switches. - Updated suites: `full-source-copy`, `markdown-latest-request`, `mission-primitives`, `render-cost`. - 31 relevant browser files, run one at a time: 459 pass, 1 opt-in skip. UI typecheck clean. - Known follow-up: reasoning text keeps its own silent 10,000-character cut. Oversized files touched: `message-block.tsx` (~1,963 lines), `tool-call.tsx` (~998), `message-item.tsx` (~828), `tool-call/renderers/task.tsx` (~581). An independent gatekeeper review will be published before the admin merge. |
||
|
Pascal André
|
16fad5279e
|
fix(usage): explain the ChatGPT token-sharing quota limitation (#999)
OpenAI's "Sign in with ChatGPT" login can be used for chat, but OpenAI does not currently expose its quota through the Codex usage endpoint. The Usage panel previously presented this as a temporary failure and suggested that reconnecting might restore it. The native Codex reader now detects this exact selected login and returns a dedicated, credential-free reason, so the panel explains the limitation in all ten UI languages instead of calling it a temporary outage. No quota request or account fallback is attempted for this login, and its caches are cleared if the selected account changes. This is a diagnostic explanation only. It does not restore quota access for this login. The legacy Codex browser/device login keeps its existing reader and continues to show quotas. The same limitation is documented in dev-docs/PROVIDER_ACCOUNTS_UX_PLAN.md, with OpenAI's confirmation linked. Validation: 19 server tests pass (native selection, account changes, cache revocation, routes, credential redaction); 14 provider-usage browser tests pass (English/French 320 px, account-change recovery, isolated Vite cache). Typechecks report the same baseline diagnostics as before the change, with ES2022 libraries: 14 server errors and the known UI help-url.test.ts error. No installed build or shared service was restarted. Independent gatekeeper COMMENT review found zero actionable P0-P3 findings at 6742620d0153ae1fee6b3f7e0c25b4a8d4dfdf5b. |
||
|
Pascal André
|
008e53aa27
|
docs(sidecars): keep rejected-isolation history out of the architecture notes (#1003)
Documentation only. Removes the 'isolation was evaluated and rejected' sentence from \dev-docs/architecture.md\: the architecture notes describe how SideCars work (trusted same-origin extensions), not the alternatives tried. \AGENTS.md\ and the architecture-guide reference kept a pointer to that sentence; they now state the reason directly, so agents are still told not to reintroduce isolation. |
||
|
Pascal André
|
c12d473ac1
|
docs(sidecars): condense the rejected-isolation rationale to one line (#1002)
Documentation only. Replaces the bullet list added in #1001 with one sentence in the existing SideCar paragraph of \dev-docs/architecture.md\: isolating SideCars (opaque sandbox, separate origin or per-view port) was evaluated and rejected because it breaks service cookies/storage or single-port, proxied and tunnelled access. The detailed measurements remain in #1001. |
||
|
Pascal André
|
1ce629b9a6
|
docs(sidecars): document SideCars as trusted same-origin extensions (#1001)
## Summary Documentation only. SideCars are now documented as **trusted same-origin extensions** of CodeNomad, replacing the "temporary exception / isolation follow-up" wording introduced with #994. ## Why The isolation follow-up was prototyped, measured and reviewed, then rejected: - **Opaque sandbox:** the frame loses cookies and storage, so the service's own login and state break. - **Separate origin:** keeping service cookies requires a same-site origin (another port or subdomain). Chromium still sends the application's `Lax` cookie across ports of the same host, and CORS alone did not block authenticated writes, so every API would need an origin barrier. - **Per-view ports:** these are unreachable through a single exposed port, reverse proxy or tunnel, and reset service storage on every opening. - **IP and single port:** with a literal IP and one exposed port, no frame topology gives both isolation and working `Lax` cookies. ## Changes - **`dev-docs/architecture.md`:** records the decision and these constraints. - **`AGENTS.md` and the architecture-guide `desktop-conventions.md`:** refer to the decision instead of a pending prototype. - **`CONTRIBUTING.md`:** no longer claims SideCar frames are sandboxed. - **`README.md`:** tells users to add only services whose content they trust. The #995 cookie filtering stays as is; no behavior change. |
||
|
Pascal André
|
54958f4e83
|
fix(tauri): prevent Windows event-loop refcount corruption (#996)
## Summary
Fix repeated Windows heap-corruption crashes in the installed Tauri
build. The pinned runtime exposes clonable, thread-safe handles whose
unsafe context graph contains Tao's non-atomic `Rc<EventLoopRunner>`.
