Coalesce event-driven scroll observations to one per animation frame while
preserving synchronous gesture, resize and content observations. Cancel
pending observations on deactivation, reset and disposal.
Debounce transcript retention measurements to one trailing walk after a
500 ms quiet window, reducing repeated starts during deferred highlighting.
Preserve abort-in-flight and stale-result fencing. Cancel the armed frame or
timer when synchronously flushing tool-body mounts, so a subsequent queue
cannot be drained by both an obsolete callback and its new frame.
Add scheduler regressions and CI registration. Update the cache-lifetime
test for delayed accounting, select only long-to-long samples for their
timing bound, and retain a separate host-tolerant overall backstop.
Plugin target discovery includes asynchronous filesystem work, so invocation order cannot identify which mutation reaches the identity lookup first. Await Global reaching its held lookup before launching Project and a second Global mutation; assert independent-scope progress and same-target serialization using completion receipts instead of polling.
Exercise Mermaid initialization expiry through the real file-preview consumer. Deferred Markdown highlighting can remount a fence and admit a distinct initialization after the first expires, invalidating the old assertion's ownership assumption. Keep source fallback, late-import fencing and retry coverage without changing production behavior or increasing deadlines.
Document the synchronization contracts. Deterministic adverse-order reproductions fail before the test fixes; removing the existing import fence or bypassing the mutation queue still fails the updated tests. Validation on Windows with Node 24.22.3: 30 complete runs of each file (1170 plugin tests and 240 Mermaid tests), 61 server neighbours, 14 browser neighbours, both typechecks and diff whitespace checks pass.
Opening a long session performed every initial Markdown highlight and expanded
tool-body mount in the mounting task, blocking the main thread.
Commit plain Markdown first and schedule one queued highlight per idle drain.
The single-job limit covers async continuations whose parsing/highlighting
cost is invisible to a synchronous drain's wall-clock budget. Preserve render
request, disposal and cache-key fences.
Mount default-expanded settled tool bodies two per frame. User expansion and
running/error states release the wait immediately. Flush deferred mounts when
explicit key navigation or element alignment begins so timeline settlement
lands on final body layout, while ordinary session mounts keep batching.
Cover the mechanisms with real-component mount and scheduling regressions;
validate timeline placement, source copying, reveal, speech and session-link
integration against current dev.
Manage each recognized OpenCode integration from its Status → Plugins row.
Remove the separate per-integration sections and manual attachment picker;
integrations attach conversations through their native first-use contract.
Show catalogue names, package versions, integration-accent switches,
conversation binding and application warnings. The chain button attaches to a
compatible open document or detaches the captured conversation. Revoke pending
enumeration and choices on navigation, invalidation, reconnect and disposal.
Keep guarded application installation and one-shot native actions alongside
existing package controls.
Reads remain demand-driven and refresh on native events and reconnects.
Explicit refresh also retries demanded bindings for the exact displayed
conversation and Location. Preserve integration display and native actions
for inherited, virtual and runtime-only plugins through an unambiguous
runtime identity, separately from writable-source mutation authority.
Keep revision checks, consent revocation and uncertain-outcome handling;
never replay a mutation automatically.
Update help and UI strings in ten locales, documentation and captures.
Cover binding recovery, read-only origins, activation/removal scope and
native-action guards through unit and real-panel browser regressions. Qualify
the projected runtime identities with the isolated official daemon.
OpenCode 2.3 runs every subagent in the background: the call returns at once
(`metadata.status: "running"`) and the child reports to its parent through
synthetic `<subagent sessionID state …>` messages, one per idle period,
tagged `running` while background work remains. Runtime contracts on
`latest` failed for every PR since 2.3.0 because two native fixtures assumed
a foreground subagent, and the subagent card showed the model-facing "working
in the background" instruction instead of the child's result.
OpenCode 2.3.0 becomes the minimum and recommended runtime, so CodeNomad
maintains a single subagent delivery model. Daemons below it are refused with
`native_contract`. The client, schema and plugin pins move to 2.3.0 with the
`effect` 4.1.0 they require; the lockfile is regenerated with the CI's npm so
root overrides hold. Docs, the architecture skill, README, CONTRIBUTING and
the install, OpenCode, server and troubleshooting help in ten languages state
the new minimum.
- Native fixtures (missions-trajectory, subagent-nesting) require the launch
acknowledgement, an intermediate running report (metadata still
`completed`), the final report and lasting quiescence without late wakes.
Wayfinder and compare read briefs, run outputs and the judge artifact from
the final report.
- The subagent card shows the latest report delivered to that call (after its
execution start, before the next continuation of the same child; a call
continued before any report joins the next reporting period) with a
running/completed/error indicator. One reference-only index per session
revision serves every card; report bodies stay in the message store.
- Code Mode's compact JSON object/array results are displayed indented within
size and depth bounds, keeping Warnings/Logs; copy keeps the native text.
- An interrupted shell call shows its output so far as output and only the
notice under the error label, through an optional `getErrorText` hook.
Five independent review passes closed listing-order, continuation, JSON depth,
fixture timing, cache staleness, execution-start boundary, joined-period,
retention and lockfile-override findings and ended with zero findings. CI on
the exact head: 26 jobs passed, including runtime contracts at minimum and
latest (2.3.0), OpenCode compatibility and native pruning on Windows, Ubuntu
and macOS, four browser shards and all desktop builds. Locally: 30/30 native
fixtures against an isolated 2.3.0 CLI, the full server suite under Node 24,
and the pruning fixtures on the rebuilt bundle bytes; new unit and browser
tests each fail without their change.
Plain clicks on relative or absolute file links inside a conversation's
worktree open the existing file reader instead of a dead external tab.
Preserve loopback-preview routing, browser handling of modified clicks, and
normal handling of links outside the worktree.
Resolve against the session's own directory, matching worktree inventory by
directory rather than a fallback root slug. Independently moved children and
sessions absent from a populated inventory keep their own locations. Reject
URL-shaped and escaping paths after decoding and normalization.
Extract shared session-link routing and decoration, preserve author-supplied
titles, refresh owned tooltips with locale changes, and document the behavior
in all ten locales. Cover classification and real-component file/loopback
routing, unmatched inventories and independently moved children.
Deleting one session scanned all resident instance messages through store
proxies. Clearing a family repeated that scan for every member, and retained
transcript measurement also paid proxy-trap costs across every field.
Clear a session through its own messageIds index, retaining the whole-store
fallback for missing session records. Walk raw store targets for incremental
retention measurement and canonicalize every visited proxy/raw alias before
identity deduplication, including display/global cache references. This keeps
byte accounting unchanged and avoids falsely exceeding the retention cap.
Add real-browser deletion scaling and cached-tool-output accounting
regressions alongside the existing retention/LRU tests.
## Why
The Missions schedule detail showed a permanent **Check passage** button
(and paused daily schedules made it their primary action). It is a
technical reconciliation request exposed as an ordinary control, with no
context. The case that motivated it — a wake left unconsumed — now
recovers automatically (#1482).
## Change
- Unified schedules: the button is gone. A held request, partial or not,
admits no new control and settles only through its exact receipt read
(**Refresh saved request**). The Check-as-successor chaining in
`mission-schedule-controls.ts` and the `original` hold link are removed.
- Daily recurrences: Check is no longer a primary or superseding action;
a paused pending passage shows **Resume** as its primary. A Check
already recorded natively by an earlier client still classifies as a
start intent.
- The native/server `check` control is unchanged; only the UI stops
offering it.
- Removed the three UI strings (`missionsPanel.action.checkPassage`,
`missions.recurrence.checkPassage`,
`missions.recurrence.pending.checkNeeded`) from all 10 locales.
- `MISSIONS.md` / `MISSIONS_RECURRING.md` describe the current behavior.
## Validation
- UI typecheck clean; 396 UI unit tests (all Missions and i18n suites)
pass, including a new case: a held partial request offers no mutation
even when the document lists `check`, and settles by its exact receipt.
- Browser tests updated to assert the control's absence while native
still lists it, and Resume as the paused primary. They could not run
locally (the reused dependency tree lacks `@mermaid-js/tiny`), so CI is
the browser evidence.
Help: no help page documented this control.
Restores two browser tests that fail on `dev` (dev pushes skip browser
jobs, so they only show on PRs such as #1479).
