Align root/workspace manifests and lock entries, Tauri configuration and Cargo versions for the 1.0.0 stable and preview family. Require a 1.0.0 server for the separately published remote UI while retaining every third-party dependency and the existing local remote-tunnel link.
Check committed manifest/lock consistency and stable/prerelease offline workspace installation. OpenCode dependencies, minimum and recommendation remain at 2.1.0; 2.1.1 qualification is deferred by explicit user request.
The user explicitly authorized administrator merge and subsequent dev prerelease dispatch. This does not merge #1028 into main or publish a stable release.
Adopt the OpenCode 2.1 native replay and compaction contracts, align client/plugin pins and set minimum and recommended runtime to 2.1.0. Preserve authenticated contract recognition for future/custom runtimes and explicit installation/restart boundaries.
Preserve historical conversations through official projection-based pruning revisions and independently checked migrations from 2.0.3, beta-19271 and 2.0.32. Retain ownership, execution claims, stale-selection checks and transaction fences. Update setup, help and qualification evidence.
Isolated Windows native qualification and integration checks cover pruning UI, historical reimport, Compare/Wayfinder, recurring Missions, builds and typechecks. Document broad-suite limitations and outstanding platform/package/mobile acceptance; this merge does not publish CodeNomad 1.0.0.
chore(ui): upgrade virtua to 0.53.5 to fix near-bottom shrink over-correction
Virtua 0.51 compensated a row shrinking above the reader with a relative
scrollBy issued after shrinking its container; near the bottom the browser
had already clamped scrollTop, so the shrink was subtracted twice and an
escaped reader within the clamp zone jumped by the shrink minus its gap
(70 px and 160 px measured for ordinary rows). Virtua 0.52.8 lands such a
jump with an absolute scrollTo when the recorded offset is at or beyond the
new end, and 0.53 keeps the same compensation rule (rows wholly above the
viewport when idle or scrolling up) through an anchor-based implementation.
The list's assumptions were reviewed against the new internals: Virtua's
ResizeObserver and scroll listener still attach at mount, before the
microtask that recreates the row observer and seeds the offset (the ref
now runs at instance creation); retired zero-height rows, startMargin,
keepMounted, item offset/size/index lookups and the CacheSnapshot layout
are unchanged, and no imperative Virtua operation is used. The cache
contract test no longer relied on the removed $estimateDefaultSize and now
pins that a carried itemSize is never re-estimated via $setItemSizes and
$isEstimating, with an estimating control.
A new browser test shrinks an ordinary row above a reader near the bottom
(gaps 0/10/40) and requires the read row to stay put on every painted
frame; it fails on 0.51 (gaps 10 and 40) and passes on 0.53.5. All
VirtualFollowList and session browser suites, UI unit tests, typecheck and
the UI build pass.
Desktop Tauri builds now update themselves in place on Windows (signed NSIS), macOS x64/arm64 (signed .app.tar.gz) and Linux x64 (signed AppImage), and Linux gains AppImage distribution. The application no longer shells out to `winget upgrade`; WinGet remains a distribution channel.
Updates follow the same two feeds as the server notifications: `stable` offers GitHub's latest final release when it is newer; `preview` (dev + release) offers the newest publication of any kind, ordered by publication because dev labels reuse their base version. The saved `server.updateFeed` selects the feed (otherwise the build label). Only releases carrying their signed `latest.json` are installable, so releases still building are never offered.
Native code owns URLs, keys and installers: renderers pass only the feed and, after an explicit "Install and restart", the accepted version. The manifest must announce exactly the selected version and `requireSignedVersion` binds it to the signature. Full verification precedes shutdown; installation and restart are admitted atomically with an all-window flush; timeouts, cancellation and failed cleanup discard the installer without replay. Failures belong to the installing window, survive reloads and are reported once; concurrent checks report "busy". Menu actions reach only the focused local application document. The vendored tauri-plugin-updater 2.12.0 runs its Windows exit callback only after a successful installer launch.
Publication stages four verified payloads (signed version required) and publishes each release's `latest.json` only after validating every receipt and uploaded digest; rebuilt tags drop a stale manifest first. The signing private key reaches only `tauri build` steps. Unsigned builds and PR runs publish nothing. Debian/RPM and unsupported formats use the release-page fallback. The Tauri CLI minimum is 2.11.5.
Validated by eight rounds of independent review (zero findings on both native/CI and renderer/docs), 268 native tests, script and browser regressions, real signed update trials on Windows and Linux (from loopback endpoints, before feed selection), and published-package trials on Windows, Linux and macOS x64. A production-signed dev prerelease, macOS signed updates and draft restoration across an update remain to be exercised.
Adopt the upstream fix for the hosted API's intermittent Cloudflare 525s (anomalyco/opentunnel#45): transient API failures are retried with capped backoff, errors name the HTTP status, and an unexpired saved certificate keeps serving when the check still fails. The PROXY protocol stays disabled. The adapter declares the workspace's single stable Effect 4.0.1, and the opt-in live test resolves the SDK wherever npm places it. Validated typechecks, build, 38 Remote Control tests, packaging checks, packaged Node imports and the live hosted-relay run; merged without waiting for CI at the user's request.
## Résultat
Corrige le chargement des plugins CodeNomad avec OpenCode 2.0.27 et
établit cette version comme minimum pour les prochaines releases et les
prereleases dev. Aucun déploiement de l’application active ni
redémarrage du daemon partagé.
## Cause démontrée
- Le runtime natif passe d’Effect 4.0.0-rc.112 à 4.0.1. Le bundle
précédent reproduit `cache.stackFrame` sur une CLI 2.0.27 isolée.
- Embarquer Effect 4.0.1 ne préserve pas la 2.0.26 : échec inverse
`cache.scheduler`.
- Les schémas 2.0.27 consomment `Schema.isStartingWith`, absent du
moteur 2.0.26. Le plancher est fondé sur cette rupture mesurée, pas sur
une liste de versions testées.
## Implémentation
- Pins client/plugin synchronisés à 2.0.27 ; Effect et le SDK public des
plugins sont fournis par OpenCode, hors bundles natifs
pruning/Missions/automation.
- Réglages de build partagés et régression qui interdit une seconde
copie du runtime ; smoke natif ajouté à la matrice minimum/latest.
- Diagnostic `plugin_runtime` traduit dans les dix locales ; versions
futures et personnalisées conservent la reconnaissance authentifiée du
contrat.
- Adaptations du SDK : annulation des lectures projet, références de
credentials externes et connexion fournisseur externe avec formulaire
natif, sans fallback OAuth/API key ni rejeu.
- Le runtime OpenTunnel du backend reste isolé et inchangé. Aucun
tunnel, route ou identité distant n’est modifié.
## Validation locale
- Échec reproduit sur 2.0.26 et réussite sur 2.0.27 pour les variantes
de bundle comparées.
- Suites natives isolées automation,
pruning/historique/proxy/concurrence/redémarrage et Missions réussies
sur 2.0.27.
- Régressions ciblées de build, store/serveur et navigateur (diagnostic
du minimum, connexion externe et brouillon conservé) réussies ;
typechecks UI/serveur/Electron/OpenTunnel réussis.
- Suite serveur complète et CI multiplateforme encore en validation à
l’ouverture ; aucun résultat entièrement vert anticipé.
La revue gatekeeper indépendante sera publiée ici avant fusion. Les
anciennes preuves de qualification restent historiques, pas une promesse
de support des moteurs antérieurs au nouveau plancher.
## Summary
Fix the release failure at `Set workspace versions`:
https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/38032483689
The server requested `@codenomad/remote-tunnel@0.1.0`, but release
versioning changed that private workspace to the release version. npm
then attempted to fetch the unpublished package from the registry and
failed with HTTP 404 before any binaries were built.
- Reference the internal build-time adapter with
`file:../remote-tunnel`, including lock metadata.
- Fix every existing workspace-versioning caller without changing
individual CI jobs or publishing the private package.
- Keep all external library pins and the adapter Effect isolation
unchanged.
- Add a small offline native npm regression covering stable/prerelease
versioning, clean installation and the local workspace link.
## Validation
- Regression fails with the old dependency declaration and passes with
the fix: `node scripts/test-release-workspace-version.mjs`.
- Actual complete repository manifests/lockfile pass prerelease `npm
version` and offline `npm ci`; only workspace version metadata changes.
- Clean locked workspace installation passes.
- Remote-tunnel typecheck passes.
- Full server production build including UI, plugins and remote-tunnel
bundle passes.
- Bundled remote-tunnel runtime imports successfully.
- `git diff --check` passes.
Cross-platform installers are not rebuilt locally. Existing user work is
untouched; CI is not waited on or monitored.
## Summary
- Pin `@opentunnel/client` to 0.4.1 and refresh its integrity-pinned
protocol dependency to 0.4.1.
- Consume
[anomalyco/opentunnel#34](https://github.com/anomalyco/opentunnel/pull/34):
the SDK enforces its advertised connection limit before allocating TLS
state.
- Keep the separately bundled Effect 4.0.2 copy and all CodeNomad
authorization/lifecycle behavior unchanged.
## Validation
- Reviewed the 0.4.0 → 0.4.1 source delta: admission guard/reset code
and release metadata, no incompatible interface/framing change.
- Root and server typechecks, full server/UI build.
- 27 Remote Control tests; five packaging checks.
- Bundled-runtime imports with the Electron and Tauri packaged Node
24.20.0 executables.
- No public tunnel creation, daemon restart or user configuration
change.
Adds Remote Control alongside direct/LAN access. A phone or another computer pairs with CodeNomad and continues its sessions from anywhere, without an inbound port. The transport is OpenTunnel, the blind TLS relay used by OpenCode: TLS ends inside the CodeNomad backend, and nothing has to be deployed.
- packages/remote-tunnel wraps @opentunnel/client. The server build bundles it with its own Effect 4.0.x, so the published server has no runtime dependency on a private workspace package. CodeNomad claims its own route on the device's shared identity and never deletes it.
