mirror of
https://github.com/NeuralNomadsAI/CodeNomad.git
synced 2026-10-24 23:31:20 +00:00
128 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Pascal André
|
42cab13a0e
|
feat(brand): adopt the hexagon CN logo, black or white by palette (#1114)
## Summary - New logo: a hexagon framing a C and an n, in equal bands (ring, gap, strokes, counters share one width), readable down to 16 px. - **App icon**: white ring and letters over black gaps, transparent canvas, hexagon spanning top to bottom; one fixed icon for light and dark taskbars, docks and tabs. - **In the UI** (`components/brand-logo.tsx`): black hexagon with white gaps on light palettes, white version on dark ones, picked in CSS from `data-theme` (system appearance when unset), so it also works outside ThemeProvider (title bar). Loading screen (always dark) uses the white one. Sizes: 4rem beside a text-3xl title, 3.2rem narrow column, 5.3rem loading screen, 16px title bar. - **Icons rendered from the vector**: `scripts/generate-icons.mjs` draws every `.ico` entry (16-256 px), `.icns` slot, Linux size and the 1024 px master straight from `images/CodeNomad-Icon.svg` with Chromium, instead of shrinking one large PNG; it writes the containers itself, so Electron drops `png2icons`/`pngjs`. One command replaces BUILD.md's four manual steps. ## Validation - New `tests/browser/brand-logo.test.ts`: real title bar + home page; which hexagon each logo shows on light, dark and system (both ways) palettes, with heights; red without the logo stylesheet. - UI + Electron typechecks, Electron tests (283), `macos-titlebar` and `notification-icon-badge` browser tests, `npm run test:help`. - Icon checks: ICO entries 16-256 (DIB, PNG at 256), ICNS slots icp4-ic14; UI captures on porcelain, linen, mist and ember palettes. |
||
|
Pascal André
|
c82dd8fbf6
|
fix(notifications): show Windows system notifications and keep their permission (#1109)
## Summary System notifications on Windows: everything about them in one PR. 1. **Windows data profiles never showed system notifications** (`fix(windows): show system notifications from every data profile`). Tauri runs each data profile, such as **dev**, under its own AppUserModelID (`…client.scope.s<hash>`), and its notifications carry that ID; Windows shows a desktop app's notifications only under an ID it knows, and the installer's Start menu shortcut carries the stable ID alone. Windows recorded every notification (100 on the affected machine) and displayed none. Every launch now registers the running ID under `HKCU\Software\Classes\AppUserModelId\<identifier>` (`DisplayName` CodeNomad, `IconUri` the bundled web app icon `resources\server\public\pwa-192x192.png`, which the packaged-resource smoke check requires; `windows_notification_identity.rs`). Electron always uses the stable ID. 2. **The permission was lost at every restart on Windows.** The notification plugin's page script reports *denied* there until the page requests permission, though Windows never asks, so Settings asked again after each restart. The check now asks the native plugin command, which answers granted on desktop: granted once, kept. 3. **Notifications were held back whenever the window was visible** (`fix(notifications): hold system notifications back only while focused`). With **Notify when the app is focused** off (the default), an open window stays visible behind other applications or on another screen, so nothing was sent unless CodeNomad was minimized. Delivery is now skipped only while the window is visible and focused (`document.hasFocus()`). The setting's subtitle and the Settings help say *focused* in all ten languages; `dev-docs/SETTINGS.md` records the rule. Out of scope by decision: several CodeNomad windows open on the same project may each send the event's notification (as they already do when the setting is on), and focus inside a browser preview counts as leaving the page. ## Validation - Affected machine: no profile notification showed before; after registering its ID as above, a notification sent under it showed in the notification centre under CodeNomad. - `cargo test --bins -- windows_notification_identity` (writes the key, reads back both values). - `tests/browser/system-notification-focus.test.ts`: real routed notification from a visible page; nothing while focused, one once focus is lost, one while focused with the setting on; red on the previous visibility check. - `npm run typecheck --workspace @codenomad/ui`, `npm run test:help`. |
||
|
Pascal André
|
1840c71054
|
fix(timeline): mirror every transcript block in order and keep clicks on the clicked marker (#1086)