IPC-worker clone/drop traffic races the event loop's reference count and
can free the runner prematurely.
- Use `Arc` for that internal Windows runner counter, retaining
main-thread confinement of runner state and the target's existing public
threading contract.
- Add an isolated regression using the real pinned Wry runtime's public
handle API, with a negative control that reverses only this counter in a
temporary crate copy.
- Add the Windows regression to CI and document the captured failures,
compatibility rationale and removal criteria.
This is a local compatibility correction for the runtime CodeNomad
ships. [tao#1290](https://github.com/tauri-apps/tao/pull/1290) proposed
the same counter change but was closed **without merging**, because the
underlying contract violation is Tauri moving/cloning the non-Send
target. That distinction is recorded explicitly. Related reports:
[tauri#15408](https://github.com/tauri-apps/tauri/issues/15408) and
[tauri#15793](https://github.com/tauri-apps/tauri/issues/15793).
## Validation
- `node scripts/test-tauri-runner-refcount.mjs --baseline`: **9 native
crashes / 10 negative-control processes; 5 / 5 corrected passes**,
800,000 handle clones plus teardown per process.
- `node scripts/test-tauri-input-deadlock.mjs --baseline`: keydown,
keyup, char, syschar, IME and instrumented IME-boundary checks pass; the
original/reverted negative controls reproduce their expected deadlocks.
- `cargo build --locked --release -p codenomad-tauri`: passes.
- `rustfmt --check` on the new fixture and `node --check` on its runner:
pass.
- Corrected release executable installed locally on the affected Windows
machine, retaining the existing resources and updater verification
public key; original executable and matching new symbols archived
locally.
The runtime reproduction needs no JavaScript or web page. The Virtua
0.53.5 upgrade is absent from the crashing `
|
||
|
Pascal André
|
be66133469
|
fix(sidecars): isolate application cookies from upstream services (#995)
Authenticate SideCar HTTP/WS requests before removing the configured CodeNomad session cookie, desktop session-cookie namespace and Remote Control device credential from upstream requests. Filter reserved response cookie names as well while retaining service cookies. Use the bounded Node HTTP parser for WebSocket handshakes so successful and rejected upgrades receive the same cookie treatment; preserve buffered bytes, binary forwarding and non-101 response framing. Document that this is credential filtering, not same-origin DOM/API isolation. Validation: 143 HTTP/proxy tests, 11 focused cookie/transport/preview tests, server typecheck, and isolated Chromium/Electron prototype exercises. General CI was still running at the explicitly authorized admin merge. |
||
|
heunghingwan
|
d19d1c39fa
|
fix(sidecars): keep SideCar frames same-origin so proxied requests authenticate (#994)
## Summary
Since 0.20.0, opening a SideCar panel (e.g. ttyd) shows the page but
every in-page request fails: the terminal immediately falls back to
"Press ⏎ to Reconnect". All HTTP subresource fetches
(`/sidecars/<id>/token`, …) and the WebSocket upgrade
(`/sidecars/<id>/ws`) are rejected with 401/403. Connecting to the same
service directly (no iframe sandbox) works fine.