- A remote-only loopback ingress marks its sockets as remote, so local privileges come from isLocalRequest(), never the peer address. The gate runs before CORS, auth and routing:
- exact tunnel Host, and the public Origin on mutations;
- stripped forwarding headers;
- origin-form targets only, judged as routed (decoded, cut at ';');
- host-only paths denied;
- a paired device required, except for the public UI bundle.
- Host-owned pairing: a single-use five-minute code, hashed device credentials with 30-day idle expiry, and a __Host- cookie. Revocation or eviction closes live streams. A revoked device is asked to pair again, keeping drafts.
- The Cloudflare Worker/Durable Object relay, the custom E2EE protocol and the browser transport shims are removed. Electron and Tauri keep the backend alive after the last window only while Remote Control is enabled.
Validation:
- the real createHttpServer is exercised through the ingress, plus raw-socket canonicalization tests and device registry tests;
- recovery unit and browser tests;
- an opt-in end-to-end run through the hosted relay;
- a packaged smoke import of the bundled runtime;
- five gatekeeper rounds to zero findings, and green CI on all desktop targets.
## Scope
Implement the two repository-wide Ponytail audit lists, deduplicating
overlapping recommendations. Based on current `dev@aa2776ef`, on
`refactor/ponytail-cleanup`; no direct dev changes. Initial delta:
**3,548 net lines removed**, two direct dependencies removed (and their
unused transitive lockfile entries).
## Changes and preserved behavior
- Delete superseded MVP/UI/tool-rendering/summary docs; compact the
index and canonical architecture references and remove
per-review/temp-path bookkeeping from runtime-transition history.
Preserve security/ownership rules, technical minimum rationale,
compatibility provenance and reproduction commands.
- Remove confirmed-unused UI surfaces, Electron JSON storage IPC,
obsolete release fetch/shell runners and dead
bridge/storage/command/keyboard utilities. Keep existing native
environment discovery and shared-service lifecycle untouched.
- Replace the empty first-party plugin loading layer with direct
built-in right-panel construction. External sandboxed extensions,
consent, assets authority, activation, ordering and visibility remain
intact.
- Retire the unused incremental-part message mutation engine and
exclusively owned pending-part buffers/budgets/types. The active native
reducer still publishes bounded authoritative snapshots. Preserve
optimistic send identity, pending sends, permissions, usage,
pruning/revert, memory accounting and scroll restoration. Rewrite old
tests using snapshots rather than removing relevant behavioral
assertions.
- Share speech streaming/base64 helpers, retaining playback lifecycle
and cancellation in each caller; deterministic transport regression
covers ordering, start-once, completion and failures.
- Replace three Material icons with existing Lucide icons; remove
`@suid/icons-material` and unused `ts-node` without upgrading other
dependencies.
- Drop the redundant Favorites implementation-shape test; behavioral
store/browser regressions stay. Repair two inherited tests to current
palette and lazy copy contracts, preserving image/privacy assertions.
## Validation
Server/UI/Electron typechecks, UI production build, targeted
core-panel/Favorites/audio/image/palette checks pass. Full local suites
and focused browser/native Electron regressions are in progress. The
broad server run found one existing deadline-sensitive pending-broker
test; its entire 20-test file passes in isolation. Independent
gatekeeper review is required on this exact committed head, findings
will be corrected and re-reviewed to zero before the explicitly
authorized admin merge. No user credentials/shared daemon/database were
used for testing.
## Size notes
Touched existing large files:
`packages/ui/src/stores/message-v2/instance-store.ts` ~1,450 lines,
`packages/ui/src/stores/message-v2/instance-store.test.ts` ~516 lines,
`packages/ui/src/stores/conversation-speech.ts` ~432 lines. No size-only
refactor; source/test coverage reduction is tied to proven-unused paths.
Native application is not replaced/restarted by these isolated checks.
## Summary
- Qualify and pin the generated client/plugin at OpenCode **2.0.24**,
recommended independently of the unchanged **2.0.7** technical minimum.
- **On every runtime version**, automatic Form/permission recovery uses
only the authenticated loaded-only broker. Missing capacity stops
recovery non-authoritatively; it never falls back to ordinary lists
across historical/inactive worktrees.
- Retain known requests and editor drafts through unavailable/partial
recovery and rehydration, and show a localized recovery-incomplete
status even when no request is known. Only explicit settlement
reconciliation may use ordinary lists at the attempted request's
authorized location. Keep mutation fences and settlement tombstones.
- **Remove the private reader's runtime and Effect version allowlist.**
An untested/custom/prerelease/missing version label no longer disables
recovery. Registration checks the real native RPC capability; each read
validates graph, existing-only lease, queue, codec and identity
contracts. These checks fail safely without mass-loading fallback.
Tested versions remain evidence, not grounds for blocking other
versions.
## Contract audit
The authenticated isolated 2.0.24 daemon exposes 117 native OpenAPI
paths vs 116 on 2.0.22. The new `/api/vcs/init` is not exposed by
CodeNomad. Of 167 structural schema changes, most add declared
`LocationNotFoundError` failures to location-sensitive routes; other
changes add optional `ServerInfo.capabilities.persistentPty`,
WorktreeError's literal `_tag` and the VCS-init error. Published
declaration changes: 11/30 client files (+service-probe), 3/60 plugin,
8/36 protocol and 3/102 schema files (three retired IDE/question
declarations removed). No removed declaration is imported by CodeNomad;
no consumed dependency establishes a higher minimum.
The upstream source audit leaves LocationServiceMap, Form, Permission
and RPC contracts unchanged; the Location-services wrapper changes only
its TypeScript error parameter. Effect remains rc.112. The published
native implementation chunks are hash-checked against separate receipts
before each isolated fixture run.
Native SDK service contender/probe/PTY handoff internals change, but
CodeNomad retains its selected-CLI lifecycle adapter and bounded
authenticated registration fallback rather than using
`Service.ensure/stop`. **No shared daemon restart, storage mutation or
OpenCode PR is part of this change.**
The source audit also covers compaction-agent model/budget selection,
ChatGPT's temporary remote-model synchronization removal, local-provider
discovery/cache sharing, text-capable default selection, bounded MCP
connection/catalog retries and OAuth callback timing, Windows
instruction ancestry, skill frontmatter, subagent text boundaries and
PTY runtime storage/availability. These remain native-owned; no
CodeNomad adapter change is justified by the consumed contracts.
`dev-docs/OPENCODE_V2_COMPATIBILITY.md` records the consequences and
limits: synthetic account tests are not real OAuth/provider
certification, compaction isolation does not exhaust alternate
summarizer configurations, and no desktop terminal-survival test across
service restart is claimed.
## Native loaded-only evidence
### Follow-up: unjustified version lock removed
At the user's explicit direction, remove both
`PENDING_SNAPSHOT_NATIVE_VERSIONS` and the Effect-version equality
check, as well as all version checks in registration and reader
execution. The reader no longer accepts or consults an executing-version
argument. Regression coverage registers across 2.0.7–2.0.24,
newer/custom/prerelease/missing labels and a context whose `app` getter
throws if accessed. Actual malformed/missing contracts, unsafe data,
eviction/disposal races and timeouts remain non-authoritative. The rule
against blocking untested versions is recorded in `AGENTS.md`.
The source comparison across published tags 2.0.7–2.0.24 finds an
unchanged LocationServiceMap and existing-only lookup, RPC contracts and
queue-list interfaces. Changes in older releases affect Form
cancellation feedback/state and permission rejection feedback, not queue
listing. All these tags use Effect rc.112. This is source evidence, not
a claim that all eighteen releases have passed native fixtures.
After gate removal, **29/29 reader/broker/admission tests pass**, as do
server typecheck and pruning build. Fresh published native fixtures on
**2.0.23 and 2.0.24 pass**, recovering permissions/global Forms with 100
cold candidates (three actual Git worktrees), four native boots
before/after and zero cold constructions. The fresh bounded
**full-server run on the follow-up passes: 888 passed, 0 failed, 6
skipped (894 tests, 76 suites)**. Receipts: `no-gate-server.log`,
`no-gate-native-23/receipt.json`, `no-gate-native-24/receipt.json`,
`matrix-source-inventory.json`, `server-all-no-gate-final.log`.
The follow-up also records the distinction between pinned build
dependencies and an independently updated external service in
`AGENTS.md`; no README changes. Independent read-only gatekeeper review
of the **full diff**
`1abeba78043fc6ec1fac4eb57eb6c82a541cf66e..e159068bc0a37a668814c1c5a031115dea38ed28`:
**APPROVE, 0 findings**, 59 independent targeted tests passed plus an
isolated reactive check. The review is published separately on this PR;
it is an agent review, not human approval or deployment acceptance. At
the pre-merge CI inspection, runtime contracts (minimum/latest),
OpenCode compatibility (Linux/Windows/macOS) and native pruning
(Linux/macOS) passed; general tests, native pruning on Windows and Tauri
tests were still in progress. Earlier cancelled/skipped runs are not
passes. The user explicitly requested an admin merge after zero
gatekeeper findings; no all-green CI claim is made.
The committed Bun fixture now uses the same managed `.ts` plugin
discovery shape as production, not configured-package directory
resolution. It uses an authenticated unmodified published HTTP router
in-process, with an in-memory database, private discovery paths, no
listener/service discovery and no external provider.
| Published runtime | Preloaded Locations | Locations after recovery |
Native boot logs before/after | Cold candidates | Cold constructed |
|---|---:|---:|---:|---:|---:|
| 2.0.22 | 4 | 4 | 4 / 4 | 100 (three actual Git worktrees) | 0 |
| 2.0.24 | 4 | 4 | 4 / 4 | 100 (three actual Git worktrees) | 0 |
Both runs recover three permissions, six Forms including three global
Forms. They exercise absent/present backend presence, two backends
retaining registration, expiry, return and final disposal, coexistence
with the existing Promise pruning RPC, authenticated 401 rejection,
schema limits and non-authoritative failures. The boot-log assertion
also detects briefly constructed Locations even if they later disappear
from the map.