## What changes for the user The timeline now matches the transcript block for block, and a click lands exactly where it should. - **One marker per visible block, in transcript order:** each reply, each thinking run, each tool (or collapsed tool group), each compaction and each system context. Markers follow Message content: a block that is hidden in the transcript is hidden in the timeline too. - **The clicked marker stays active** until you scroll, and its own block, not just the start of its message, is placed at the reading position. This also works for history that is not loaded yet. - **While scrolling,** the active marker is the first block below the reading line. ## Reproduced in numbers before fixing We replayed 45 of the user's real sessions (65,241 messages, exported read-only) into the real `SessionView`, with the outline, windows and previews served by the real server readers. Each session was measured at 1280×800 with two presets, using 16 real pointer clicks and 8 wheel scrolls per run. Baseline and fix used the same seeds. | Metric | Before, Complet | Before, Balanced | After, both presets | |---|---|---|---| | Sessions out of sync | 43/45 | 42/45 | 0/90 runs | | Markers / expected | 68,949 / 130,818 | 68,949 / 98,759 | 130,818 / 130,818 and 98,759 / 98,759 | | Click: clicked marker active | 53.6% (46.0% the one above) | 57.2% | 1,440 / 1,440 | | Click: block at reading position | 41.5% (median off by 35 px) | 82.2% | 1,440 / 1,440 (median 0.27 px) | | Scroll: reading-line block active | 93.1% | 92.2% | 505 / 505 moving wheels | What was wrong with the markers in the Complet runs: - 29,782 tool markers were collapsed into one marker per step. - 31,777 thinking blocks and 282 system blocks had no marker. - There were 10,232 order inversions. ## Causes 1. Once an outline existed, the outline projection replaced the markers of loaded messages too (`message-section.tsx`). It collapsed a step's tools into one marker placed before its reply, and dropped system blocks. 2. Resident segments merged thinking into replies, dropped thinking-only steps and skipped system parts. 3. After a click or a scroll, the active marker was the message's first marker. The message itself came from a scroll offset that rounds a row starting just below the top to the previous message. 4. Clicks navigated to the message, not to the block. 5. Jumps into unloaded history had no row to hold while the target was not yet rendered. ## How - **Server (outline):** each assistant step can now carry an optional `layout` field. It lists the step's visible parts in order: thinking runs, reply runs and each tool, at most 64 entries. It is computed in the same bounded SQL. Older plugin copies don't send it, and the client then falls back to the counts: thinking, then text, then tools. - **Markers:** `buildTimelineSegments` emits one marker per block, keyed `messageId:type:ordinal`. Loaded messages keep their exact markers. Unloaded steps are placed at their native position from `layout`. - **Click and scroll:** the list's `scrollToKey(key, selector)` holds the selected block on every frame, survives row remounts, and follows Virtua's estimate until the row renders. `timeline-transcript-blocks.ts` maps markers to blocks and finds the block at the reading line. - **Saved indexes:** outline indexes saved without `layout` are revalidated once. - **Docs and help:** updated in `dev-docs/SESSION_HISTORY_NAVIGATION.md` and in the help pages for all 10 locales. ## Behaviour to be aware of - **The timeline has more markers:** about +90% with Complet and +43% with Balanced on this sample, because every tool, thinking and system block now has its own marker. - **Tool icons for unloaded steps:** a step not loaded yet shows its first tool's icon on all of its tool markers, until its window loads. - **Plugin requirement:** the pruning plugin must ship with the new `layout` field. ## Validation - **New regression test:** `tests/browser/timeline-sync.test.ts` passes 4/4 and fails 4/4 on unmodified dev. Fixtures are synthetic. - **Measurement harness:** the opt-in qualification `npm run qualify:browser:timeline-sync`. - **Browser suites:** | Suite | Result | |---|---| | history-navigation | 65 | | message-scroll | 128 | | session-rendering | 47 | | render-cost | 17 | | full-source-copy | 12 | | search-highlight | 11 | | system-messages | 10 | | timeline-tool-filters | pass | | streaming-outline (no full reprojection over 64 token deltas) | pass | | session-search | pass | | transcript-presets | pass | - **Other checks:** UI unit tests 75/75, server session-pruning 70/70, help 9/9 and the UI typecheck pass. - **After rebasing on dev:** the typecheck passes, along with timeline-sync 4/4, timeline-tool-filters, full-source-copy 12/12, usage-metrics 5/5 and streaming-outline. Oversized files touched: `message-section.tsx` (~1,637 lines), `virtual-follow-list.tsx` (~1,368), `message-timeline.tsx` (~508), `message-timeline.css` (204). |
||
|
Pascal André
|
0595dd091b
|
ci: compare repacked deb hardlinks by type and accept callback faults in the Tauri negative control (#1083)
## Summary Two CI checks fail on PRs without any product defect. - **Electron deb check.** The check repacks the deb and diffs the two file listings. The two identical icon files (`opt/CodeNomad/resources/icon.png` and the hicolor desktop icon) are stored as a hardlink, and after the repack dpkg-deb may store that link in the opposite direction. One entry then flips between `-` and `h`, so `build-linux` fails on every PR that builds Linux (#1076, and two PR runs on 2026-10-20). The listing now reports a hardlink with its target's regular type. Files, modes, owners and the control archive are still compared exactly. - **Windows refcount negative control.** The check expects the reverted Tao counter to crash with a known native status. A runner reported `0xC000041D` (STATUS_FATAL_USER_CALLBACK_EXCEPTION), which is the same fault raised inside a window-procedure callback, and the run failed because that status was not on the list (#1080's run). It now counts as a reproduced crash. The corrected build must still pass every run. ## Validation - I ran the new awk expression on both hardlink directions taken from the failing log; the sorted listings are identical. - The workflow YAML parses. |
||