- `fixture-wiring`: `mermaid.test.ts` and `opencode-logs.test.ts` now
arm `armFixtureNavigationBudget(browser)` like every other
Chromium-launching file.
- `drawer-width` rotation focus test: the first sidebar button became
the disabled Back button, so focus never entered the drawer. The test
now focuses the first enabled button and asserts the drawer holds focus
before rotating. Bisect from `bf3c48848` points to the sidebar header
reorder; the product hand-off itself is unchanged.
Validation: the four affected browser test files pass locally (19
tests).
fix(ui): generate remote HTTP UUIDs without secure-context assumptions
The Missions editor generated a criterion and request UUID during mounting using
crypto.randomUUID directly. That method is absent on LAN HTTP origins, so the
create button appeared inert in a remote Tauri window despite working through
localhost. Reproduce this in native Tauri/WebKitGTK before changing application
code, then verify the same HTTP origin opens the editor after the fix.
Reuse the existing UUID generator for all Missions creation and control paths,
panel-extension handshakes and browser-preview registration IDs. Preserve native
UUID generation where available and generate RFC 4122 v4 identifiers using
getRandomValues otherwise. Missing cryptographic entropy fails instead of falling
back to Math.random, preserving the extension handshake's security boundary.
The same HTTP audit reproduced OAuth Copy link silently doing nothing when the
Clipboard API is absent. Reuse the existing clipboard fallback for that action;
keep its copied state tied to actual copy success. Native persistence hashing
retains its local-owner fence and Mission hashes retain their existing fallback.
Add regressions for Mission creation/criterion editing, extension initialization
and session remount without randomUUID, and native/fallback UUID generation.
Update the remote Mission workflow help in all ten locales. The native GTK menu
overlap reported alongside the issue is a separate, unresolved investigation.
Refs #1472.
Render Mermaid Tiny diagrams in completed mermaid/mmd message fences and Workspace .mmd previews. Preserve copy/wrap controls, provide source/diagram switching, and keep the existing editable file source, explicit Save and conflict checks. Unsupported formats, malformed diagrams and oversized inputs retain source.
Load only Tiny and its MIT notice, with no full Mermaid fallback. Isolate rendering in a network-disabled opaque iframe and display its SVG output as an image document. Bound source, edges, SVG output, pending jobs, initialization and rendering; fence cancellation and late imports. Exclude the approximately 2.87 MB Tiny chunk (about 768 kB gzip) from service-worker precaching.
Carry fenced-token provenance and closing-line completeness with cached Markdown HTML. Raw HTML cannot forge a trusted Mermaid preview. Streaming, unfinished, truncated and ambiguously cut closing lines stay source-only until complete. Update UI strings and user help in all ten locales.
Validation: clean dependency installation, UI typecheck and production build; 37 browser tests, 27 unit checks and 31 help checks passed. Independent exact-head gatekeeper review of 243bd97dcb3be590d784681274dea8aad3ce3464 reported zero actionable findings and reran all 8 Mermaid regressions. Real Tauri 2.12.5 / WKWebView on macOS 15.8 passed rendering, source toggle, dark theme, .mmd and opaque-frame checks on that same head.
CI at administrative merge: help build passed; several draft-workflow jobs were skipped/cancelled, while native WebKit jobs remained in progress. The remaining cross-platform CI was not asserted to be green. No shared OpenCode service was started or restarted.
Closes#1468.
## Summary
- One **Repository activity → Event → optional filters** card, without
provider navigation or separate GitHub criterion entries. The native
event menu groups Git and the detected forge; a single available event
is displayed without a one-option selector.
- Reuse Contribute's repository detection, host-specific CLI selection,
anonymous public access and bounded transport for GitHub, GitLab and
Gitea.
- Support new PRs/MRs, merged PRs/MRs and new issues, with optional
author filtering. Notifications and Dependabot remain specific to
github.com. Existing GitHub and branch policies retain their exact saved
targets and source keys.
- Pin repository/account identity, reject incomplete activity windows,
freeze event summaries as untrusted passage input, and consume only
after successful settlement. Refreshing detection never silently
retargets the draft.
- Update UI strings and public help in all ten languages.
## Visual review — before merging
Captured from the real Solid Mission editor/components with
deterministic repository responses; these are rendered UI screenshots,
not generated mockups. Administrator merge is explicitly authorized,
gated on review and current-head validation.
### GitLab: merged MR with optional author
### GitHub / Gitea
### Full editor
### Narrow layouts: French and Hebrew RTL, 320 px
## Validation
- 84 server tests: shared forge connections, all three providers and
three common events, independent GitLab merge/update timestamps, author
filters, pagination/capped pages, cancellation, anonymous access,
account/remote changes, frozen input, saved documents and authorized
discovery. Upgrade regression covers exact pending GitHub input bytes
through recovery and settlement without resend.
- 12 UI unit tests: serialization, decoding, exact stored policies and
summaries.
- 59 targeted browser tests passed; focused screenshot/layout rerun: 8
passed; final invalid-author error check: 1 passed. An initial
keyboard-scroll timeout passed both its isolated rerun and the full
targeted rerun.
- Server/UI typechecks and the native Mission plugin build pass. The
production UI build passed before the backend-only review-fix commit.
- Help validation: 31 passed, including 28 pages × 10 locales.
- Full local browser suite is running separately. An unrelated
automation geometry check failed in that run and passed its isolated
rerun; full-run status remains pending. Current-head CI is the final
qualification gate.
## Review
Two blocking findings in the initial review were corrected in d350420cb:
GitLab merge-time coverage and exact serialization of existing pending
GitHub inputs. Follow-up independent review found no remaining blockers;
38 focused tests and a live GitLab response/query verified those fixes.
No merge or auto-merge has been performed yet.
## Large touched files
Changes remain localized; new modules are below the repository
thresholds.
| Path | Approximate lines |
| --- | ---: |
| `packages/server/src/server/http-server.ts` | 2,576 |
| `packages/ui/src/components/mission-editor.tsx` | 622 |
| `packages/ui/src/lib/api-client.ts` | 1,005 |
| `packages/ui/tests/browser/mission-editor-scheduling.test.ts` | 1,180
|
Group session navigation beside the panel toggle, centre Sessions, and retain New session/Search at the trailing edge. Remove the duplicate Info view and keep global OpenCode diagnostics in Settings > OpenCode.
Read the selected execution host's fixed opencode.log through the CLI's documented log directory, using bounded 128 KiB snapshots, strict selector validation, no-store responses and source-change/cancellation fences. Share the movable, non-modal output frame with native background-shell output while keeping log bytes separate from messages and model requests.
Restore saved Info selections only after native parent hydration without claiming user-selection authority. Keep output open across unrelated settings changes, and update all ten locales and affected help pages.
Validation: 76 browser tests, 6 backend tests, 15 restoration tests and 31 help tests passed, along with server/UI typechecks, production UI build and whitespace checks. Independent gatekeeper review of exact head 8ccbfeb236e17ba02c3232a8a038c122c47976e8 reported zero actionable findings; a COMMENT review records the evidence.
CI state at administrative merge: help build and completed authorization/compatibility checks passed; the remaining platform, native and browser jobs were still in progress, with no reported failing check. Those in-progress jobs are not represented as passed. The unrelated existing Missions help-anchor assertion is documented in the PR.
Closes#1465.
A child subagent transcript is never the instance's active session. Streaming
events therefore repeatedly invalidated its loaded page while the task card
was visible, exhausting bounded read retries and latching a load error. After
a session switch or remount, the card could remain empty until a successful
manual retry.
Admit watched transcripts through the same frame projection paths as the
active session, using a reference-counted visibility registry shared with
transcript memory coordination. Unwatched sessions keep invalidating their
loaded pages; history-window and request-authority fences remain intact.
The task renderer opts into a forced activation read to clear a stale latched
error on binding transitions without introducing a retry loop or changing the
main session view's retry contract.
Cover watched/unwatched child streaming, forced activation recovery and hook
forwarding, register the new store regressions in CI, and retain the browser
fixture's snapshot/error/retry contract through explicit refresh transitions.
Add bounded GitHub notification, Dependabot alert, new pull request and new issue criteria using the execution host's existing gh sign-in. Repository and author selectors flow through native baselines, frozen untrusted event context and successful-passage consumption.