Short-fixture RSS: 2.0.24 460,599,296 → 461,824,000 bytes; 2.0.22
463,929,344 → 461,701,120 bytes. These are receipts, **not a memory
profile or comparable deployment soak**, and do not attribute the
reported 10 GiB to this fallback.
## Validation
Environment: Windows, Node **25.2.1**, Bun **1.3.14**. All native checks
use owned processes, synthetic providers/configuration/data and explicit
isolated CLI paths; never the shared daemon or user database.
- `bun scripts/test-pending-snapshot-native.mjs <qualified-packages>
<fresh-output>`: passes separately on published 2.0.22 and 2.0.24.
- 2.0.24 native automation, pruning parent runner,
Location/worktree/proxy/event relay, environment, fork, aside, degraded
Git, prompt skills, provider usage/accounts, permission receipts and
blank-session cleanup: **12 suites pass**.
- Minimum 2.0.7 with the same 2.0.24 client/plugin dependencies: **nine
isolated suites pass** (automation, pruning,
Location/worktree/proxy/relay, environment, fork, aside, degraded Git,
prompt skills and blank-session cleanup). Operation-specific
usage/account/receipt checks do not establish a new global minimum.
- `test-compaction-isolation-native.mjs <2.0.24-cli> --context-mib 2`:
passes with native compaction and outline enabled; the second session
completes before releasing the first session's provider gate.
- Focused UI pending recovery, compaction, Forms and permission
lifecycle: **37/37 pass**. Coverage includes 100 cold worktrees on
unsupported capability, reconnection, request retention, per-kind
mutation fences, settlement reconciliation, late supported/unsupported
responses and compaction admission.
- Final browser dock/selection/mobile regressions: **44/44 pass**. The
incomplete status appears with no known request at 393 px, has no
horizontal overflow, preserves a typed answer on repeated unavailable
recovery and disappears only after full recovery. Real-shell provenance,
recursive interruptions, Android keyboards and per-conversation drafts
remain covered.
- Server/UI typechecks and shared server/UI/plugin builds: pass.
- Final full server unit run after dependency reinstall, `node --import
tsx --test --test-concurrency=2 'packages/server/src/**/*.test.ts'`:
**888 pass, 0 fail, 6 skipped** (894 tests, 76 suites). An earlier
unbounded parallel run exceeded the existing 30-second pending-broker
deadline; the bounded rerun passes without changing that deadline.
- Broad UI unit tests: **1189 pass, 2 fail**. Both failures are
reproduced from unmodified base `1abeba78` sources in an extracted tree:
`classic-dark-surfaces.test.ts` expects a removed accent-hover override;
`tool-content.test.ts` expects copy text where the renderer returns
none. These paths use OpenCode types only, no runtime client import.
This suite is **not green**; unrelated UI corrections are intentionally
not included.
- `git diff --check`: pass. Lockfile retains unrelated package
versions/integrities; npm peer metadata recalculation remains.
- Lockfile reproducibility: `npm ci --ignore-scripts --no-audit
--no-fund` passes after browser fixtures release the Windows esbuild
executable. An earlier attempt during those fixtures encountered
`EPERM`; a simultaneously launched server rerun was invalidated by
dependency removal and is not counted as product evidence.
Detailed local receipts/logs are retained under
`C:\Users\Admin\AppData\Local\Temp\opencode\q224`:
`pending-native-final/receipt.json`, `pending-native-22/receipt.json`,
`schema-audit.log`, `*-declarations.diff`,
`server-all-bounded-final.log`, `ui-pending-final.log`,
`ui-all-final.log`, `ui-unrelated-baseline.log`,
`browser-interruption-final.log`, native-suite logs and
`compaction-2mib-final.log`.
## Deployment acceptance and limits
Not deployed to the active user service. After authorized deployment,
compare passive-recovery Location boot/eviction counts and process
RSS/private memory over a comparable observation window, separating
explicit user actions. Accumulated pre-fix Locations are not
automatically evicted. Only an explicitly confirmed shared-service
restart may release them. The separate Usage-flicker work is not a
substitute for this fix.
Unknown requests cannot be exhaustively recovered on a daemon without
the capability; known requests and live events remain usable. Existing
bootstrap warming, bounded coverage, compaction admission and ownership
constraints remain documented in
`dev-docs/OPENCODE_V2_COMPATIBILITY.md`.
File-size signal: `packages/ui/src/stores/instances.ts` remains
approximately 2,300 lines; no threshold-only refactor is included.
## Summary
Prepare stable CodeNomad 0.20.1 on top of `dev@8ce70ec4`, the source of the latest requested prerelease, before publishing through `dev -> main`.
- Align root, server, UI, Electron and Tauri npm versions and workspace lock metadata to `0.20.1`.
- Align the native Tauri configuration, Cargo manifest and application lock entry.
- Require CodeNomad server `0.20.1` in the remote UI manifest, so the updated Files, provider settings and pending-request surfaces use the matching backend routes.
- Leave the dependency graph unchanged.
This preparation PR targets `dev`; only the subsequent push to `main` publishes the stable release.
## Validation
- Clean locked dependency installation in an isolated release worktree.
- Version consistency assertions across npm/lock metadata, Cargo and Tauri; dependency graph comparison against the parent commit.
- `npm run sync:version --workspace @codenomad/tauri-app` confirms all native versions are aligned.
- UI, server and Electron typechecks pass.
- Full server production build, including the UI and bundled plugins, passes.
- Remote UI selection and dev-release channel tests pass (3 tests).
- `git diff --check` passes.
Native installers and the cross-platform release matrix have not been rebuilt locally. Existing local work and suspended worktrees are untouched. CI is not being waited on or monitored as requested.
## Summary
Qualify **OpenCode 2.0.22**, align server/UI client and plugin pins, and
recommend this release. Keep the demonstrated **2.0.7** global minimum
and **2.0.20** Codex Usage feature-local requirement.
Block the new native `parentID` create variant in the workspace proxy:
upstream ignores the supplied location and inherits the parent's
directory. Require inspectable JSON objects to close opaque-body
bypasses. Root creation and the existing authorized fork route remain
available.
Started at `dev@0983db3c` (#828 Windows test harness), then integrated
`dev@97c361c3` (#789 Code Mode presentation). Conversation remains
attached to `D:\CodeNomad`; all work and tests use explicit separate
paths and synthetic data.
## Upstream audit: 2.0.21 → 2.0.22
- Authenticated native OpenAPI retains **116 paths**, with **11 schema
differences**: session creation gains optional `parentID`,
parent-not-found response/description; provider settings gain optional
`headerTimeout` and `chunkTimeout=false`; configured model capability
overrides become partial. No new proxy route or consumed mandatory API.
- Published declarations: **4/30 client, 2/60 plugin, 3/36 protocol,
4/102 schema** files change. Plugin session domains expose `remove` and
`compact`; CodeNomad does not add calls to them. Identifier namespace
export is additive.
- An isolated native fixture proves parent creation inherits the parent
location despite a different supplied directory. Mock and
production-proxy fixtures reject owned/foreign parents; malformed values
and opaque content types are covered before any native request. Owned
root creation stays available.
- Runtime changes include HTTP header/chunk/whole-response timeout
handling and bounded timeout retries, provider cache/error/tool-history
fixes, model capability defaults, and legacy MCP shutdown cleanup.
- Lock changes are limited to six `@opencode` packages and two workspace
entries. Integrity/dependency metadata matches independently installed
published packages; clean `npm ci --ignore-scripts` passes. Optional
OpenTUI peers are not installed by CodeNomad.
## Isolated local qualification
**Windows / Node 24.20.0**, isolated profiles, databases, services and
synthetic providers/credentials. No shared-daemon or personal-history
mutations.
- Previous **2.0.21 dependencies + runtime 2.0.22**: native
pruning/history/proxy acceptance passes.
- New **2.0.22 dependencies + runtimes 2.0.7 and 2.0.22**: seven suites
pass (automation, pruning/history/navigation, per-send environment,
inclusive forks, idle/busy side questions, blank-session cleanup,
Git-degraded recovery), plus explicit native proxy suites.
- Native/UI pruning acceptance passes through the committed parent
runner, with completion and actual child exit verified. This uses #828's
early dependency-import workaround, not the old late-import order. No
claim that underlying Windows heap corruption is repaired.
- Current compaction-isolation acceptance passes: session B progresses
while session A's provider response is held; bounded outline reads
retain daemon heartbeats. Fixture runtime selection is extended to
include 2.0.22; its assertions are unchanged. This supplemental fixture
was not qualified on 2.0.7 (explicit runtime selector rejects it).
- Native Codex Usage passes on 2.0.22 with synthetic OAuth/key
credentials and mocked quota HTTP; not a live-account/WSL test.
- Native migrations **2.0.3 → 2.0.22** and **beta-19271 → 2.0.22**
preserve full history/forks/inbox/provider selection.
- Packed standalone pruning plugin installed outside the repository
passes native acceptance.
- Native npm upgrade **2.0.15 → 2.0.22** passes; authenticated daemon
remains **2.0.15 / PID 43876** before and after.
- Full server run: **794 passed / 6 skipped / 0 failed**. Final guard
revision separately passes **68 focused server tests** and native proxy
suites on minimum/current. Aggregate runs use `--test-force-exit`.
- Targeted client/store/reducer/usage UI: **63/63** with
`--conditions=browser`, `--test-force-exit`, bounded timeout. Initial
broad UI run used the wrong Node conditions and hung at
`prioritized-read.test.ts`; only its owned processes were stopped. That
incomplete run is **not green**. The same prioritized-read tests pass
under the browser condition used by CI. No production fix is inferred
from this launch correction.
- **41 browser scenarios** pass: setup/install, auth recovery, tool
images, rendered Codex Usage and compaction responsiveness. Browser
tests do not use forced exit.
- Server/UI/Electron typechecks and production server/UI/plugin builds
pass. Revalidation after #789 integration and independent gatekeeper are
reported separately below.