## Root cause
The browser-frame sandbox added in 0.20.0 (`allow-scripts allow-forms
allow-modals allow-popups allow-downloads`, no `allow-same-origin`) also
applies to SideCar frames. That makes the frame an **opaque origin**, so
the browser sends its in-page requests with `Origin: null`, cross-site,
and **without the `SameSite=Lax` session cookie**:
1. `sandbox` lacks `allow-same-origin` → iframe document is an opaque
origin
2. In-page fetch/WS requests become cross-site (`Origin: null`, no
cookies)
3. `codenomad_session` is `SameSite=Lax` → never attached
4. Server enforces session auth on `/sidecars/*` → **401**; the
opaque-origin gate additionally answers **403** (`http-server.ts`,
"Opaque origins may access preview capabilities only")
Only the frame's *subsequent* requests fail — the initial navigation is
issued by the top-level page (same-origin, with cookies), which is why
the panel visibly loads before disconnecting. Browser previews already
solve this with their token-scoped capability path; SideCars have no
such path and depend on the session cookie, so their frames must stay
same-origin.
## Change
Opt-in relaxation, scoped to user-configured app-proxied content only:
- `getBrowserFramePolicy(environment, { trustedSameOrigin })` appends
`allow-same-origin` to the sandbox only when explicitly requested
(`browser-frame-security.ts`)
- `BrowserFrame` gains a documented `trustedSameOrigin` prop; arbitrary
web previews must never set it
- `SideCarView` passes `trustedSameOrigin` — restoring pre-0.20 behavior
for content the user explicitly configured (a local service on
`127.0.0.1` reached through the app's own authenticated proxy)
Security posture is otherwise unchanged: the server-side gates stay
exactly as strict (the new server tests pin this), and browser preview
frames keep the full sandbox.
`allow-scripts` + `allow-same-origin` together do let SideCar content
script its same-origin parent — the same trust level SideCars had before
0.20.0 for services the user deliberately added. A follow-up can remove
even that by issuing short-lived tokens in the iframe URL (see below).
## Tests
- **Unit** (`browser-frame-security.test.ts`): trusted SideCar policy
includes `allow-same-origin`; existing tests still assert the default
policy excludes it
- **Browser** (`tests/browser/sidecar-sandbox.test.ts`, new): asserts in
a real Chromium DOM that the `SideCarView` iframe carries
`allow-same-origin` while a plain preview `BrowserFrame` does not
- **Server** (`server/__tests__/sidecar-proxy.test.ts`, new): WebSocket
upgrade **without cookie → 401**, **with valid session cookie → 101**
(also verifies `strip` prefixMode drops `/sidecars/:id` before
proxying); HTTP with `Origin: null` → 403, same-origin + cookie → 200 —
locking the exact contract that forces same-origin frames, so the server
gates cannot be quietly loosened instead
## Validation
- CI's runnable-UI unit list: 56/56 pass
- Targeted browser suite (`sidecar-sandbox` + full
`browser-frame-native` Electron suite) under xvfb: 20/20 pass
- Full server suite: 2286/2329 pass; all 27 failures are pre-existing
Git/gpg-signing environment failures (reproduced on an unmodified tree
via stash), none touch sidecars/auth/http-server
- `tsc --noEmit` clean for `@codenomad/ui` and the server package
- Manual: `ttyd -i 127.0.0.1 -p 7682 bash` as a port SideCar (insecure,
strip) — terminal stays connected; before the fix the token fetch was
403 and the WS handshake 401
## Follow-ups (not in this PR)
- Short-lived token in the SideCar iframe URL accepted by `/sidecars/*`
HTTP + WS auth, so even trusted sidecars could drop `allow-same-origin`
(mirrors the preview capability mechanism)
- Optional `SameSite=None; Secure` configuration for authenticated
sandboxed iframes behind HTTPS reverse proxies
---------
Co-authored-by: Pascal André <pascalandr@gmail.com>
|
||
|
Pascal André
|
2428947f81
|
refactor(chat): render the transcript header as Virtua's first row (#992)