Allow explicit continuation in an existing project/Location coordinator while retaining distinct passage inputs, journals and archived results. Preserve transcript, title, permissions and unrelated metadata, apply the configured profile, and let Mission controls affect the selected session's existing work. Exact native identity/publication fences, child-entry markers and aggregate sequences retain uncertainty across lost acknowledgements, background delivery, pruning and resets. Durable marker-release obligations survive history eviction and deletion waits for confirmed cleanup.
Update the editor, ten locales, help and native contracts. Independent review findings are closed; focused regressions, native qualification on both reference service versions and complete PR CI pass on the pinned head, including browser shards, native/runtime checks and desktop builds. Administrator merge is explicitly authorized by the user.
fix(security): update PWA tooling and qualify modern glob dependencies
Resolve the six sharp/serialize-javascript alerts through PWA 2, assets-generator 2 and Workbox 7.4.1. Preserve the configured icon outputs and network-only HTML/API routes. Let VitePWA add its web manifest once, avoiding conflicting precache revisions during service-worker installation.
Override only identified modern glob/minimatch consumers to patched releases, keeping historical callback/callable APIs and the OpenCode SDK/Effect versions intact. Update sucrase compatibly to its tinyglobby-based release. Merge the two selective lock deltas without refreshing unrelated Babel, Electron, Monaco, Kobalte or Rollup entries.
Add runnable regression coverage for real consumers, aborted and timed-out walks, matching bounds, workspace discovery, cache verification, deletion boundaries, TUF paths, TypeScript configurations, Workbox and ASAR. Run it in PR validation. Qualify frozen installation, typechecks, full server/UI/plugin builds and real offline PWA behavior before publication. Remaining builder, glib and contested deepmerge alerts stay tracked separately.
Retain explicit model identities while the provider catalog is still loading,
instead of silently substituting the native default. Published-catalog and
picker availability checks retain their current policy.
Reproduced the cold-catalog fallback before the fix. Local validation passed:
153 session/default/model/reconciliation/request-authority tests, UI typecheck,
and 31 help tests across ten locales. Independent gatekeeper review reports
zero findings on a942b0a9ecfa994c54bb414d67170998e6a97ded.
CI was queued/in progress at admin squash merge and had not completed. This
merge uses the owner's authorized admin flow based on the reproduced regression,
passing focused validation and exact-head gatekeeper review.
Refs #1444. The issue stays open: its exact intermittent trigger remains
unconfirmed and its live per-message model label request is separate.
## Summary
- Add **Previous User Message** and **Next User Message** to the
prompt's **More actions** menu, corresponding to Alt+Up/Down
(Cmd+Option+Up/Down on macOS).
- Reuse the existing scoped transcript navigation, translated command
labels and configurable shortcut hints. Keep prompt-history recall
separate and preserve the draft without sending anything.
- Disable these entries for inactive, missing or Info sessions, and
capture their owning instance/session before deferred menu dispatch.
- Update the composer contract and all ten localized shortcut pages. No
new dependencies, settings, shortcuts or translation keys.
## Validation
- UI TypeScript check and production UI build passed.
- Five focused real-component browser journeys passed, covering menu
clicks, keyboard selection, historical-window loading, draft
preservation/no sends, macOS defaults, changed/unbound hints and
missing-session availability.
- Hotkey/navigation unit checks: 19 passed.
- Help checks: 31 passed; 28 pages checked in all ten locales.
- Personally inspected the menu captures. Broader history/composer
regressions are running; results will be added in a comment.
- Independent correctness review: **No findings.**
The existing application, user draft and native session data were not
restarted or changed.
## Problem
OpenCode 2.2.7 intentionally removes `Plugin.awaitActivation` from
`rpc.call`. On unchanged CodeNomad, native cold history/pruning returns
`rpc.unavailable`, `/goal` incorrectly reports unsupported, and a
headless integration host can fail its first advertisement. The same
native checks pass on 2.2.6.
## Adaptation
- Adopt the existing bounded, connection-owned pruning readiness
foundation and its eight fixed broker families. Preparation targets the
already-authorized exact native Location and requires a fresh
lease/registration-scope acknowledgement, rather than treating a
backend-wide startup marker as universal readiness.
- Preserve session/workspace/connection, deletion/ABA, cancellation and
extension-grant fences around waits and the single functional dispatch.
No pruning mutation is probed, replayed or retried; generic RPC proxy
access stays closed.
- Share the native catalogue activation wait with `/goal`. Only method
absence after activation proves unsupported; transient registration loss
remains unavailable.
- Preserve current Memory provisioning and ownership options while
adopting the foundation. Abort the startup marker observer on close so
cleanup does not wait on an unreferenced polling timer.
- Correct the reference host discovery client, vendored byte-for-byte
from [opencode-integrations
#17](https://github.com/NeuralNomadsAI/opencode-integrations/pull/17):
payload-free status preparation may repeat while registration is
unavailable; advertise/withdraw are sent once, with no directory
fallback after dispatch. The external PR publishes source only;
installed hosts need the corresponding host update.
- Keep minimum, recommendation and authoring dependency pins unchanged.
Add cold fixed-broker native coverage to minimum/latest and
Windows/Linux/macOS native lanes.
## Validation
- **199** affected broker/lifecycle/readiness/goal tests pass; the final
cancellation cleanup additionally passes **40** focused tests.
- **30** real-browser Images/panel-extension journeys pass.
- Official isolated **2.2.3, 2.2.6 and 2.2.7**, driven by pinned **Node
24.22.2**: full pruning/history/Images/replay fixture, production goal
route, cold fixed preview/prune/history/Images brokers and headless
integration discovery/advertise/attach/withdraw all pass. The cold
broker check asserts one prune dispatch and retained conclusion bytes,
plus a new backend lease.
- **2.2.7 split storage** passes full pruning, native proxy/UI
contracts, assets/gallery, mixed split+inline content after flag
disable/restart, receipts, active-claim refusal and retained model
payload.
- Server/UI typechecks, complete server/UI/native-plugin build, **27**
package/vendor parity tests, **31** help tests, native driver test, YAML
and whitespace checks pass.
- External Python reference tests **9/9** and kit test typechecking
pass; Blender's vendored copy equals the reference.
Only private synthetic daemons, local providers and owned fixture state
were used. No shared service restart, real
credentials/database/configuration change or stable publication. Earlier
fixture attempts exposed an import-ID conflict, Windows path
normalization in the fixture ownership stub, and teardown ordering;
those harness defects were corrected without relaxing assertions. One
final rerun was needed after a simultaneous build cleaned its dist
input; the post-build rerun passes.
The native tests reuse source from the independently prepared readiness
foundation and broker work, adapted onto current dev without taking the
unrelated multi-backend branch. Public labels, controls and documented
steps stay unchanged; the fix restores their documented behavior. Large
existing touched files: `packages/server/src/index.ts` (~758 lines),
`packages/server/src/server/http-server.ts` (~2574),
`packages/server/src/workspaces/manager.ts` (~1230), and
`packages/server/src/server/routes/pending-requests.test.ts` (~1025).
Integrated CI and platform builds remain the final gate.
Apply the Vite 7.3.8 security migration to UI and Electron while preserving the standalone UI browser target, reviewed native optimizer cleanup, aligned Rollup binaries and the merged Zod 4 migration. The shared fixture daemon scans its real TSX entries, preventing late dependency optimization from invalidating a borrowed fixture's desktop API module URL. Logo tests read the displayed SVG rather than infer its color from a filename that Vite may inline.
Retain the shared native plugin activation and receipt synchronization qualifiers, including the Goal plugin's positive readiness state before its original assertions. No production timeout, failure collector, native mutation retry, runtime requirement or security guard is relaxed. The integration preserves all unrelated dev changes and the complete dependency graph through a strict semantic lockfile merge with protected SDK/Effect/Monaco/native Rollup records unchanged.
The combined Vite 7 and Zod 4 graph passes a frozen optional-workspace Linux install, UI/server/Electron typechecks, the full server/UI/plugin/tunnel build and local packaging without lockfile drift. The formerly failing real browser sequence passes twice each on Linux and Windows; targeted native source, restart, integration and Goal qualifiers pass against isolated minimum/latest runtimes.