Local results do not certify all real providers, Linux/macOS/WSL, or
installed Electron/Tauri hosts. Historical Windows import and Git
cleanup failures remain limitations, not repaired by this upgrade.
Remote CI is not continuously monitored and no global CI-green claim is
made.
Size note: existing `packages/server/src/server/http-server.ts` is
~2,359 lines;
`packages/server/src/server/__tests__/instance-proxy.test.ts` is ~1,139
lines. Changes are narrowly scoped; no unrelated size-driven refactor.
## Independent gatekeeper
Review launched on exact head `0a7615476034eabbff54967aacc8a93ab0e6ab12`
against `dev@97c361c33f6fa7de30be5dde31c0e26e12bab574`; verdict will be
published before any admin merge. Findings will be corrected and
reviewed again until zero actionable findings.
Align server/UI client and bundled-plugin pins with OpenCode 2.0.21 while keeping the demonstrated 2.0.7 application minimum and the separate 2.0.20 Codex Usage requirement. The native contract changes only by optional form-cancellation text, so existing callers need no production adapter or proxy expansion.
Extend recommendation/status coverage and update maintained architecture and compatibility references. Scope the lockfile to published OpenCode packages, including optional OpenTUI peer metadata, without refreshing unrelated dependencies.
Qualify minimum/current native suites, generated cancellation with and without a message, selected native Codex credentials, ordinary pruning/UI acceptance, standalone plugin, historical migrations and isolated upgrade retaining daemon version/PID. Typechecks, builds, 71 UI tests and 32 browser cases pass. Preserve the full server suite cleanup EPERM and its successful focused rerun as separate evidence rather than claiming a fix.
Synchronize server/UI client and plugin pins with OpenCode 2.0.20 while retaining the demonstrated 2.0.7 step-timestamp minimum. Review the authenticated runtime contract: existing routes remain stable, while credential operations and optional connection/error metadata are added without requiring production adapters.
Protect the workspace proxy boundary with credential export/create rejection coverage and verify optional provider response bodies survive UI normalization. Update the maintained compatibility and architecture references, including explicit native service startup with the new disabled setting and the unresolved historical Windows import failure.
Validate minimum/current native runtimes, ordinary pruning/UI acceptance, standalone plugin installation, historical migrations and native npm upgrade with daemon version/PID preservation. Clean-install the scoped lockfile and revalidate typechecks, production builds, 745 server tests and 66 UI tests; browser qualification covers 30 scenarios.
Align server/UI client and bundled plugin pins with OpenCode 2.0.19 while retaining the demonstrated 2.0.7 timestamp minimum. The authenticated native schema and published declarations preserve the consumed API contract; runtime improvements concern compaction, context limits, provider cache affinity and Shell conventions.
Extend setup version coverage and update the maintained compatibility and architecture references. Add per-import native/UI fixture diagnostics after late Vite loading stopped on both the new runtime and the 2.0.18 control; do not claim that eager-import diagnostic acceptance fixes that failure.
Qualify both minimum/current native runtimes, historical migrations, isolated npm upgrade without daemon restart, standalone plugin installation, UI/browser behavior and production bundles. Retain the original Windows fixture failures and their bounded diagnostic results in the PR evidence.
Align server/UI client and bundled plugin pins with the latest stable runtime while preserving the demonstrated 2.0.7 timestamp minimum. Review the published declarations and authenticated native schema: pairing and Shell signal additions require no CodeNomad API adaptation.
Make the isolated native upgrade fixture follow the recommendation while retaining its 2.0.15 source boundary and live-daemon PID assertion. Extend setup version coverage and update the current compatibility and architecture references.
Validate both minimum/current native runtimes, historical migrations, server/UI tests, setup and tool-image browser scenarios, typechecks and production bundles. Record the intermittent Windows Node pruning/UI heap exit and successful diagnostic rerun without claiming its cause is fixed.
## Summary
Prepare the stable 0.20.0 version on top of `dev@25e07c74` before the
release PR from `dev` to `main`.
- Align the root, server, UI, Electron and Tauri npm versions and
workspace lock metadata to `0.20.0`.
- Align the Tauri Cargo manifest, Cargo lock entry and native config
version.
- Require CodeNomad server `0.20.0` in the remote UI manifest: the new
V2 frontend cannot use the old 0.19.x V1 backend contract.
- Leave the dependency graph unchanged.
The stable publication workflow reads the root version on a push to
`main`; this preparation PR targets `dev` and does not publish the
stable release.
## Validation
- Clean locked dependency installation in an isolated release worktree.
- Version consistency assertions across npm manifests, lock metadata,
Cargo and Tauri config; dependency graph comparison against the parent
commit.
- `npm run sync:version --workspace @codenomad/tauri-app` confirms all
native versions are already aligned.
- UI, server and Electron typechecks pass.
- UI production build passes.
- Remote UI selection and dev-release channel tests pass (3 tests).
- `git diff --check` passes.
Native installers and the cross-platform release matrix have not been
rebuilt locally in this preparation pass. No CI monitoring is started.
## Summary
- Add narrow CodeNomad routes for native OpenCode V2 plugin inventory
and activation-rule mutations.
- Present one row per user/configured plugin with exactly two compact
**Global** and **Project** switches, sharing Yolo/MCP switch geometry.
Builtins are hidden; exact configured disabled IDs remain available.
- Keep complete names, source paths, failures and configuration targets
readable on narrow keyboard/touch layouts. Retain focused rows across
refreshes and guard repeated pending activation without removing
keyboard focus.
- Provide translated feedback in all ten locales and suppress stale
feedback after the owning surface is disposed.
## Authority and refresh behavior
- Discover roots through the authenticated daemon's `config.get`, after
native-location ownership and connection-generation checks.
- Append only exact activation rules while preserving JSONC comments,
source options, unknown keys, formatting, BOM and native permissions.
Bound reads, check optimistic conflicts, serialize by write target and
use atomic replacement with nonce-owned locks.
- Require proven raw/normalized alignment before acknowledging a no-op.
Watcher lag cannot report success for a rule that is no longer saved on
disk.
- Account for inherited `.opencode` precedence by choosing a
higher-precedence target in the active project location; preserve
ancestor files and reject an escaping fallback target.
- Use native WSL filesystem operations. Retain canonical invalidation
and one trailing reconciliation when host/native cache records converge.
- Cache display snapshots by instance/worktree, share them across
sessions in that worktree, and refresh only on visible demand. Global
writes invalidate sibling snapshots without background reads.
## Compatibility
The current server/UI/bundled-plugin dependency pin and recommended
runtime are **2.0.16**, aligned with `dev`. The demonstrated technical
minimum remains **2.0.7**. Activation writes use the narrow local JSONC
operation rather than a runtime-specific write endpoint.
## Validation status and provenance
Final reviewed head: **`5204d97694ca8ced954bddc9cc94ea464e46119d`**,
aligned with `dev@9d7ea5d6`. Both independent resumed review loops
reached **ZERO actionable findings**: UX R6 and quality/optimization R5.
Local validation on the final head: **100 plugin/server/cache/WSL tests
passed**, **eight real-component browser regressions passed**, **14
restoration/metadata integration tests passed**, server/UI typechecks
and UI production build passed. Translation keys/placeholders match
across all ten locales. The current-dev baseline and PR browser
comparison passed the same 34 shared cases with one optional native
Electron skip; detailed revision provenance is in the final review
comment.
**CI qualification is excluded at the user's explicit request.** No
final CI success is claimed, and CI completion is not being awaited.
The earlier head `38845060` failed typechecking because `noticeId` was
undeclared; the earlier historical UX R4 zero-finding claim was also
incorrect and has been [explicitly
corrected](https://github.com/NeuralNomadsAI/CodeNomad/pull/726#issuecomment-5816956417).
Historical test results and the installer built from `bd31dcd0` are not
validation or artifacts of the final corrected head. See the final
review comment for completed counts, review evidence and revision
boundaries. The PR remains open.
## Scope note
Implemented independently; no code was copied from PR #593.
This separate V2 implementation supersedes PR #593.
Align the server/UI client, bundled plugin and recommended runtime at 2.0.16 while retaining the demonstrated 2.0.7 minimum. Verify the real generated-client detailed errors without duplicate proxy prefixes or failed mutation replay; retain explicit installation and daemon restart boundaries.
Independent gatekeeper audited all 63 upstream commits and the full comparison, published packages, native consumers and targeted regressions: zero actionable findings. Native pruning/UI and historical migrations pass across Windows, Linux and macOS; minimum/current runtime contracts and dedicated Tauri jobs pass. Generic browser failures were independently reproduced on the exact 2.0.15 base and documented in the published review. Admin squash merge explicitly requested by the user.
Validation includes isolated minimum/current native suites, historical migrations on Linux/Windows/macOS, targeted unit and browser tests, production builds and two independent gatekeeper reviews with zero actionable findings. Retain startup diagnostics for an unexplained intermittent Windows pruning/UI process exit; the complete instrumented Node 24.20.0 rerun passes locally. Known system-message search fixture timeouts remain documented. Admin merge explicitly requested; runtime activation and desktop installation remain separate actions.
Align the server/UI OpenCode client and bundled plugin at 2.0.11. Route canonical server.info through authenticated discovery, preserve legacy step timing, and honor hidden Forms protocol fields without rendering their inputs or dropping defaults.
Reconcile terminal tools into the bounded visible transcript and fence native reducer history reads against intervening events. Discard stale pages and coalesce trailing reads so a late settlement snapshot cannot remove a newer streaming assistant. Preserve lifecycle, generation, disposal, location and historical-data safeguards.
Qualify the latest stable runtime in CI and record the resolved version. Each CodeNomad release fixes its minimum supported OpenCode version to the latest stable available when that CodeNomad release ships. Keep one shared compatibility reference and detailed evidence in PR/CI history rather than per-version reports.
Validation includes isolated native runtime/proxy/pruning, automation, environment and fork acceptance; hidden Forms browser coverage; deferred settlement/new-execution regressions; 112 final targeted UI tests, typechecks and production builds. Gatekeeper findings were fixed and independently re-reviewed before merging.