refactor(chat): render the transcript header as Virtua's first row The content above the transcript rows (permission receipts, older-history controls, empty/loading/error states) used to sit outside Virtua's data, so VirtualFollowList corrected every header resize itself: stable offsets, a browser-clamp zone, a start margin handed to Virtua on every scroll, a synthetic scroll event, and a correction shared with the rolling-window anchor. Each rule exposed a new edge case, and the last ones left blank bands when the reader sat inside the header, when a growth reverted within its frame, and for one frame after a large shrink while following. The header is now Virtua's row 0, ahead of the retired prefix, always mounted and created once. Like every absolutely positioned row, its resizes move nothing until Virtua measures them and compensates them in the same pass, so the whole header correction and its trace reason are removed (virtual-follow-list.tsx shrinks by 84 lines). The list keeps its own indexes and translates them to Virtua's internally. The header is never an anchor, the active row, a restoration target, a message or a renderItem call. A Virtualizer remount moves the header element and restores focus inside it, and it keeps hit testing while Virtua scrolls. A held native scrollbar thumb is now compensated like a roll: the content stays in place and the offset moves. Near the bottom this relies on Virtua 0.52.8+, which compensates from its recorded offset after the browser clamps. Header tests specific to the removed correction are replaced by painted-frame checks of the reader's position and blank bands (far from and near the bottom, same-frame reverts, a reader inside the header, large shrinks while following), plus focus-across-remount and hit-testing checks. |
||
|
Pascal André
|
bbab05dade
|
chore(ui): upgrade virtua to 0.53.5 to fix near-bottom shrink over-correction (#991)
chore(ui): upgrade virtua to 0.53.5 to fix near-bottom shrink over-correction Virtua 0.51 compensated a row shrinking above the reader with a relative scrollBy issued after shrinking its container; near the bottom the browser had already clamped scrollTop, so the shrink was subtracted twice and an escaped reader within the clamp zone jumped by the shrink minus its gap (70 px and 160 px measured for ordinary rows). Virtua 0.52.8 lands such a jump with an absolute scrollTo when the recorded offset is at or beyond the new end, and 0.53 keeps the same compensation rule (rows wholly above the viewport when idle or scrolling up) through an anchor-based implementation. The list's assumptions were reviewed against the new internals: Virtua's ResizeObserver and scroll listener still attach at mount, before the microtask that recreates the row observer and seeds the offset (the ref now runs at instance creation); retired zero-height rows, startMargin, keepMounted, item offset/size/index lookups and the CacheSnapshot layout are unchanged, and no imperative Virtua operation is used. The cache contract test no longer relied on the removed $estimateDefaultSize and now pins that a carried itemSize is never re-estimated via $setItemSizes and $isEstimating, with an estimating control. A new browser test shrinks an ordinary row above a reader near the bottom (gaps 0/10/40) and requires the read row to stay put on every painted frame; it fails on 0.51 (gaps 10 and 40) and passes on 0.53.5. All VirtualFollowList and session browser suites, UI unit tests, typecheck and the UI build pass. |
||
|
Pascal André
|
2f9ccea747
|
feat(history): name the conversation and worktree of workspace search results (#993)
## Why Workspace-wide conversation search listed each hit as raw native identifiers (`sessionId · messageId · kind`). A result could not tell which task, worktree or branch it came from, and another conversation could only be previewed, never opened. When the same file diverges across parallel tasks, that context is what tells results apart. ## What changes - Workspace results group consecutive hits by session. Each group shows the conversation title and a badge for the worktree that currently holds the session (its label, normally the branch). - Raw IDs no longer appear in results. - The other-session preview adds the worktree badge, the message's relative date and an **Open in session** action that opens the conversation at the hit. - No commit is shown: a conversation message is not bound to one. ## How - `stores/history-search-sessions.ts`: titles/locations come from the session store, or one native `session.get` per distinct unloaded session (older catalog pages, collapsed subsessions), at most four in flight. Display reads never add sessions to the list, end with the results view and are discarded on reconnect. - Opening hydrates only that session and its parents (`hydrateRestoredSessionChain`), stores the hit as its transcript anchor and selects