The maintainer explicitly requested this merge while the corrected exact-head CI is still running. No CI job has reported failure at merge admission; unfinished jobs are not counted as completed validation. Their immutable-head CI remains under first-failed-job supervision after merge.
Migrate application validation to patched Zod 4.6.6 in the server, direct UI consumers and source pruning package while retaining the independently qualified OpenCode and Effect pins. Use explicit record key/value schemas, prefault for parsed preferences, partialRecord for sparse task states and strict configuration composition at the owned request boundary.
Admission regressions observe the actual route array parsers with positive and disabled-guard controls. Oversized array/set/map checks retain rejection before element traversal. Native RPC, permissions, pruning, exact receipt and schema parity checks keep their existing assertions and limits.
Native fixtures synchronize on actual plugin activation in new Locations and after owned-service restarts, and read-only integration readiness in the Python discovery target. The editor test settles one receipt read before changing its proof. These qualification corrections preserve native pending identities, claims, no-resend behavior and deadlines; application runtime admission and user data are unchanged.
The exact proposal head is qualified by CI, with targeted minimum/latest private-runtime controls, real browser pagination/cancellation and source-package pruning runs. The delivered merge preserves concurrent dev changes, including the independent editor pointer/title-case correction.
Regaining window focus starts a passive OpenCode status read. The restart
controls used that read's checking flag as a disabled condition, consuming
a real pointer click without issuing an activation request and making a
second click necessary once the refresh finished.
Separate pending mutations and confirmations from passive checking for
the inline activation and troubleshooting restart controls. Retain the
fresh pre-action status read, failed-check guard, restart authority,
executable/disposal fences and troubleshooting confirmation. Installation,
connect, reload and explicit Check keep their existing guards. No restart
is queued, automatically retried or performed by passive refresh.
Add deterministic real-Solid browser regressions using held HTTP reads and
raw pointer input, covering both restart paths, failed fresh admission and
duplicate-click exclusion. Extend the isolated native upgrade fixture to
assert that one explicit restart activates the installed version with a
new PID. Update the runtime guide and all ten maintenance-help locales.
Validation: initial browser reproduction failed with zero activation
requests; final 37 browser tests and 44 server lifecycle/updater/reconnect
checks passed, along with UI typecheck, 31 help checks and diff checks.
Isolated native 2.0.15 -> 2.2.6 upgrade preserved the old daemon until one
explicit restart activated the new version. Independent review found
P0/P1/P2/P3 all zero and separately passed nine browser regressions, help
checks and UI typecheck. The user's shared service was never restarted.
Admin squash merge under the maintainer's standing instruction. Remaining
CI jobs were queued or running at merge preparation; no failure reported.
## Summary
- Stop source rows moving under the mouse. Pointer focus never scrolls
the virtual list; keyboard navigation and reopening reveal only the
required row. Slow pointer traversal across a partially clipped last row
now keeps the exact clicked conversation under the pointer.
- Match conversation titles without case distinctions, including
accented capitals and Unicode lowercase mappings. Narrow native reads
with a necessary candidate substring, then compare the complete query
locally rather than relying on native ASCII-only case folding.
- Keep search reads bounded: continuation is an explicit action inside
the source picker, even when earlier matches remain. Ordinary browsing
without a query retains scroll continuation. Preserve source ownership,
opaque native cursors, stored selections and explicit Retry.
- Update the current contract and all ten help translations.
## Verification
- Reproduced the original failure in the real `dev` application against
existing native conversation data: pointer movement advanced the list by
thousands of pixels and could select a different row. The repaired live
journey keeps the scroll position and exact pointed ID stable.
- Verified real `vérifier` / `VÉRIFIER` and `pré-sync` / `PRÉ-SYNC`
searches, then selected the exact pointed conversation. No Mission was
created and the user's existing application/draft was not restarted or
cleared.
- Five focused real-component regressions passed: slow mouse movement
and exact click identity, keyboard scrolling, accented/Unicode case, and
both empty-first-page and retained-match searches followed by multiple
nonmatching pages with explicit request counts.
- UI TypeScript check passed. The full shared-fixture-daemon browser
qualification and updated help validation are being completed; results
will be recorded in a comment.
- Independent correctness review completed with **No findings.**
The live verification uses a separately authorized loopback-only
temporary backend. The production application and its unsaved form stay
separate from that test view.
fix(electron): remove global preview GPU readiness heuristic
Process-wide GPU metrics cannot establish readiness of an individual preview.
Remove that heuristic while preserving semantic-operation validation, exact
target leases, visibility and deadline fencing, native input delivery, and
the shared paint-holding wait.
Retain the hidden fixture's captured guest through preparation and reject
replacement. Add actual-CJS regression controls for a stop-loading notification
while loading is still true, a successful capture after expiry before timer
dispatch, and replacement by a different guest at the same URL.
Validate Electron/UI typechecks, focused native input/security suites, five
fresh Electron/Xvfb preview runs and targeted mutations of all three fixture
guards. Keep the first-key 500 ms and late-navigation assertions unchanged.
Use 800 requests per UTC day as an explicitly estimated display reference for
free models. Count only the sum of free-model requests reported by the connected
Console account since midnight UTC, across its clients and devices. Remove
local statistics, maximum calibration and fallback estimates.
Without Console credentials, show the translated connection prompt and the
Settings → Providers action. Failed or incomplete Console reads leave counters
unavailable rather than inventing zero usage. Preserve bounded pagination,
credential/day cache keys, independent caller deadlines, ownership checks and
exhaustion evidence. The reference is not an upstream-enforced client limit.
Update UI copy, provider documentation and help in all ten locales. Validate
the server usage readers/routes, UI usage state and locales, real Chromium
provider-usage suite, help and server/UI typechecks. The four red browser shards
on the PR head concern Missions; all 21 original failing cases and a matching
sibling case pass on the conflict-free merge with dev.
## Summary
- Keep conversation and other event source selection inside its owning
launch criterion. Changing the criterion type removes the selector and
clears its source; remove the unrelated global conversation picker and
paging controls.
- Keep source search, virtualized continuation and explicit read
recovery in the transient picker. Preserve selected labels through
native title searches, resolve saved off-page sources directly and fence
obsolete reads by owner/generation/visibility.
- Preserve stored conversation context IDs and prove that a new-message
criterion supplies its selected conversation to native passage context
without a separate global selection.
- Keep validation beside the relevant criterion without premature errors
for new empty fields. Update the Missions help in all ten languages and
the internal contracts.
## Validation
- UI TypeScript check and production UI build passed.
- Native passage/source regression checks: 21 passed.
- Multilingual help checks: 31 passed; 28 pages validated in all ten
locales.
- Real-form browser journeys cover every criterion type, source/type
changes, pagination/search, failures and Retry, two conversation
criteria, keyboard selection and recovery, stale replies, hidden editor,
remount, retained configuration and technical-carrier exclusion.
- Personally inspected normal-width and narrow French/Hebrew RTL
source-picker and selected-value captures.
- Independent correctness review completed with **No findings.** after
fixing active-query reset and keyboard access to Retry.
- Exact committed-head Windows and Linux qualification is being
completed; results will be added in a comment without restarting the
hosted workflow.
This change does not restart the user's application, alter their open
unsaved form, clear session history or discard cached data. The two
unrelated failures recorded on the earlier scheduling PR are not claimed
as repaired here.
Align direct listener origin checks, host-only controls and password-session lifecycle. Keep preview capabilities and Remote Control admission consistent, with regression coverage and help updates in all ten languages.
Preserve WebSocket origin validation and asynchronous authentication responsiveness. Include the reviewed shell environment lifetime fix, isolate AppImage test executable preparation from concurrent descriptor inheritance, and collect bounded, typed cold-admission failure diagnostics without exporting private text or replacing the original failure.
Independent reviews resolved all findings. Exact-head CI run 42711032215 attempt 1 passed at ca2ba71d56: all 26 active jobs succeeded, both POSIX shell suites passed 14 tests, Linux concurrent Rust passed 336 tests, the minimum-runtime cold admission passed, and seven enabled desktop builds produced artifacts. Existing conditional skips and the separately provisioned native capture replay remain unqualified. No release or advisory publication is included.
## Summary
- Repair late browser-CI failures from #1436 by targeting semantic task
nodes and revealing offscreen rows before focus/click observation.