|
Pascal André
|
f314123dd1
|
fix(opencode): qualify and require 2.1.2 for correct Code Mode execution (#1078)
Raise the approved external runtime minimum and recommendation to 2.1.2 after reproducing incorrect native Code Mode job ordering on 2.1.0/2.1.1. Keep the independently qualified 2.1.0 client/plugin build pins and preserve bounded contract recognition for custom/future runtimes. Add the real isolated execute regression to the minimum/latest compatibility matrix, align supported installer fixtures without weakening assertions, and update setup/help in all ten locales. Two author-side review passes found no blockers; the final focused set passes 93/93 and native Code Mode passes. Qualification includes builds/typechecks, UI/browser, native pruning/Missions/recurrence, migrations and isolated installation/upgrade. Record the broad server shutdown timeout and its two unchanged isolated passes precisely. Admin merge explicitly authorized by the maintainer without waiting for CI. |
||
|
Pascal André
|
16428ad927
|
test(pruning): expect response usage to keep tool steps in one group (#1074)
test(pruning): expect response usage to keep tool steps in one group #1059 changed the transcript's token lines from one per model step to one per agent response. Steps that end with tools now pass their usage on to the response text, so no line separates them and their tools stay in one technical group. The native pruning UI scenario still expected the old behaviour: it waited for visible per-step usage to split the last tool group ("Shell: 2"), then hid usage to join it. That wait times out, and tests-session-pruning-native has failed on every OS for each pull request since #1059 (including #1059 itself). The step now checks the new contract on the real native transcript. With usage visible, the response's conclusion carries its usage line, the two tool-only steps carry none, and their tools form a single "Shell: 3" group across both messages. The rest of the scenario (whole-group, cross-message response, reasoning-group and whole-session cleanup) now runs with usage visible, the default, instead of hidden. Product code is unchanged. Validation: node scripts/run-session-pruning-native.mjs <cli> --ui against an isolated @opencode/cli 2.1.2 on Windows passes every native and UI step, including the updated one. |
||
|
Pascal André
|
da0dc279a7
|
ci(tauri): stop the refcount negative control at its first crash and warn when a runner never races (#1061)
The Windows runtime handle regression builds a copy with the counter fix reverted and required that negative control to crash within ten processes before the corrected build's five runs. The race is timing-dependent: of the last ten PR builds, five runners reproduced it (1 to 8 crashes in ten) and five never did, so tests-tauri-windows failed about every other pull request, unrelated to the change under test. The negative control now runs up to fifty processes (about 0.16 s each) and stops at the first native fault. On GitHub Actions, a runner that never reproduces it emits a warning naming its CPU instead of failing; local --baseline runs still fail, so a change to the fix cannot pass on a machine that never races. The corrected build's runs, the accepted fault codes and the clean-teardown check for surviving processes are unchanged; the counter-boundary and vendored-Tao checks guard the fix on every runner. Docs state that corrected runs on a warning machine provide no timing evidence. Validation: syntax check and two independent reviews; the sample comes from the tests-tauri-windows logs of the ten most recent PR Build Validation runs. |
||
|
Pascal André
|
f3c0fe671e
|
fix(timeline): stop adding an empty agent marker after every tool step (#1058)
fix(timeline): stop adding an empty agent marker after every tool step In OpenCode V2 each agent step is its own assistant message, and most steps only call tools. The timeline's structural index for history knew an assistant message's tool and reasoning counts but not whether it had text, so the projection drew a tool marker followed by an agent marker for every step. For tool-only and reasoning-only steps that agent marker was empty: no hover preview, and clicking it reached a message showing nothing but its tools, or nothing when tools are hidden in Message content. Resident (loaded) messages already dropped such markers. The outline index now also counts an assistant message's non-blank text parts that are neither synthetic nor ignored, the same text the hover preview shows. The projection draws an assistant marker only when that count (or the resident segments) shows visible text, so a tool-only step keeps its tool marker alone and a reasoning-only step has none. The count is optional in the contract: an older plugin copy still loaded by the daemon reports no count, and its markers stay as before. Persisted indexes saved without the count display immediately and then revalidate every checkpoint once, like the representative tool names. The unused message-timeline-group-* classes, which no stylesheet or test referenced, are removed; the group spacing that still uses tool membership is kept. Validation: navigation.test covers text counts for text, tool-only and blank/synthetic/ignored/reasoning-only steps; session-outline-projection covers tool-only, reasoning-only, text, unknown-count, shell and resident cases; session-outline-persistence covers validation and the one-time refresh of indexes without counts; the native navigation script now asserts the counts on real native storage (CI). history-navigation, timeline-tool-filters, system-messages and render-cost browser tests, the session-outline tests and the UI typecheck pass. |