Closes#694
## Status
This PR contains the stable 2.0.4 client migration, authenticated V2
discovery fallback and shared cross-runtime compatibility
implementation. The validation results below are local execution
evidence; the newly added CI matrix must also run on the updated PR
head.
## Published changes
- Pin UI/server to official `@opencode/client@2.0.4` and the bundled
pruning plugin to `@opencode/plugin@2.0.4`, with the corresponding
lockfile migration.
- Probe authenticated `/api/status` first. Fall back to earlier V2
`/api/health` **only on HTTP 404**, retaining the endpoint, credentials,
64 KiB response bound and absolute deadline. Authentication, transport,
server and malformed-status failures do not trigger fallback.
- Migrate the canonical UI/server contract to stable Forms, permission
decisions, command names, interrupts, renaming, forks, message lookup
and inbox delivery.
- Update the guarded proxy for stable methods/paths, native
active-session envelopes, native `cursor.next`, global Form directory
headers and current resource/plugin events.
- Follow the renamed upstream platform binary `bin/opencode(.exe)` while
retaining public CLI aliases.
Discovery success alone does not establish compatibility with an earlier
runtime's conversation APIs.
## Shared cross-runtime compatibility
### Shared cross-runtime integration
- Introduce one connection-scoped adapter under
`packages/server/src/opencode/compatibility/`, used by both the guarded
UI proxy and direct server callers, including Yolo.
- Select the contract using authenticated daemon identity rather than
the CLI executable's version. Recognize unknown publications through
authenticated, bounded OpenAPI negotiation instead of an exact
runtime-version gate.
- Bind authorization, client, transport and profile to one connection
generation. Fence actual mutation dispatch after asynchronous body
preparation; prevent late old streams from publishing or invalidating
their replacement.
- Translate earlier V2 routes, methods and payloads before sending.
Never retry a mutation speculatively after 400, 404, authentication or
transport failures.
- Normalize legacy HTTP inbox timestamps, including compaction
admission, before the pinned Solid reducer. Preserve the distinct native
SSE inbox schema and durable event metadata.
- Restore legacy catalog/content invalidation and permission-event
convergence. Preserve meaningful method/path/status/profile diagnostics
and native 401 error envelopes.
### Location authority and pruning
- Preserve legacy workspace identity internally through request
serialization, catalog/cache keys, Forms, imports, cursors, events and
exact move rollback. Modern public APIs continue to reject obsolete
workspace selectors.
- Authorize complete locations before translating directories or
synthesizing upstream Form/location headers. Keep native cursor tokens
unchanged.
- Preserve session/path ownership, worktree mutation fences and the
restricted proxy allowlist. Generic RPC, plugin management and
destructive revert commit remain blocked.
- Carry verified legacy identity through pruning membership checks,
preview and the existing transactional storage/claim fence; do not relax
deletion checks.
- Treat native idle records as control records, retaining
identity/outcome without fabricated assistant text.
- Add a common multi-runtime CI matrix and the audit/evidence register
in `dev-docs/OPENCODE_V2_COMPATIBILITY.md`, including preserved
historical architecture findings.
## Local validation
All native tests use isolated synthetic daemons, configuration and
databases, never the shared daemon or user storage.
| Check | Result |
| --- | --- |
| Same native suite on beta-19271, 2.0.3, 2.0.4 and 2.0.5 with pinned
client/plugin 2.0.4 | Passed |
| Full native pruning suite with non-null legacy workspace identity on
beta-19271 and 2.0.3 | Passed |
| Rendered UI on modern 2.0.5 and beta-19271 with non-null identity |
Passed |
| Native 2.0.5 suite inside Ubuntu/WSL, using a temporary Linux
filesystem root | Passed |
| Server tests (after CI follow-up) | 500 passed, 2 skipped |
| UI store tests | 441 passed |
| Electron native tests | 194 passed, 4 skipped |
| UI/server/Electron typechecks | Passed |
| UI/server and Electron production builds | Passed |
| Windows Tauri release executable (`--no-bundle`) | Passed |
| Electron/Tauri packaged-resource smoke checks | Passed |
| Desktop packaging invariants | 4 passed |
| `git diff --check` | Passed |
The native matrix exercises the actual shared connection, generated
client, UI fetch adapter and guarded proxy: voice-off/on instructions,
prompts, commands, session Shell, background Shell output
cursors/removal, UI/Yolo permission acceptance and rejection, busy inbox
delivery/cancellation, interrupt/wait, staged revert clearing,
session/global/worktree Forms, native pagination, export/import,
same-directory legacy identities, scoped events, foreign authority
refusal and exact rollback.
Pruning coverage includes actual storage identity and execution claims,
busy refusal, idempotency, competing admission, next-model payload, fork
isolation, pre-compaction history, restart, backend presence
disposal/reopening and crash expiry. Rendered tests cover
individual/group/response/session cleanup, confirmation counts,
persistence and reload.
## Autonomous gatekeeper review
Review/fix/retest loops concluded with no remaining actionable findings
in the reviewed transport/lifecycle/proxy,
identity/UI/events/pruning/rollback, scripts/CI and rendered-fixture
scopes.
Corrections included dispatch-generation races, compaction admission
normalization, independent negotiation cancellation, first-request
profile resolution, preservation of streamed 401 envelopes and direct
Shell/PTY identity propagation. A final rendered failure was traced to
the fixture awaiting only the first RPC of a cross-message deletion; the
fixture and regression now await every affected message. Production
deletion guards were not relaxed.
This scoped approval does not close the separately preserved historical
architecture findings.
## Validation boundaries
### CI follow-up
The first run on `a0c1c943`
([35142559235](https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/35142559235))
failed in five native jobs. The local bundle tests had missed the
standalone npm archive's missing sibling import, and Windows legacy jobs
exposed a short-path versus canonical-path project comparison. The
dependent artifact-comment job reported that same build failure.
The follow-up makes the plugin's identity primitives self-contained,
adds an isolated npm-file-list regression for all exported entrypoints,
and corrects project identity selection with alias and nested-repository
regressions. The packed-plugin failure was reproduced before correction;
the corrected installed package passes the native suite on Windows 2.0.4
and Linux/WSL 2.0.4/2.0.5. The corrected 2.0.4 shipped bundle also
passes rendered/native pruning. Fresh full beta-19271 and 2.0.3
`--legacy-pruning` suites pass under a reproducing Windows short-path
TEMP root after the final exact-directory fix. Independent final reviews
approve packaging/documentation and worktree identity with zero
actionable findings. Remote checks on the new head remain the CI
authority; these are local follow-up results.
- Full interaction with the installed desktop application through
Developer Mode was not verified because Developer Mode is inactive. The
release executable and packaged-resource checks above are build/smoke
evidence, not a fresh-install interactive certification.
- Remote run
[35146390688](https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/35146390688)
at `486e856d` passes all runtime-contract jobs, Windows/Linux native
pruning, service compatibility, general tests and both Tauri checks.
macOS passes packed-plugin loading/pruning, then times out on late
bundle discovery. The fixture now canonicalizes its root before daemon
startup to align `/var` configuration paths with `/private/var` FSEvents
paths. Late installation remains mandatory and asserts the plugin was
initially absent; failures now upload isolated diagnostic
logs/inventory/captures. Actual macOS confirmation remains pending on
the new head.
- Interactive native TUI validation was not performed.
- The passing WSL result is Linux-native execution inside WSL, not a
complete Windows-host/WSL desktop traversal. With the fixture's
configuration directory under `/mnt/c`, conversation/proxy checks passed
but late plugin discovery timed out; the otherwise equivalent
Linux-filesystem run passed. Mounted-configuration late discovery
remains a documented environment limitation.
- Other audited publications are declaration-reviewed, not individually
native-certified. The four-runtime matrix does not imply universal V2
compatibility.
- Earlier PR artifacts do not contain the completed cross-runtime
implementation; use artifacts built from the updated head. Local passing
results do not imply that the updated remote CI has completed.
## Summary
Restore selective deletion of completed assistant tool/reasoning content
after OpenCode removed `session.messageUpdate`, without forking OpenCode
or opening a generic RPC proxy.
The original draft's unconditional `maintenance_required` stub is
replaced by a working **experimental, explicit opt-in** plugin path for
the audited `0.0.0-beta-19419` runtime. The default remains read-only.
Unknown runtimes/storage and active native execution fail closed.
Nothing is installed or enabled on app startup.
## Implementation
- Keep individual/message/group/session cleanup entry points. Send
selected technical indices and a canonical SHA-256 revision, never
arbitrary replacement content, SQL, database filenames or
caller-selected locations.
- Use an ownership-checked CodeNomad broker with a fixed RPC
ID/method/location and worktree-deletion fence. Keep the removed PATCH
and generic RPC routes blocked.
- Bind the plugin's explicitly configured database connection to the
actual daemon DB with a fresh `ctx.storage` challenge. Inside a
synchronous SQLite write transaction, recheck
directory/project/workspace ownership, native durable execution claim,
staged revert/compaction state, event ownership and retained payloads.
- Rely on the audited native **write-ahead execution claim before runner
history reads**, not an `idle` check, plugin mutex or `BEGIN IMMEDIATE`
alone. Never set or release the native claim ourselves.
- CAS only the completed assistant's content array. Preserve IDs,
ordering, text, snapshots, usage and metadata. Commit a content-free
idempotency receipt atomically with the change; identical retries cannot
delete a second shifted block.
- Emit the custom invalidation after commit. Re-read via the native API,
invalidate the SDK transcript and pending rotations, and fence late
reads against newer invalidations. Add a public-API TUI cache companion
and reconnect handling.
- Correct native Windows path encoding; support more than 4,096 selected
parts within explicit request/message budgets.
- Provide an independently packable plugin with main and `./tui`
entrypoints, deployment/safety docs, and a Windows/Linux/macOS native
package CI matrix. Plugin installation remains manual and separately
approved.