- Observe automatic passage continuation through exact source-window
responses, preserving scope and transport-budget assertions.
- Fix a real resize-scroll defect exposed by those stronger
preconditions: transparent, inert or ARIA-hidden focused controls cannot
trigger task viewport focus repair.
- Preserve native clipping, document-focus, owner/source identity,
mutation and rail assertions.
## Validation in progress
- The selector/button failures reproduced locally; independent reviews
of the test migration and runtime visibility guard returned No findings.
- The full tree focus ownership/visibility matrix now passes on Windows
and Linux, including native tab blur.
- Five-suite qualification is running on both platforms. Two
crowded-rail assertions are undergoing separate diagnosis; this PR
remains a draft until qualified.
- UI typecheck and production build pass.
An HTTP message page can contain a delivered user and its reply before the
delivery event arrives over SSE. The SDK then relocates the user row to the
tail, leaving it below its own reply. A relocating delivery now reconciles
against the native message page instead of inferring order from neighboring
rows. Tail-only delivery does not issue a read.
Repair publication uses the active-session/latest-window gates. An outstanding
repair is a retirement barrier and survives verified reconnect by resuming
after continuity seeding. Scoped retirement flushes respect the active-session
gate, while selection-change flushes keep their existing behavior. Shared
reconciliation reads from settlement and delivery retain the reducer until
the newest read publishes, including a trailing read superseding a repair.
Covered by HTTP-ahead delivery, history/inactive gates, reconnect, retirement
and superseding-read store regressions, plus a shared-fixture browser suite
with persistent SSE and request-owned cancellation diagnostics.
## Summary
- Automatically continue Mission and task windows near the list end;
retain an explicit Retry only for failed lanes.
- Virtualize task DOM using the existing panel scroller, preserving
cached task data, stable dependency rails and wheel reading positions.
- Compute chevron attention independently of selection from exact
indexed task metadata, canonical native assignments and known session
signals. Preserve history; no session deletion or full-map fan-out.
- Mark the whole task snapshot as read, including unloaded metadata
windows. Fence shared task-session coverage and trailing observation
refreshes by their owner/revision.
- Share actual keyed-DOM-move focus preservation with the session list;
respect later user focus and viewport visibility.
## Validation
- Six integrated browser suites: **118/118 passed**.
- Canonical task-session unit checks: **12/12 passed**.
- Server transport, native budget, recurrence and assignment parser
checks: **45/45 passed**.
- UI and server typechecks and production builds passed.
- Independent source reviews: **No findings.** Exact committed-head
review follows.
- Additional shared-session rendering/activity/acknowledgement
regressions passed **60/60**. Supplemental suites exposed nine failures:
all now pass in focused runs after two small product fixes (known empty
task coverage and cached tree attachment) and producer/geometry fixture
corrections. Inventory and task transport contracts pass **38/38** and
**43/43**.
## Integration order
#1435 is merged. This branch includes its `dev` integration and
preserves the exact reorganized ten-locale guide and creation-form
controls. The requested admin merge follows final local qualification
and independent exact-head review; queued hosted workflows are not
reported as passed.
## Real-component captures
Unselected, folded Mission with unseen task results:
Native work and a task-owned question, without selecting or opening its
Mission:
Automatic continuation through a 400-task plan:
## Summary
- Restore the shared Agents and models disclosure, inline summary and
Agent / Model / Thinking columns.
- Group Objective, Title and Notes; keep Options open; place Start
automatically outside Scheduling and use the shared primary Add a
criterion button.
- Keep the bookmark-labelled Configuration picker above and the named
Save configuration action in the footer. Remove redundant profile
commands and catalog-loading layout shifts.
- Reorganize Missions help in all ten locales around the actual
interface, preserving consent, permission-change and uncertain-outcome
guidance.
## Validation
- UI typecheck and production build.
- Help validation: 31 tests, 28 pages in ten locales.
- Browser checks cover profile payloads and held drafts,
creation/autostart recovery, native depth, keyboard focus, narrow/RTL
layouts and localized help.
- Independent implementation and semantic-help reviews: No findings.
## Real-component captures
A tool whose terminal event never reached the UI mid-execution stayed on its
running spinner through every later round: the reducer only settles a
running part from its terminal event, and stranded rows were reconciled only
at execution settlement, which a quickly following execution could suppress.
Once the next round starts (a reduced session.step.started, live or from the
queued replay), a tool still running in an earlier, finished round is
reconciled from the authoritative page. The native loop feeds every local
tool result back before a step ends, so such a part has lost its terminal
event; tools in the active round never trigger a read.
Reconciliation reads share one in-flight read per reducer. Publication follows
the SDK's current reconciliation promise, so a later trailing read (a newer
settlement or freshly dirty demand) owns the publication instead of a stale
earlier read, and the newest execution's demand is never dropped. Replacing
the reducer abandons its read, and the abandoned completion can neither clear
the successor's state nor publish against it.
Covered by settlement and queued-replay store tests (step-boundary repair,
active-round negative, shared read with a later fresh read, reducer
replacement).
## Summary
- Replace Status's disabled visibility checkbox in **Customize right
panel** with a chevron. It folds only the section choices, preserving
actual visibility and ordering. The group starts expanded when the menu
opens.
- Put Status first by default. Existing saved tab orders still take
precedence.
- Give Status Tokens the same metric chips as messages through a shared
renderer and stylesheet. Collapsed: input/output/cost on the header
line. Expanded: reasoning joins them on that line, chips wrap when
narrow, and descendant-inclusive totals remain underneath.
- Preserve existing subscription labels, accounting and independent
message-token visibility. No explanatory UI prose is added.
Captures use the real Solid components and stylesheet with synthetic
fixture data. Image assets are absent from the final tree.
## Validation
- 46 browser tests: Status/customization, Status tokens, message usage,
integration Status sections and panel extensions.
- 12 registry/manifest unit tests.
- UI typecheck and production build.
- 31 multilingual help tests, validating 28 pages in all ten locales.
- New regressions cover default/saved ordering, chevron
click/Enter/Space without visibility writes, shared chip styling, 220px
LTR/RTL wrapping, live values and subscription/descendant totals.
Shell and transcript conventions plus all ten Settings help pages are
updated.
Improve the existing cold-admission failure artifact so it distinguishes a missing native wake from a failed prompt with retry/backoff. Read native outcome, retry and carrier state only on failure, retain the existing redaction and bounds, and upload that existing artifact. Keep product timing and assertions unchanged.
Repair the independently observed browser-fixture races during qualification: count only the exact setup-status route, freeze consent clocks directly instead of pausing an already advancing clock at a past instant, and await native Cancel autofocus before retaining its assertion. Keep every consent threshold and duplicate-dispatch check.
Complete CI is green on head 280a03211a5d1e2226509473187127fd348fdb94, including the minimum/latest runtime gates and all enabled package builds. The full setup and attachment suites passed locally; six focused integration checks additionally pass with the newer dependency graph now on dev. The final workflow preserves the newer Windows hidden-emulation check, and the complete delivered tree is verified against current dev plus the five reviewed files.
Complete the bounded dependency catch-up after routine Dependabot updates were paused, including the KaTeX security update, without enabling a new stream of automatic version PRs.
Update YAML, KaTeX, React, Virtua and the reviewed build/browser tooling. Retain Kobalte core 0.13.11 with presence 0.1.8 and date 3.12.4 because the proposed newer overlay stack reproduced accessibility regressions. Preserve the OpenCode 2.2.3 client/plugin pins, Effect, Monaco and the intentional Rollup binary records. Add the Windows hidden Electron emulation-reset check to CI, keeping its existing assertions.
The complete exact-head CI is green on e1a140382433befb9badd026745136fe0ef05b30, including all browser shards, technical-minimum/latest runtime contracts, three-host pruning, WebKit qualification and all enabled Electron/Tauri packaging jobs. This head includes the shared-cache wiring and actual-background-shell correction.
Current dev additionally contains the speech-owner and busy-session persistence fixes. Their combined source is qualified separately against this exact candidate lockfile with a frozen npm 11.19.1 install, all three TypeScript checks, cache/runtime regressions and the focused capture, speech and project-restoration browser checks. The final merge tree is checked against the reviewed six-file candidate while preserving every unrelated dev file.