it; the destination restores the bounded window through the existing anchor path. - `components/history-search-results.tsx` renders the grouped list (rows are described by their group header); `getWorktreeForDirectory` is shared with the session list. - i18n for all locales; styles in `styles/components/history-search.css`; documented in `SESSION_HISTORY_QUERIES.md` and `AGENTS.md`. ## Validation - `tests/browser/history.test.ts` extended: grouping, worktree badges, failed label read, one bounded read per conversation, accessible descriptions, preview date/badge, open at anchor. - Browser suites `history`, `header-windows`, `history-navigation`, `worktrees`: 115/115 pass. - UI typecheck passes. Not covered: landing on the message inside a real SessionView after opening (the anchor restore path itself is covered by the existing history-navigation suite), and the installed desktop app. |
||
|
Pascal André
|
3394fc7f2f
|
refactor(chat): finish transcript scroll migrations and fix known scroll follow-ups (#980)
Mission final workstream (scroll unification), after #971-#978. **Migrations:** wheel intent goes through the gesture routing's single nested-scroller decision (no second ancestor walk; SVG targets in nested output count as consumed); touch/key intent reuse findNestedScroller; the viewport observer uses trackHeightDelta; search reveal reuses scrollAxes; contentRendered no longer reads layout per streamed chunk; the constant sentinelMarginPx field is removed. **Fixes (each red before, green after):** a hidden transcript under the mission reader is no longer pinned to the bottom; an escaped reader captured at the bottom (hold triggered there) keeps its anchor; a send before hydration cancels the pending activation restore; a wheel no longer releases Virtua's imperative operation (scrollBy(0) reasserted the pre-gesture offset and undid the first notch that mounted rows). **Documented, not fixed:** two effects of a still-live Virtua index jump (session switch within its landing frame; frames at the message top during a deep reveal). Validation: typecheck; unit 68/68; after rebase on dev: message-scroll + history-navigation + mission-reader-transcript + session-rendering 160/160; full run also session-search, search-highlight, history, streaming-outline, project-tab-restore, interruption-selection, render-cost 17/17. |
||
|
Pascal André
|
d36f8a703b
|
fix(opencode-setup): offer OpenCode 2 when an old or foreign OpenCode blocks setup (#982)
# Offer OpenCode 2 when an old or foreign OpenCode blocks setup ## Problem CodeNomad prefers the `opencode` found on PATH and only installs or updates OpenCode through a verified `@opencode/cli` npm installation. When PATH held OpenCode 1.x — from the npm package `opencode-ai`, or from winget's `SST.opencode` (still 1.19.0) — setup reported no active OpenCode service and offered no action at all, only "update manually". For npm users this was a real dead end: `opencode-ai` and `@opencode/cli` both claim the `opencode` command, so npm refuses to install OpenCode 2 over it (EEXIST). ## Expected behavior **OpenCode 1.x installed with npm.** Recognized only from the package's `package.json` and the shim's actual target, never from a version string. Setup offers **Replace OpenCode 1.x with OpenCode 2** behind a confirmation. The confirmation states that the data folder is kept and that OpenCode 2 imports 1.x conversations itself; CodeNomad does not convert them. On confirm, under the existing installation lock, `opencode-ai` is removed from that npm prefix and the existing shared installation path installs and verifies `@opencode/cli`, registers PATH and implies no daemon restart. Consent carries the exact confirmed installation (`path`, `version`); the route validates it, the service compares it with current status and the installer re-checks it under the lock, refusing any mismatch. A broken 1.x install whose `--version` fails can still be replaced. Before uninstalling on Windows, every native executable owned by the legacy package (including nested `opencode-<os>-<arch>` packages used by 1.0–1.15.0) is checked for use. npm failures map to "in use", "1.x still installed" or "partially removed" (with manual instructions) from npm's error code only. If installation fails after removal, the panel reports it and offers a plain install as retry; nothing is retried automatically or by another mechanism. **Foreign installations (winget, Homebrew, curl, manual).