## Validation performed locally
| Check | Result |
|---|---|
| Server/plugin/SQLite/broker/proxy tests | 72 passed |
| UI actions, events, SDK projection and stale-read tests | 60 passed |
| Plugin/SQLite/TUI-companion tests under Node 22 | 30 passed |
| Server and UI TypeScript checks | Passed |
| Production UI build | Passed; existing large-chunk warnings |
| Official Windows x64 beta-19419 executable | Passed on a private
daemon and generated DB |
| Independently packed and installed plugin | Same native test passed,
outside the checkout |
The native integration test uses the real beta-19271 network client
against the official beta-19419 runtime, with a local synthetic provider
and no credentials. It verifies actual preview/prune RPC, refusal while
a primary generation holds the native claim, both prompt/transaction
orderings, idempotent retry, two event subscribers, native re-reading,
the subsequent primary model payload, fork isolation, pre-compaction
history without summary changes, and persistence after server restart.
The new three-OS native CI matrix must pass on this head before merge.
No CI result is inferred from the local Windows run.
## Boundaries and remaining validation
- This is a reviewable opt-in implementation, **not general availability
across OpenCode versions/providers/platforms**. Exact runtime gating is
intentional; don't widen it without re-auditing/testing.
- Interactive official TUI, two native CodeNomad windows/scroll
behavior, WSL, provider-specific continuation state and budget/token
estimates are not claimed as validated. TUI companion tests use its
cache contract, not an interactive terminal. Two HTTP subscribers are
not two GUI windows.
- Existing bulk cleanup is per-message and reports failure counts;
dedicated installation/capability and bulk progress/cancel UI are not
added here.
- Existing summaries/native checkpoints, fork copies and already
assembled/sent requests are not retroactively scrubbed. Historical usage
remains historical usage; mock token values are not a token-savings
measurement.
- This changes persisted V2 content, not only visibility. It frees
reusable SQLite pages but does **not** promise a smaller physical file.
No VACUUM, V1 cleanup, durable-event rewriting, automatic backup
restoration or universal repair is included.
- No active user DB was changed, no shared-daemon plugin installed, no
shared OpenCode service stopped/upgraded, and no native desktop
executable/profile rebuilt or replaced. Tests use isolated synthetic
data only.
## Documentation
- [Request flow and validation](dev-docs/SESSION_PRUNING_RPC.md)
- [Audited safety boundary](dev-docs/SESSION_PRUNING_SAFETY.md)
- [Explicit deployment and
recovery](dev-docs/SESSION_PRUNING_DEPLOYMENT.md)
References: anomalyco/opencode#44984, anomalyco/opencode#48043,
anomalyco/opencode#48090 and the maintainer's plugin/RPC direction. No
upstream API or distribution fork is introduced.
## Follow-up split from #680
Per the requester, #680 now contains **only** the empty older-page fix
for #678.
This draft preserves the remaining work without blocking that narrowly
scoped fix.
Both PRs target `dev` as required by repository policy. The #678
pagination hunks
and their seven regressions are excluded from this diff; update from dev
after
#680 merges before final integration validation.
## Included
- Native staged undo persistence across hydration/reload, redo, off-page
boundaries,
and a completely undone transcript that seeks to an empty page.
- Stable usage totals for the visible, non-reverted transcript.
- Conditional native Busy handling: stage, interrupt only on Busy, wait
for execution
settlement, retry once; serialized local admissions and
ownership-checked proxy wait.
- Immediate visibility of locally and externally forked root sessions.
- Live assistant rendering and invalidatable message-block cache
identity.
- Bounded virtualizer measurements retained by stable key, with
independent pending
probes across successive resets, overflow estimation, and escaped-reader
tests.
- Nested tool-output scrolling relinquishes following on middle-button
input;
render-time scroll callbacks are cancellable and recheck their
owner/follow state.
- Browser fixtures and CI wiring for these rendering and navigation
regressions.
## Validation and open work
The consolidated state before splitting passed 482 Node/Solid UI tests,
UI/Electron
typechecks, and 12 Chromium tests in three consecutive runs. The two
subsequent
nested-scroll browser tests passed five focused runs. Those are
historical checks
of their respective source states, not a claim of full validation of
this split head.
Split-head validation (`25f4d6d3`): **315 runnable + 160 Node/Solid
integration
tests passed**, UI/Electron typechecks passed. The full browser run was
**13/14**:
the middle-button test intermittently failed its immediate ownership
assertion
(`innerFollow` still true after the click), despite its five earlier
focused passes.
This remains an open draft finding; it is not part of minimal #680.
`git merge-tree` verifies that combining minimal #680 (`dcd88aff`) and
this split
head produces exactly the original consolidated tree at `decebc28`: no
work was lost.
- [ ] Finish reproducing the user's remaining prompts disappearing and
returning.
- [ ] Verify native middle-button scrolling across real code/tool
blocks.
- [ ] Confirm session-return alignment and compare geometry with the
independent
UI-harmonization branch without merging its design changes.
- [ ] Retest the combined result after the minimal #680 lands in dev.
- [ ] Resolve required CI/review gates before marking this PR ready.
No user session or shared daemon was modified for reproductions. The
installed
Tauri application is still the earlier consolidated `817fd2c4` build; it
has not
been replaced during the split. Electron interactive testing remains
deferred.
## Maintenance
Existing oversized production files include message-block (~1905 lines),
virtual-follow-list (~1107), session-api (~1639),
instance-store (~1644), session-actions (~757), session-events (~681),
session-view (~685), use-commands (~625), and server/http-server
(~2298).
The session-request-authority test file is ~1658 lines. No size-only
refactor.
# OpenCode V2 Migration and Desktop Restructuring
## Summary
This branch replaces CodeNomad's OpenCode V1 SDK, custom plugin, and
per-workspace runtime architecture with the native OpenCode V2 client
and one shared OpenCode service. It intentionally ships no V1 runtime
fallback.
The scope includes native location ownership, Forms and Shell resources,
project-wide cursor pagination, bounded resident message windows,
streaming reconciliation, duplicate-folder instances, multi-window
Electron/Tauri behavior, content-addressed restore, worktree mutation
fencing, and reproducible desktop packaging.
The reviewed implementation head is `dea20996`. UI and server resolve
`@opencode-ai/client@beta` to `beta-18999`; the runtime CLI is managed
independently. The official comparison baseline remains `upstream/beta`
at `eb1ac54d73`.
Full details: [`MIGRATION_V2.md`](./MIGRATION_V2.md),
[`DESKTOP_V2_COMPARISON.md`](./DESKTOP_V2_COMPARISON.md), and
[`dev-docs/DEV_V2_CODE_REDUCTION.md`](./dev-docs/DEV_V2_CODE_REDUCTION.md).
## Stabilization Fixes
- Preserve manual scroll escape across pagination, remote updates,
capped-window shifts, tab changes, and desktop restore; only a local
prompt submission forces the bottom.
- Keep the timeline resident window capped at 200 messages. Ordered
window slides use Virtua shift, while reorder, pagination, and
non-aligned replacement remount with a fresh measurement epoch.
- Finalize the temporary `200 -> 201 -> 200` transition in a
generation-guarded microtask before paint and compensate followed
content growth from a `ResizeObserver` attached to the mounted Virtua
root.
- Keep all pending inbox prompts after delivered transcript messages in
native inbox admission order.
- Add a persisted `steer`/`queue` follow-up preference; the alternate
shortcut uses the inverse while idle sends remain `steer`.
- Edit a pending prompt only after authoritative inbox cancellation
succeeds, then restore its text, structured payload, files, and agent
references to the composer.
- Expose native `session.background` through the ownership-checked
proxy, a prompt action, and `Ctrl/Cmd+B`.
- Remove the duplicate model-selector "show all" action and make the
favorites toggle label reflect its current action.
- Restore permission/Form synchronization plus skill, reference,
MCP-resource, and websearch-provider reads in the reviewed proxy
allowlist.
- Validate and preserve native location workspace identities for
root/worktree requests, session moves/imports, cursors, and global
Forms.
## Capability Decisions
| Capability | Native V2 availability | CodeNomad `DEV-v2` decision |
Revisit or complete when |
| --- | --- | --- | --- |
| Assistant content mutation | `session.messageUpdate` authoritatively
replaces the text, reasoning, and tool content of a completed assistant
message. There is still no generic deletion of a complete delivered
message or mutation of user messages. | Restores individual
tool/reasoning deletion through the native update route. Arbitrary
whole-message deletion remains absent rather than locally simulated. |
Add broader deletion only if V2 exposes an authoritative operation for
the required message type. |
| Bulk tool and reasoning cleanup | No native bulk operation, but
`session.messageUpdate` can safely compose cleanup one assistant message
at a time. | Restores selected-group and full-session technical-part
cleanup through authoritative per-message updates. | A native bulk
operation is only needed if per-message updates become a measured
performance problem. |
| Delete-to-boundary / undo | `session.revert.stage` and
`session.revert.clear` use V2 staged-revert semantics instead of
arbitrary deletion. | Command-palette Undo uses `revert.stage`; Redo
clears the staged revert through `revert.clear`. | Revisit only if V2
adds broader authoritative transcript deletion. |
| Compaction | Native checkpoint compaction summarizes the older head
and retains a server-selected recent tail controlled by
`compaction.keep.tokens`. | Uses `session.compact`; there is no
message-level selective compaction. CodeNomad displays the partial
summary through the same reactive streaming path as text and reasoning,
then replaces it with the terminal summary. | Add scoped controls only
if V2 defines scoped compaction semantics. |
| Transcript pagination authority | Message pages expose only opaque
previous/next cursors. They provide no transcript revision, total,
absolute range, position, or random seek target. | Uses bounded cursor
traversal and a 200-message resident window, with defensive
reconciliation after destructive events. It cannot prove that pages
loaded across compaction or revert belong to one snapshot. | V2 adds
snapshot revision authority
([#43766](https://github.com/anomalyco/opencode/issues/43766)) and
navigable position metadata
([#44660](https://github.com/anomalyco/opencode/issues/44660)). |
| Full-session search | `session.list(search)` filters session titles
only. There is no server transcript-search endpoint returning message
identity, excerpt, navigable position, and transcript revision. |
Retained through exhaustive message-cursor traversal while keeping only
the 200-message resident window and collected matches. Large searches
still fetch every page. | V2 exposes transcript search
([#45801](https://github.com/anomalyco/opencode/issues/45801)) with a
target that composes with transcript revision and seek metadata. |
| Queued prompt management | Native inbox list, cancel, steer, and queue
operations cover authoritative follow-up delivery. The TUI's edit action
cancels a queued prompt before restoring it to the composer; it is not
an atomic inbox update. | Implements persisted primary `steer`/`queue`
delivery, inverse alternate shortcut, delivery switching, cancellation,
cancel-first composer restoration with structured payload retention, and
native-order timeline projection. | Revisit atomic editing or reordering
only if V2 adds an authoritative operation and a concrete product need
is established. |
| Background execution | Native `session.background` moves blocking
tools out of the foreground; Shell resources separately support listing,
bounded output, and removal. | Exposes `session.background` through the
proxy and UI with `Ctrl/Cmd+B`, and replaces the custom process manager
with native Shells. Unsupported controls such as rename remain removed.