Busy session usage updates invalidated both application-session capture effects and repeatedly encoded and published the retained snapshot graph. A small cost/token update could therefore pay the cost of unrelated retained history and catalogue data.
Share a value-compared scalar projection between both effects and defer only cost/token-only invalidations while a session is working or compacting. Genuine checkpoints and explicit flushes still read the current stores. Preserve metadata, nested in-place mutations, runtime transitions, ownership, dirty-on-failure and shutdown semantics without changing the native persistence protocol. Document the last-checkpoint freshness of restored display counters after a crash in the conventions and all ten Desktop help translations.
The real-store regression covers positive preserved-draft hydration and all relevant scalar invalidations. The restoration fixture now supplies the cost and token fields required by native Session.Info, retaining its foreground barriers and assertions. Its focused comparison fails before the fixture correction and passes on both hosts with 200 messages visible before releasing secondary slots.
The complete isolated Windows Tauri applications use identical canonical histories of 10,001 messages and catalogues of 512 sessions with matching locks. Three repeated native sequences publish [3,3,3] snapshots on the reference and [1,1,1] on this change; renderer TaskDuration median falls from 109.093 to 65.106 ms. Native graph verification confirms fresh counters, drafts and close/flush acknowledgements. Input median remains nearly unchanged and the scenario produces no tasks over 50 ms: this is evidence for the targeted persistence cost, not a claim that all severe global lag is resolved.
Both independent review axes returned ZERO FINDINGS on b4bb4f067e6f8c0f9c470b5a901010241cb82fbd. A fresh validator qualified typechecks, configured Clippy, all exact-head test jobs, separate capture/restore regressions and the server-plus-Electron build under Node 24.22.2/npm 12.2.2. Exact-head Windows native builds also pass. Remaining remote release-packaging variants were queued or running and are not counted as completed validation evidence. The active application and shared OpenCode daemon were not restarted or stopped.
Recycled transcript cards could register speech cleanup under one content ID and dispose under another, retaining their Solid owners and DOM after unmount.
Remove the mounted-card registry and retain only the active playback owner's callback. Track content identity by its scalar value so republishing the same message preserves playback and pending requests, while replacement and disposal cancel the real owner. Fence late capabilities, synthesis and streaming responses and keep audio completion, abort and URL cleanup instance-owned.
Real ToolCall/Index regressions reject cumulative owner retention and cover duplicate IDs, same-ID object replacement, cancellation, stale responses and audio resource cleanup. The focused suite passed 9/9 and a separate retention run passed 2/2 with Node 24.22.2 and npm 12.2.2. Both independent review axes returned ZERO FINDINGS on c4b4f893f22ed58a2e9bce40e19716e118ebf011.
Exact-head CI typechecks, Clippy, all test jobs and Windows/Linux Electron and Tauri builds passed. macOS packaging jobs were queued or running at the user's explicit request for this administrator merge. This change addresses the measured speech-owner retention mechanism, without claiming to resolve all desktop memory use or lag. The separate persistence-performance PR remains open for native desktop measurement.
Status's Background Shells section was showing every running native Shell,
including foreground calls, rather than commands explicitly moved to the
background. Multi-line cards obscured the list, output rendered undefined,
and checking only cwd rejected commands legitimately launched outside
their originating session's project.
Intersect the selected Location's native Shell inventory with the running
shell IDs from experimental.job.list, using the authenticated runtime
transport and a validated 4 MiB/10 s read. The owned workspace route
authorizes both its requested directory and the originating session of
each tool shell. Output and removal use that same authority, including
the worktree deletion fence; direct API shells retain cwd authorization.
Unavailable inventory reports an error rather than showing foreground
commands. No daemon changes or runtime version allowlist.
Each command now occupies one clipped row with the existing output and
stop/remove actions; metadata stays in the tooltip. Plain output and ANSI
HTML render in separate elements. Reads follow visible expanded demand,
Shell lifecycle, tool completion after background admission and reconnect,
coalescing in-flight refreshes and preserving unchanged action DOM. WSL
inventory retains its native directory beside the host-side demand key;
events match either alias, including event-driven recovery after an
initial failure before the native alias was learned.
The V1 implementation was inspected: it managed explicitly launched
background tasks per project, retaining completed records and separate
stop/remove. This correction restores accurate background selection using
native V2 APIs while retaining V2's running-only list and combined action.
It applies the maintainer's requested one-row layout without rebuilding
the V1 process manager/history. Help is updated in ten locales.
Validation: 61 server/proxy, 12 store, 12 browser and 31 help checks;
UI/server typechecks and diff checks. Negative controls fail with the old
row/output renderer; WSL regressions fail before their fixes. Real native
2.2.6 read-only inventory excluded two foreground commands. Three
independent review rounds: both WSL P2s resolved; final P0/P1/P2/P3 all zero.
Merged under the maintainer's standing admin-merge instruction. At merge
time only the authorization check was running; the test CI had not yet
reported results.
## Remaining Missions test corrections
#1305 merged the Cargo graph repair, build-order expectation and native-help receipt fix while this PR was being qualified. This branch now preserves those changes, including its existing manifest-unit loader, and contains only five Missions test/fixture corrections.
- Supply a valid depth response for the compact form rather than the generic empty JSON fallback.
- Interact with directly visible Playbook/depth controls, retaining native aim/click geometry and exactly-once assertions.
- Observe exact catalog response-body completions before project discovery and before Create can invalidate the owner. Cached model text is retained as a presentation check, not a readiness receipt.
- Retire the saved fixture editor synchronously before its display fetch, matching the real MissionControl owner.
- Await the partial Pause/Stop result's owning row publication before continuing to the next action.
No production source, dependency, assertion, deadline or failed-request filter changes. No forced click, sleep or retry.
## Evidence
- Six controlled catalog/lifecycle cases fail on the previous test and pass with the correction, covering either completion order and the late display-fetch race.
- A held recurrence read proves the partial-result helper previously returned before publication.
- Fresh current-dev source with the exact lock-matched dependency tree: **46/46 targeted tests pass**, independently run with Node 24.22.2 and headless Chromium.
- New full CI required on this conflict-free combination. The historical macOS pruning load timeout remains unexplained; its disappearance on one run is not a root-cause explanation.
Agent-prepared missions should use the same new-mission preferences as the Missions editor. Fill missing coordinator, role and task-mode choices through shared resolution, preserve explicit whole-slot selections, and expose recorded selections and their origins in tool responses.
Read the owning backend's authoritative preferences over the authenticated bridge and refuse invalid preferences with actionable errors. Keep standalone inspect-start creation available with explicit unavailable-preference provenance. Resolve preferences outside the project mutation lock and retain first-recorded choices across retries, restarts and preference changes.
Persist bounded preparation intents and provenance through native RPC, journals and unified documents. Keep strict ownership discovery separate from ordinary worktree behavior, preserve Compare judge inheritance, and direct out-of-mission preparation to the Missions editor. Update tool guidance and help in all ten locales.
Validated focused creation, automation, ownership, route and replay regressions, both typechecks, native bundle builds and help checks. Independent agent reviews identified issues addressed in the branch; the review record and final integration results are recorded on the PR. Existing parallel test failures passed their serial rerun. The OpenCode 2.2.6 scheduled-wake fix from dev is preserved.
## Summary
- Put reusable configurations first and preserve their existing
version-1 records, notes and requested profiles. Rename the UI/help
terminology in all ten locales.
- Show compact preparation controls directly, retain one-row growing
Objective/Notes fields, and use contextual localized help instead of
inline playbook prose or See details.
- Add **Start on creation**, off by default. Only a direct confirmed
creation response continues the existing guarded lifecycle/schedule
operation; recovered or uncertain acknowledgements never autostart.
- Make **Once, now** the initial composable criterion. Add a criterion
appends a second row. Existing or/if/else groups, source checkpoints,
native calendars and exact request receipts decide admission.
## Safety and compatibility
Sole-now preparations retain ordinary one-time journal admission and
native-default profiles. Mixed policies freeze a single existing native
`at` calendar when armed, preserve its consumed-slot evidence through
restart/replay/timing edits, and allow an unmet condition to consume the
sole chance. Existing stored launch policies remain readable without
automatic migration. OpenCode itself is unchanged.
## Integration
Contextual-help #1404 is integrated. **Do not merge before #1402**; its
tree and auto-delete changes will be merged normally before the final
review gate.