** Never modified. The foreign version probe is asynchronous, bounded to 5 s and kills its process tree on timeout; an unknown result keeps the PATH command's priority and expires after 60 s, the setup panel's Check action forces a fresh probe, only one probe per command runs at a time, and successful results are cached by path, mtime and size. When the PATH executable is unusable or below the minimum (the notice names the minimum version), setup offers **Install OpenCode 2 for CodeNomad** into the user npm prefix, and CodeNomad then uses that managed copy. The panel says the older copy is untouched and that the terminal `opencode` may still start it. When the resolved winget package folder proves the `SST.opencode` ID, it adds that `winget uninstall SST.opencode` is optional (text only, never executed). A working foreign OpenCode 2 keeps today's PATH priority. **Mixed case.** With winget's copy first on PATH and an npm 1.x behind it, only the npm package is replaced, with confirmation. **Custom executable** chosen in settings is never overridden or installed over. ## Verified facts - npm bins: `opencode-ai` 1.18.10 / 1.19.2 → `opencode`; `@opencode/cli` 2.0.30 → `opencode`, `opencode2`. - OpenCode 1.x and 2.x share `<data>/opencode/opencode.db`; the 2.x server runs a V1 migration layer copying 1.x sessions (checked in upstream tags v2.0.0–2.0.15). - winget `SST.opencode` is a portable zip; user scope links `%LOCALAPPDATA%\Microsoft\WinGet\Links\opencode.exe` to `…\WinGet\Packages\SST.opencode_<source>\opencode.exe`; machine scope uses `%ProgramFiles%\WinGet\…`. ## Known limitations - Machine-wide winget installs and a customized winget Packages root are not covered by tests; an old executable there still gets the install-alongside action, without the winget label. - The 1.x → 2.x conversation import is upstream behavior, verified from source rather than on a real history. - POSIX symlink layouts and the POSIX process-group kill are covered by tests that run only on Linux/macOS. - A real running 1.x process holding its executable was simulated with a read-only file; npm's mid-uninstall EPERM/EBUSY parsing is tested with synthetic stderr. - For up to 5 s after startup, before the first foreign probe completes, a launch keeps using the PATH command. ## Validation - Server: 93 pass in touched areas (2 pre-existing POSIX-only skips); full suite 2341 pass, with 2 failures in untouched files (`meta.test.ts` OS-name expectation on the test machine; `binary-validation.test.ts` timing, passes alone). Coverage includes legacy shim recognition and rejections, consent, remove-then-install under lock, failure and retry, winget symlink/hardlink layouts with PATH order, winget + npm 1.x, working vs unusable foreign installs, custom executable, status/upgrade logic and route errors. - Browser: 33/33 setup tests, including replace (cancel/confirm/failure/retry), broken 1.x, the winget notice and an outdated foreign 2.x. - Real npm on Windows: `scripts/test-opencode-legacy-replacement-native.mjs` installs published `opencode-ai@1.18.10` and `1.15.0` in temporary prefixes, reproduces EEXIST, finds the nested native executables, refuses mismatched consent, then performs the confirmed replacement to 2.0.29 without starting a service. - Server and UI typechecks clean; new strings in all 10 locales. |
||
|
Pascal André
|
e41bf9401b
|
perf(chat): persist transcript scroll when it settles; drop dead render notifications (#977)
Scrolling no longer persists the transcript position on every scroll event: MessageSection records it once Virtua reports the scroll ended (40 -> 1 store writes, 1112 -> 160 rect reads over 1.5 s of wheel), and follow-mode changes (hold escapes immediately; a follow resume once the reader is at the bottom) are persisted at once because a pinned stream never settles. No reached position is lost: unmount captures are anchored on rows still laid out (shared with #972), and app shutdown, navigation and pagehide flush unsettled scrolls through messageStoreBus.flushScrollSnapshots(). An A/B trace showed markdown/text render notifications are needed to pin a following reader in the paint frame, while the reasoning-stream and bash RAF notifications moved nothing and the memory-accounting call was redundant; those are removed. Tests cover unsettled scrolls persisted on switch, unmount and flush with anchor and return-gap checks, settle-path persistence without a flush, a resumed follow, and the bus flush API. Gatekeeper rounds 1-6 resolved to zero findings. |