| Add controls only when the native session or Shell APIs support them.
|
| Service lifecycle | V2 uses one shared externally owned service rather
than one runtime per workspace. | CodeNomad discovers or starts the
service. Stop Workspace evicts the native location after its final
logical owner is removed; application shutdown never stops the daemon. |
No parity work planned unless V2 changes service ownership semantics. |
## Validation
Migration gate (`878550ca`):
- UI and server TypeScript typechecks.
- 86 focused UI tests covering follow, pagination, queue ordering,
bottom pinning, shortcuts, delivery resolution, and model visibility.
- 64 focused server tests covering proxy ownership/location enforcement
and shared-service workspace identity.
- Production UI/server build.
- Tauri `cargo check` and all 121 Rust tests.
- `git diff --check`.
Timeline stabilization (`dea20996`):
- UI TypeScript typecheck and all 68 focused timeline, pagination,
request-authority, and restore tests.
- Tauri release build against the `beta-18999` lock.
- Native Developer Mode validation: no remount or empty frame during
capped shifts, same-cycle growth compensation, preserved manual escape,
and inactive-tab anchor restore within 0.3125 px.
## Remaining Gaps
- Active-session-location authority for MCP/plugin status.
- Optional interactive PTY, session export, and reference/MCP-resource
attachment UI.
- Desktop release signing/notarization hardening.
## Summary
- Restore the primary desktop client's window bounds, zoom, workspace
tabs, active sessions, drafts, bounded attachments, scroll positions,
and panel layout across launches.
- Keep additional Electron and Tauri processes independent: they still
start normally but do not read or write the shared native snapshot.
- Add translated settings to disable startup restoration or clear the
saved state.
## Implementation
- Persist a versioned, bounded snapshot atomically in Electron and
Tauri, preserving unknown future envelopes until an explicit clear.
- Elect one primary process with stale-owner recovery and process
identity checks, then protect renderer access with per-document
capability tokens.
- Flush renderer state before close, quit, reload, and app-owned
navigation with bounded failure handling and fresh token rotation.
- Reconcile partial or timed-out workspace hydration without losing
unsent prompt state or resurrecting explicitly cleared drafts,
attachments, sessions, or tabs.
- Correlate restore-created workspaces so cancellation and delayed SSE
events cannot produce ghost tabs.
- Harden workspace launch cancellation and cross-platform process
cleanup so failed starts cannot orphan detached POSIX, WSL, or Windows
children; incomplete shutdown exits nonzero.
The restored shell state remains local to the desktop client. Durable
semantic session properties continue to use OpenCode session metadata
separately.
## Validation
pm run typecheck --workspace @neuralnomads/codenomad
- Electron native suite: 43 passed
- Tauri suite: 54 passed
- Focused UI restore, reconciliation, attachment, authority, and race
suites passed
- Focused server workspace runtime, manager, process identity, route,
and shutdown suites passed
- pm run build
- pm run build:tauri
- git diff --check
- 16-pass adversarial review loop completed with final No findings
- extensivly optimized, tested and used day by day
## Platform notes
- Native menu reloads and app-owned navigation have awaited durability
guarantees. Browser-engine crashes or forced process termination remain
inherently best effort.
- Process cleanup uses identity-guarded platform adapters and fails
conservatively when target ownership cannot be proven.
## Summary
Yolo (permission auto-accept) currently lives entirely in the UI. Each
browser keeps its own toggle in `localStorage` and auto-replies to
permission requests over a 4-hop path (`OpenCode → server SSE → UI →
server proxy → OpenCode`). The server — which already sits on the event
stream that carries every `permission.asked` — does none of the work.
This PR makes the **server authoritative**: it owns the toggle state,
resolves family-root inheritance, and performs the auto-reply in-process
via loopback using the same `"once"` semantics the UI used to send. The
UI becomes a pure view: it toggles via REST and mirrors state from a
`yolo.stateChanged` SSE event.
## Why
- **Correctness**: the server already consumes the instance SSE stream
(`InstanceEventBridge`); auto-accepting there is the natural choke point
instead of bouncing to the UI and back.
- **Multi-client**: previously each browser had independent
`localStorage` state and never synced. Toggles now broadcast to all
connected clients in real time.
- **Headless**: Yolo keeps auto-accepting even when no UI is connected
(useful for long autonomous runs).
- **Latency**: drops from 4 hops to a single in-process loopback call.
## What changed
**Server (new, authoritative)**
- `permissions/auto-accept-store.ts` — in-memory state keyed by family
root. Faithful port of `resolvePermissionAutoAcceptFamilyRoot`:
fork/`revert` sessions root at themselves; enabling any member enables
the whole family.
- `permissions/auto-accept-manager.ts` — subscribes to `instance.event`,
builds the session tree from `session.created/updated/deleted`
(`properties.info`), intercepts `permission.v2.asked` /
`permission.asked`, dedupes in-flight replies, emits `yolo.stateChanged`
/ `yolo.autoAccepted`, clears per-instance state on
`workspace.stopped/error`.
- `permissions/opencode-replier.ts` — default replier calling OpenCode
directly (`getInstancePort` + auth header), mirroring
`background-processes/manager.ts`.
- `server/routes/yolo.ts` — `GET/POST
/workspaces/:id/yolo/sessions/:sid[/toggle]`, following existing route
conventions.
- `api-types.ts` / `events/bus.ts` — `YoloStateResponse` + the two new
event types registered in `onEvent` so they flow over `/api/events`.
**UI (pure view)**
- `permission-auto-accept.ts` — removed `localStorage`, persistence, and
drain logic; now a runtime (non-persisted) projection.
`resolvePermissionAutoAcceptFamilyRoot` is **retained as a display aid**
so the badge still lights up for child/sub-sessions of an enabled family
(preserving the inheritance UX).
- `instances.ts` — toggle calls REST (optimistic, reconciled on success,
reverted on failure); subscribes to `yolo.stateChanged`;
`ensureYoloStateSynced` backfills the active session's state on first
connect (deduped per session, reset on SSE reconnect so it re-syncs
after a server restart).
- `session-events.ts` — removed the three
`drainAutoAcceptPermissionsForInstance` hooks (the server drains now).
- `api-client.ts` — `getYoloState` / `toggleYolo`.
## Behavior parity
| Aspect | Before | After |
|---|---|---|
| Reply semantics | `"once"` | `"once"` (unchanged) |
| Inheritance | whole family (root + non-fork descendants) | **same** |
| Fork isolation | `revert` session is its own root | **same** |
| Persistence | UI `localStorage` | none (intentional, see Notes) |
| Multi-client sync | ❌ independent per browser | ✅ real-time via SSE |
| Works with UI closed | ❌ | ✅ |
| Auto-reply path | 4 hops | 1 in-process hop |
## Testing
32 unit tests added (`node:test`), all passing. Server + UI typecheck
clean.
- **Store (16)**: inheritance (parent/child/sibling), fork isolation,
cyclic parent chains, late parent discovery, `revert` re-rooting,
per-instance independence, tree maintenance.
- **Manager (13)**: real `properties.info` event shapes, v2 vs legacy
reply, in-flight dedup + retry-after-resolve, `yolo.stateChanged`
emission, `session.deleted` keeps toggle, `workspace.stopped` clears
state, `stop()` unsubscribes.
- **UI (3)**: retained `resolvePermissionAutoAcceptFamilyRoot`
display-projection tests.
## Notes for reviewers
- **No persistence is intentional** for this milestone — server restart
resets all Yolo state (matches the agreed scope). The UI mirror
self-heals via SSE reconnect + `ensureYoloStateSynced`. Persistence can
be layered on later (e.g. into `~/.config/codenomad/config.json`)
without touching the manager.
- **Family-root resolution lives in two places on purpose**: the server
resolves it to decide whether to auto-reply; the UI resolves the same
pure function to render the badge instantly (synchronous memo). Both are
faithful ports; no network round-trip is added for display.
- **`properties.info` nesting**: OpenCode wraps session records under
`properties.info` for `session.*` events (permission events are flat).
The manager handles both and the tests use the real nested shape to
guard against regressions.
- `getYoloState` / `yolo.autoAccepted` are wired but `yolo.autoAccepted`
is not yet consumed by the UI — it's available on the wire for future
observability (e.g. an audit log / toast).
## Risk / rollback
The change is additive on the server and the UI gracefully degrades to
the SSE mirror. If the server lacks the new routes (mixed-version), the
UI's optimistic toggle still flips locally and `toggleYolo` failures are
logged + reverted, so no hard breakage.
---------
Co-authored-by: Pascal André <pascalandr@gmail.com>
## Summary
- update @opencode-ai/sdk to 1.17.8
- load session lists through client.session.list with scope=project
- use a single high-limit project request because this endpoint does not
support cursor pagination
## Validation
- npm run typecheck --workspace packages/ui
## Notes
- Existing untracked .opencode/package-lock.json was left untouched.