## Validation
- `npm ci` and `npx playwright install chromium`
- 161 focused server scheduling/preparation/calendar-owner tests
- UI scheduling/data/decode/summary: 10; reusable-library records: 14;
creation helper/draft tests: 10
- Direct scheduled-create/activation/lost-acknowledgement browser
fixture: 5 tests
- Focused real-editor browser rerun: 12 tests; broader regressions and
final shared-help checks are being completed
- UI/server typechecks; production UI build; Missions plugin build
- Help: 31 tests, validating 28 pages in all 10 locales; i18n: 7 tests;
contextual destination tests: 4
The untouched baseline fixture-wiring check reports existing violations
in `automation-webkit-geometry.test.ts` and
`automation-webkit-page.test.ts`; the new fixtures pass its wiring
requirements. A real-component fixture screenshot and independent
read-only review results will be attached before merge.
## Summary
- Enable the existing free-model Console calibration by default: show
`max(local steps, Console free-model requests since UTC midnight)` when
the active Console connection is usable.
- Keep the `Estimated` label, local fallback, exhaustion marks and
display-only scope. Account selection is unchanged.
- Reserve time for local publication if the optional Console/credential
read stalls; one caller timing out does not cancel another caller's
shared transport.
## Scope and limitations
Console account-wide totals can include other clients and IP addresses,
while the 200-request reference is IP-based. Whether Console counts
authenticated free requests remains unconfirmed; a zero or lower Console
count leaves the local estimate unchanged. No real user credentials or
live Console calls are used in tests. Unknown local counts remain
unknown.
## Documentation
Updated the existing information popover and `docs/help/*/providers.md`
in all ten locales, plus `dev-docs/PROVIDER_ACCOUNTS.md`.
## Validation
- Usage/provider/rotation/route tests: 289 passed, no skipped tests.
- Focused free calibration + Usage/Google routes: 70 passed.
- Chromium free-model information popover and provider switch: passed;
French formatting and UTC-midnight cases also passed.
- Localization navigation-label checks: 10 passed.
- Server and UI typechecks: passed.
- Help checks: 31 passed (28 pages × 10 locales); help build passed.
- Independent review found and prompted fixes for stalled optional reads
and an unmocked stats-only test. Follow-up review in progress.
## Summary
Follow-up to #1318: the delivered Missions tree diverged from the
session list it was modelled on. This brings it in line with the issue's
design.
- **One selection, session-list highlight.** The panel selects a row
**or** one task, never both. A click only selects; only the chevron (the
session list's own `SessionExpander`) expands. Expanded rows are kept
per project. A Mission without tasks has no chevron: summaries now carry
an optional `taskCount`.
- **Tasks are session-list rows**, nested one level, with the same
height, separators, rollover and highlight.
- **The eye is a mode.** Pressed, the central reader shows the selection
(a Mission's overview, or the task's reader) and follows each new
selection. Released, it closes. A selected task takes the header
toolbar.
- **Colours agree.** The chevron uses the task rows' own states
(`missionTaskRowState`): input, then active, then unseen finished.
- Finished tasks stay **green until seen**. Selecting one, clicking its
icon or sweeping across icons greys it. The chevron's right-click **Mark
as read** clears a Mission's tasks and its own completion.
- Tasks not started yet are **blue**.
- **No text under rows.**
- Command progress and errors are announced and appended to the primary
button's tooltip; their actions stay visible.
- The empty-plan and loading lines are gone.
- Delete happens at once. Deleting task conversations is a Settings ›
Missions checkbox, and the delete form only appears on failure.
- **Dependency rail.** Lanes start under the Mission chevron with a
fixed step. Rows move over when the lanes need more room, instead of
lanes merging at the panel edge.
Not in this PR: a recurring Mission listing its passages as children
(#1318) needs a passage listing the panel does not have yet. It follows
separately.
## Docs
- `dev-docs/MISSIONS.md` describes the selection, expansion, eye,
colour, seen and deletion model.
- The Missions help (ten locales) covers the same.
## Validation
- Missions browser tests migrated to the new behaviour.
- New `mission-tree-parity.test.ts`, every test failing on the previous
UI:
- single highlight;
- chevron-only expansion;
- the eye following the selection;
- chevron colours from task states;
- unseen tasks and Mark as read;
- leaf Missions;
- immediate delete honouring the preference;
- feedback in the tooltip.
- Missions, session and automation browser suites: 669/670. The
schedule-list cold-start timeout passes alone (37/37).
- Server mission tests, plus a `taskCount` test.
- UI and server typecheck; `npm run test:help`.
- `tests/browser/mission-control.test.ts` is about 1,700 lines.
## Summary
Closes#929 and #1207 by using the native archive/restore API already
present in OpenCode 2.2.3. The 2.2.6 `run --archived` announcement adds
CLI convenience; no minimum or dependency bump is required.
- Session row **Archive session / Restore session** actions and an
**Archived** badge.
- Search-local **Unarchived sessions / Archived sessions / All
sessions** selector.
- Hide idle archived branches in normal browsing and session-list
cycling; preserve selected conversations and paths to running work or
pending requests. Children retain independent native flags and remain
independently searchable.
- Serialize native writes, follow with ordinary authoritative inventory
refresh and verify the flag. Failed/uncertain writes never synthesize
local archive state or replay automatically.
- Project archive events and fence older metadata reads; retain complete
native inventory for ownership and recovery.
- Technical docs and help in all ten locales; native minimum/latest
coverage in CI.
## Validation
- Official isolated **2.2.6 and 2.2.3** CLI probes pass archive/restore,
filtered cursor pagination, unfiltered listing, persisted flag,
idempotent events, retained transcript and unchanged child flag, with no
archive-induced model execution.
- **132** targeted UI/store/recovery/pagination tests pass; **61** proxy
ownership tests pass.
- Workspace typechecks and **31** help tests pass.
- Main real-browser archive/restore/search/failure journey passes, as do
existing search and child-activity checks. Final compact-menu/delete
reruns are in progress.
- The repository fixture-wiring checker reports two pre-existing
violations in unchanged WebKit automation tests
(`automation-webkit-geometry.test.ts`,
`automation-webkit-page.test.ts`); the new browser fixture uses the
shared daemon and navigation budget.
Native probes use synthetic private databases and a local provider,
never the shared daemon or user state. Large existing touched files:
`session-list.tsx` (~1168 lines), `session-events.ts` (~732),
`session-state.ts` (~1343).
## Summary
- Extend the existing `SettingsInfoTip` with `help?: { page: string;
anchor?: string }`; retain short hover/focus explanations and open
matching localized help externally on click, Enter or touch.
- Reuse `helpUrl` and `openExternalUrl`, guard page/anchor syntax,
preserve containing controls and disclosures, and show the existing
localized help error without replaying failed actions.
- Carry destinations through existing choice rows, behavior settings and
core Status metadata; document the reusable pattern and update the
settings guide in all ten languages.
## Linked inventory
- General: automatic subsession expansion, keep-awake, Memory, Tidy up
and memory-review warning.
- Advanced: whitespace-only changes and session environment variables.
- OpenCode: startup launch.
- Providers: image generation and image storage.
- Notifications: On screen, History and System column tips.
- Speech: provider, separate providers, shared/input/output base URLs,
playback mode, output format, playback test and prompt voice input.
- Status: Tokens, Yolo mode, Usage, Background Shells, MCP and Plugins.
Mission creation/scheduling/depth/preferences belong to the separate
form change, which can use the shared prop directly. Dynamic mission
budget, attention and diagnostics tips retain their information-only
purpose. Existing `SettingsInfoLink` and integration `InfoPopoverButton`
explanations retain their actionable/runtime-specific popovers; sidebar
Info navigation and Info-card heading icons keep their distinct purpose.
## Validation
- `npm ci` in the isolated checkout.
- UI typecheck.
- URL/section checks: every literal contextual destination resolves in
all ten locales, including `zh-Hans`.
- Behavior and right-panel registry tests: 14 passed.
- Full help suite: 31 passed, validating 28 pages × 10 locales.
- Real Solid browser gesture and relevant settings regressions: 56
passed (new shared-tip cases, startup launch, General/appearance,
Memory, notifications and help-command routes). All eight new
gesture/native-route cases pass.