||
|
Pascal André
|
69683f8c34
|
refactor(chat): give transcript navigation a single owner state (#972)
Timeline clicks and search results reach a message through one navigateToMessage path; the unmarked scrollIntoView fallback, redundant setAutoScroll(false) calls and duplicate scrollToKey are gone, and the transcript step of a search reveal goes through the list's alignElement (traced writes only). Nine coupled navigation flags become one TranscriptNavigation union (unrestored | restoring | paging | idle); restore branches merge and the activation snapshot is read once, so a first gesture after a snapshot-less restore is never restored again (audit C4). Paging records whether the restore had positioned the list: a jump cancelled or failed before positioning returns to the saved passage and its window, a placement or new page load settles superseded jumps to idle, boundary paging waits while a restore loads its anchor, and a gesture cancelling a jump hands the position to the reader. Scroll snapshots replace the stored object instead of merging stale anchors (audit C9); persistence accepts only captures that identify the reader (at the bottom or anchored), and the unmount capture reads its anchor from rows still laid out. Search occurrences are revealed only by an explicit search navigation through a one-shot request; rows moved by the virtualizer repaint their highlights before paint through one bounded observer per document. Known pre-existing follow-ups (session switch 0-1 frame after a jump lands; one frame at the message top during a deep reveal) are documented. Browser regressions cover restore/paging interplay, cancellation before hydration, unmount during paging, deep and shallow search placement and highlight continuity. Gatekeeper rounds 1-6 resolved to zero findings. |
||
|
Pascal André
|
7436ac8e67
|
refactor(chat): merge explicit bottom pins and element alignment into existing loops (#978)
One bottom loop (bottomPin) that exists only while following replaces the 3-frame pinDomBottomAfterLayout chain and the eleven-variable explicit pin; leaving follow ends it, and a settled or timed-out explicit pin hands the bottom back to ordinary follow for two frames. Layout priority is written once (restoration > explicit pin > hold > follow): a restoration supersedes an active pin and reports onApplied only after landing (C5), an at-bottom restoration joins an active send pin and keeps its row count, and an at-bottom restoration whose pin loses follow is cancelled. alignElement becomes a reader-settlement hold with the former alignment's fixed 30-frame window, re-aligned every frame, never extended by layout, released by gestures, navigation, focus moving to another element in the transcript, or a lost element; one anchor measurement serves reader settlement, alignment and restoration. MessageSection derives the send-intent token with a memo and cancels pending window paging only on a new send. Browser regressions cover C5, pin cancellation and handoffs, replaced restorations, send-pin row counts, alignment within its window, Tab after an alignment and temporary viewport clamps. Gatekeeper rounds 1-5 resolved to zero findings; foreign-scroll heuristics were deliberately removed in favour of the former bounded lifetime. |
||
|
Pascal André
|
2196f1731e
|
fix(chat): keep escaped readers in place when Virtua re-estimates rows (#974)
An escaped reader near the bottom during streaming, and a reader at the long-reply hold escape, jumped back many messages. The scroll trace showed no transcript write: each measurement-reset remount kept Virtua's one-time median default-size estimate armed, which later resized every never-measured history row at once while the browser clamped before compensation. Remounts now pass the carried default size as itemSize (refreshed to the median once every retained row is measured), and a new instance is seeded with its real offset. The hold publishes its escaped position. Positioning teardown is unified (supersedePositioning, stopPositioning) and deactivation during a restoration invalidates it and releases Virtua's queued scroll. A unit test pins Virtua's internal CacheSnapshot/itemSize contract. Browser regressions cover both jumps and deactivation during restoration. Gatekeeper rounds 1-4 resolved to zero findings. |