## Summary
- Upgrade `@opencode-ai/sdk` to `1.15.13` and adapt UI types for the
current session/diff API surface.
- Add a session metadata store helper that safely updates OpenCode
session metadata via read-merge-full-replace while preserving
non-CodeNomad metadata.
- Migrate CodeNomad worktree assignments from
`.codenomad/worktreeMap.json` into `metadata.codenomad.worktreeSlug`,
with legacy fallback, stale-entry pruning, and server-side deletion of
the legacy map once empty.
- Add `.codenomad/background_processes/` to CodeNomad-managed
`.git/info/exclude` entries.
## Details
- New sessions and worktree reassignment now persist explicit session
worktree assignments in OpenCode session metadata under:
`metadata.codenomad.worktreeSlug`
- Worktree resolution now prefers session metadata, then falls back to
legacy `parentSessionWorktreeSlug`, then `root`.
- Legacy migration runs after session/map loading; after the full
session list is known, missing legacy session IDs are treated as stale
and pruned.
- The UI no longer uses `defaultWorktreeSlug`; the fallback is `root`.
- `writeWorktreeMap` deletes `.codenomad/worktreeMap.json` server-side
when no legacy parent-session mappings remain.
## Validation
- `npm run typecheck --workspace @codenomad/ui`
- `npm run typecheck --workspace @neuralnomads/codenomad`
## Summary
- Trim Electron app packaging to only include runtime shell assets and
remove unused workspace runtime dependencies.
- Copy server resources explicitly, filtering stale build artifacts and
pruning known non-runtime dependency files.
- Bundle only the Node executable instead of the full Node distribution.
## Validation
- Built macOS Electron artifacts with `npm run build:mac --workspace
@neuralnomads/codenomad-electron-app`.
- Ran packaged server CLI smoke test: `dist/bin.js --version` returned
`0.16.0`.
- Ran packaged dependency import smoke test for pruned runtime
dependencies.
## Size Impact
- macOS x64 zip: 161M
- macOS arm64 zip: 161M
- macOS arm64 app bundle: 435M
- Packaged server node_modules: 25M
## Summary
- Rename the OpenCode config template into a versioned npm-packable
CodeNomad plugin package.
- Build and package the plugin through the server bundle, with
Electron/Tauri carrying it via existing server resources.
- Replace OPENCODE_CONFIG_DIR injection with JSONC-aware
OPENCODE_CONFIG_CONTENT merging that appends the CodeNomad plugin while
preserving user config.
## Validation
- npm run build --workspace @codenomad/codenomad-opencode-plugin
- npm run prepare-plugin --workspace @neuralnomads/codenomad
- npm run typecheck --workspace @neuralnomads/codenomad
- npm run typecheck --workspace @neuralnomads/codenomad-electron-app
- node --import tsx --test \"src/opencode-plugin.test.ts\"
\"src/workspaces/__tests__/spawn.test.ts\"
## Notes
- Production plugin loading uses an explicit npm file alias for the
packaged tarball.
- Dev loading still references the TypeScript plugin entry directly.
---------
Co-authored-by: Pascal André <pascalandr@gmail.com>
Fixes#331
## Summary
- add an optional Markdown preview toggle for markdown files in the
Files tab
- add a word-wrap toggle for the source editor
- escape raw HTML in preview mode and limit preview to plain Markdown
file extensions
## Why
The Files tab only showed raw source, which makes Markdown files harder
to read quickly.
This change adds a lightweight preview/source switch without introducing
a larger viewer registry.
## What Changed
-
`packages/ui/src/components/instance/shell/right-panel/tabs/FilesTab.tsx`
- added `Preview Markdown` / `Show source` toggle for markdown files
- added a word-wrap toggle for the Monaco source viewer
- restricted preview mode to plain Markdown extensions
- escaped raw HTML in markdown preview mode
- `packages/ui/src/components/file-viewer/monaco-file-viewer.tsx`
- added configurable word-wrap support
- `packages/ui/src/components/instance/shell/right-panel/RightPanel.tsx`
- moved file-viewer word-wrap state up so it persists across tab
switches
- `packages/ui/src/components/instance/shell/storage.ts`
- added storage key for file-viewer word wrap
- `packages/ui/src/lib/i18n/messages/*/instance.ts`
- added strings for preview/source and word-wrap controls
## Validation
- `npm run build --workspace @codenomad/ui`
Fixes#359
## Summary
- include `packages/opencode-config` in the root npm workspaces
- refresh the root lockfile so fresh installs include
`@opencode-ai/plugin@1.14.19`
## Why
The CodeNomad OpenCode plugin imports `@opencode-ai/plugin/tool`, but
the plugin config package was not part of the root workspace install.
Fresh clones could skip that dependency and fail plugin startup.
## Validation
- npm install --ignore-scripts --workspaces --include-workspace-root
- npm ls @opencode-ai/plugin --workspace @codenomad/opencode-config
- node --input-type=module -e "const mod = await
import('@opencode-ai/plugin/tool'); if (typeof mod.tool !== 'function')
process.exit(1); console.log('ok')"
- npm run prepare-config --workspace @neuralnomads/codenomad
## Summary
- Adds editable path entry directly inside the folder browser dialog
while keeping browse-first behavior.
- Removes the multi-root workspace picker changes from the source
implementation.
- Refines responsive controls so mobile shows the path field first, then
New Folder and Open actions together.
## Credits
- Based on the work and request flow from #350. Thanks to the original
requester and contributor there for the folder picker path input idea.
## Verification
- npm run typecheck --workspace @neuralnomads/codenomad
- npm run typecheck --workspace @codenomad/ui
---------
Co-authored-by: Pascal André <pascalandr@gmail.com>
## Summary
- revert the Bun standalone desktop packaging path and restore the
server's original `dist/bin.js` bootstrap flow
- add a managed Node runtime for Electron and Tauri that downloads only
the current platform/arch artifact into `~/.config/codenomad`
- update desktop startup and packaging scripts so packaged apps use the
managed runtime consistently, and clean up Electron's expected
navigation-abort log noise
## Testing
- npm run typecheck --workspace @neuralnomads/codenomad-electron-app
- cargo check
- npm run build --workspace @neuralnomads/codenomad
- npm run build:mac --workspace @neuralnomads/codenomad-electron-app
- launch
`packages/electron-app/release/mac-arm64/CodeNomad.app/Contents/MacOS/CodeNomad`
and verify the packaged server reaches ready with the managed Node
runtime
## Summary
- package `packages/server` as a standalone desktop executable so
Electron and Tauri no longer depend on a system-installed Node runtime
in production
- align Electron and Tauri startup logic around launching the packaged
server, resolving binaries from the user shell, and bundling the same
server resources into both desktop apps
- replace the workspace instance proxy path that used
`@fastify/reply-from` with a direct streaming proxy so packaged
standalone builds can talk to spawned `opencode` instances correctly
## Why
Desktop production builds were still depending on a user-provided Node
runtime to launch `packages/server`, which made packaging less
self-contained and created different behavior across machines. While
moving to a standalone server executable, we also found that
Bun-compiled standalone builds could start `opencode` successfully but
failed when proxying requests to those instances through `reply-from`.
The goal of this change is to make desktop production startup
self-contained, keep Electron and Tauri behavior aligned, and restore
correct communication with local `opencode` instances in packaged
builds.
## What Changed
- added a standalone build path for `packages/server` and bundle
`codenomad-server` into desktop resources
- updated Electron production startup to resolve and launch the
standalone server executable
- updated Tauri production startup to resolve and launch the standalone
server executable with matching cwd and shell behavior
- added runtime path helpers so the packaged server can reliably find
its bundled UI, auth templates, config template, and package metadata
- improved bare binary resolution so commands like `opencode` can be
resolved from the user's login shell environment
- upgraded the server stack to newer Fastify-compatible packages needed
for the standalone/runtime work
- replaced the workspace instance proxy implementation with a direct
streaming proxy for requests to spawned `opencode` instances
- updated Electron and Tauri build/prebuild scripts to generate and
package the standalone server, while also repairing missing
platform-specific optional binaries during packaging
## Benefits
- desktop production builds no longer require Node to be installed on
the user's system
- Electron and Tauri now use the same packaged server model in
production, reducing platform drift
- packaged desktop apps can successfully create workspaces, launch
`opencode`, and proxy health/session traffic to those instances
- the server bundle is more self-contained and resilient to different
launch environments
- desktop packaging is more predictable because the required server
executable is built and bundled as part of the app build flow
## Summary
- add a server-backed HTTPS proxy flow for Tauri remote windows so
self-signed remote HTTPS works with the local CLI TLS assets and desktop
auth/cookie handling
- manage remote proxy sessions through `packages/server` with
per-session bootstrap, local-only cleanup, and explicit session
lifecycle handling
- support the Tauri desktop flow across environments, including packaged
Windows builds, `tauri dev`, and updated Linux/macOS handling for the
new local HTTPS proxy path
## Testing
- `npm run build --workspace @neuralnomads/codenomad`
- `cargo check`
- `npm run build --workspace @codenomad/tauri-app`
- Windows smoke test for concurrent remote proxy bootstrap sessions
- Windows manual validation of packaged Tauri remote connection flow
## Notes
- Windows was validated end-to-end.
- Linux and macOS code paths were updated for the new proxy flow, but
runtime validation on those platforms is still pending.
---------
Co-authored-by: Shantur Rathore <i@shantur.com>
Fixes#324
## Summary
- declare root Rollup optional dependencies for the repo's current
supported build matrix: macOS x64/arm64, Linux x64/arm64, and Windows
x64
- pin those root platform packages to the same Rollup version already
used by the repo
- keep the existing workflow/manual-install fallback steps in place for
now
## Validation
- regenerated `package-lock.json` with `npm install --package-lock-only
--ignore-scripts`
- verified the root package entry now records the supported platform
packages under `optionalDependencies`
- kept the change scoped to the platforms currently represented in
workflows and `packages/tauri-app/scripts/prebuild.js`