- The fixture-wiring audit reports two existing WebKit fixtures without
the required exemption/navigation-budget wiring; those files and the
audit inputs are unchanged from `origin/dev`.
## Scope
No Mission form/tree edits, new dependencies, URL registry, plugin
extension point or duplicated info component. Visible explanations and
opener errors reuse existing translations.
## Independent review and CI
Round 1 found a translation-readiness race in the browser test. The test
now waits for the real localized info-link label before activating it.
Round 2: **No findings**.
Current `origin/dev` is merged. CI has baseline failures in the
unchanged binary-build ordering expectation and Cargo lockfile; the unit
failure reproduces locally and the affected inputs match `origin/dev`.
The existing fixture-wiring audit likewise reports only unchanged WebKit
files. These are tracked in the PR discussion separately from
contextual-help validation. Additional platform jobs remain
queued/running; admin merge is explicitly authorized for this change.
## Real component capture
## Scope
Native browser previews, agent browser automation parity, and preview
capabilities across **Electron, Tauri Windows, Tauri macOS and Tauri
Linux**.
- Shared native embedding, geometry, overlay masking, session-owned
history and profile-scoped preview storage, isolated from the trusted
application renderer.
- Public `codenomad.browser`: open, navigate, snapshot, click, type,
select, press, scroll, hover, drag, wait and screenshot through the
authenticated backend and fenced native-parent channel.
- Six native viewport presets, WebKit HTTP/JavaScript mobile identity,
reset/reload and per-registration isolation. Native WebKit density/input
differences remain explicit.
- OAuth pop-ups with opener/postMessage and shared preview storage;
downloads with sanitized unique names; native dialogs and
owner/opener/renderer lifetime cleanup.
- Camera, microphone, location and notifications remain denied. Other
classified permissions retain native consent/selection and fail-closed
attribution. Guests receive no application privileges, app IPC, page
Node access or general evaluation bridge.
- Current-state developer documentation and user help in ten languages.
**Tauri macOS requires macOS 14 or newer; Electron keeps its own
platform baseline.**
## Host matrix
| Host | Native preview/history | Agent automation | Mobile profiles |
Pop-ups/downloads/dialogs |
| --- | --- | --- | --- | --- |
| Electron | Chromium | Supported | Chromium | Supported |
| Tauri Windows | WebView2 | Supported | Chromium | Supported |
| Tauri macOS 14+ | WKWebView | Supported | Native WebKit | Supported |
| Tauri Linux | WebKitGTK | Supported | Native WebKit | Supported |
## Qualification
- **Ubuntu 24.04 KDE VM:** real application built from the merged
sources, real backend and parent channel, private OpenCode daemon and
deterministic provider producing actual agent tool calls. Full browser
action sequence, OAuth opener messaging, downloaded-file contents,
native dialog acceptance and PNG passed under X11/Xwayland. Additional
native Wayland qualification uses an owned private KWin compositor;
native dialog operator coverage is recorded separately.
- **macOS 15.8 Intel VM:** same real-application/agent-tool path, all
actions and capability smoke passed with the built UI, private
profile/configuration and private OpenCode daemon. The app-window
nested-scroll check also qualifies the Cocoa wheel-coordinate
correction.
- **Windows:** Tauri release executable under its own
profile/configuration; all actions, OAuth, completed download, native
dialog and PNG passed through actual agent tool calls. The user's main
CodeNomad and shared OpenCode service remain untouched.
- Native CI qualifies Linux, macOS Intel, macOS ARM64 and Windows.
Authorized draft qualification uses no signing secrets.
- A **real Mac trial remains a release qualification step**. Graphical
macOS ARM64 and physical hardware capabilities retain their own
qualification scope; the capability matrix describes supported contracts
rather than exhaustive peripheral testing.
## Documented limits
- macOS first standalone hover can omit `pointerenter`; ⌘A selects
through the native responder while consuming the main A keydown.
- WebKit captures script-created closed shadow roots; declarative closed
shadow roots remain opaque.
- WebKitGTK preserves CVE-2025-13947 dropped-file protection; use the
page's native file input. No dropped URI text is converted into host
file access.
- GTK async clipboard reads lack requesting-frame attribution and are
refused; native Ctrl+V and clipboard writing remain available.
- WebKit keeps native screen/platform/pointer/hover/touch metadata.
WKWebView uses DPR 2.75 when its runtime-checked native selector exists;
GTK DPR follows monitor scale × fitted zoom. CSS dimensions remain
stable across app zoom/DPI. No JavaScript getter shims.
- Cross-origin frame contents retain the documented opaque automation
boundary. Page input timeouts have unknown outcomes and are never
replayed automatically.
## Integration
- Merge `ef69b4085`: `feat/tauri-webkit-parity`.
- Merge `e0d56d428`: `feat/tauri-webkit-capabilities` (`d58022b13`).
- Activation `3c68ab566`; Cocoa wheel correction `ecf5751ec`.
- The fetched `origin/dev` merges cleanly with this head. Pushed history
is preserved; no force-push or merge into `dev`.
The shared embedded-view layer remains available to remote-tabs work
while each consumer retains its own origin/profile/login/pairing/events
policy.
The projection-only delta-churn fixture let an unrelated session-history outline request escape to a generic API response; real native event projection can cancel that obsolete request, which then failed the strict page-error collector (net::ERR_ABORTED) after the DOM identity assertions had passed. This failed several unrelated PRs (most recently #1398).
Serve the existing valid empty-outline adapter before mounting the Solid components and explicitly reject any outline HTTP escape. Every browser-error collector, native event dispatch, action-eligibility and DOM identity/mutation assertion is unchanged. Merged current dev cleanly (both files unchanged there); full CI is green on the exact head.
Two Missions UI browser tests fail intermittently on CI and could not be reproduced locally (0/10 normal, 0/10 under 4x CPU throttling): the lifecycle Play/Pause/Resume test timing out waiting for an enabled Resume control after a panel refresh, and the recurrence late-refusal test where the selected row's Pause never reaches the route.
Record a bounded, passive event log (mission requests and outcomes, fixture control replies, pointer/click targets with the eligibility of the hit control, row identities, notices, console errors) and emit it as a single failure-only test diagnostic under 16 KB. Successful runs produce no output. Every assertion, wait, timeout and retry is textually unchanged. Full CI is green; the first attempt failed only on the separate automation-preview "Key:a" flake.
## Summary
Prepare **CodeNomad 1.1.0** on dev `689f73b62`. Align the root, all five
workspaces, npm lock entries, Tauri configuration and Cargo package/lock
version. The npm lock differs only in seven release-version fields;
dependency versions and metadata are unchanged.
Set the separately published UI's **minimum server to 1.1.0**. This is a
consumed API boundary: its Missions store uses `POST
/api/workspaces/:id/missions/panel-page` for inventory and task pages,
absent from v1.0.1. Older servers retain their cached/bundled UI instead
of downloading the incompatible 1.1 UI. Test 1.0.0, 1.0.1, 1.1.0 and
future-server behavior; document the contract and update all ten help
locales.
## Validation
- Stable 1.1.0 and preview-family versioning plus clean offline
workspace installation/local remote-tunnel linking pass.
- Tauri/Cargo alignment and the remote UI server floor are checked.
- UI compatibility and release-PR-note contracts: **7/7** passed.
- Help checks: **31/31** passed across ten locales.
- Workspace typechecks and server/UI/native plugin build pass.
- npm package dry-run confirms `@neuralnomads/codenomad@1.1.0` and its
shipped CLI/Missions/pruning/memory entrypoints.
- Strict lockfile metadata comparison and whitespace checks pass.
## Publication boundary
This preparation creates no stable release or tag and changes no signing
or publishing credentials. After merge, prepare a **draft dev → main**
release PR whose body is the public release notes. Merging that separate
PR publishes GitHub/npm/UI/updater assets and requires explicit
publication approval. Existing nightly dev previews retain their normal
schedule and will use the new base version. Production Windows signing
remains disabled in current repository configuration.
The panel shows the selected mission's fallback row before the summaries inventory arrives, so counting rows right after the task rows rendered produced 1 instead of 12 on CI. Wait for the 12 inventory rows, then keep the exact count assertion. Holding only the summaries response reproduces the CI failure on the original test and passes with the wait; full geometry file 8/8; full CI green. No timeout, assertion or product change.