||
|
Pascal André
|
7d9093de68
|
feat(timeline): follow Message content tool visibility (#1049)
Timeline tool markers now follow the Message content filters: a marker disappears when the tool type it shows (its icon; the outline's representative tool for indexed history) is hidden there, and the Nothing preset removes every tool marker. As with hidden tools before, the transcript's active marker and markers with an active permission stay visible, so highlighting and reveal keep following the transcript. Collapsed tools keep their marker. Because the rail now follows those filters, the separate "Show tool calls in the timeline" preference is removed everywhere it surfaced: Settings > General, the View menu item in the renderer, Electron and Tauri hosts, the palette command, its shortcut catalog entry (72 actions, 23 initially unbound) and its strings in all ten locales and the help. Saved values are ignored; the server schema passes unknown keys through, and hosts ignore an extra field from older renderers. The never-updated expandedMessageIds timeline input is dropped. Intended default change: tool markers are visible with the Balanced preset unless their type is hidden in Message content. Validation: new timeline-tool-filters browser test (hidden, Other-routed and collapsed tools, Nothing/Everything presets, a hidden active marker shown and highlighted); view-menu, a real Electron View menu, hotkeys-settings, transcript-presets, render-cost, history-navigation and other timeline suites (one local-environment failure that also fails on unmodified dev); related unit tests; UI typecheck; rustfmt check of view_menu.rs. Independent review approved after the active-marker fix. |
||
|
Pascal André
|
50066fc27d
|
chore(release): prepare CodeNomad 1.0.0 versions (#1045)
Align root/workspace manifests and lock entries, Tauri configuration and Cargo versions for the 1.0.0 stable and preview family. Require a 1.0.0 server for the separately published remote UI while retaining every third-party dependency and the existing local remote-tunnel link. Check committed manifest/lock consistency and stable/prerelease offline workspace installation. OpenCode dependencies, minimum and recommendation remain at 2.1.0; 2.1.1 qualification is deferred by explicit user request. The user explicitly authorized administrator merge and subsequent dev prerelease dispatch. This does not merge #1028 into main or publish a stable release. |
||
|
Pascal André
|
6f8881d5ae
|
fix(stats): restore cached totals and refresh only while visible (#1041)
## Summary
Replace the renderer-only workspace-ID cache with bounded validated
display snapshots in backend-owned state.ui.serviceUsage. Cache survives
recreated renderer/backend/workspace identity, keyed by authenticated
service/discovery/execution-host/folder fingerprint and period/timezone.
Eight entries, 1 MiB maximum; no plaintext credentials or paths.
Preferences does not write the opener's client-state journal.
Show previous totals/charts immediately with a cached-state label while
revalidating; preserve them on error. Hidden/unmounted Stats starts no
reads, cancels trailing work and fences late results. Visibility resumes
one read; execution hints use the existing activity cooldown instead of
one native scan per descendant. Manual refresh, period, reconnect and
deletion/pruning paths retained.
## Validation
- Rebased on current dev
|
||
|
Pascal André
|
b818a28c3d
|
test(pruning): align native UI journey with token grouping (#1040)
## Cause and correction Native pruning CI timeout on all three OSes was a fixture mismatch: visible per-step token usage splits technical groups, but the journey still expected the second cross-message prune request. It reproduces on BOTH OpenCode 2.1.0 and 2.1.1. Assert the visible grouping boundary, then explicitly hide message usage before testing cross-message cleanup. Use immutable config fixture responses so Solid updates. Add SSE/HTTP replay-metadata parity assertions to the existing native fixture. ## Validation - Base native UI journeys timeout on 2.1.0 and 2.1.1; corrected complete journeys pass both (completed:true). - UI tests 97/97; server pruning/broker tests 21/21; UI/server typechecks and diff check pass. - Local Windows only; Linux/macOS CI acceptance still pending. - The two reported metadata unit failures are from stale local client 2.0.27; they reproduce with that dependency and pass unchanged with lockfile client 2.1.0. No metadata or contract workaround introduced. - No production code, guard, timeout, dependency pin or shared app/daemon/state changed. Largest changed file ~428 lines. |
||
|
Pascal André
|
6a6367b560
|
chore(opencode): retire adaptations for runtimes and events OpenCode V2 no longer produces (#1034)
## Summary This PR removes OpenCode compatibility code that nothing can reach any more: - Code that was already dead at the former 2.0.27 minimum, and is still dead at the current 2.1.0 minimum (#1029). - Handlers for events and data shapes that OpenCode V2 never produces. Each item was checked against the upstream 2.0.27 and 2.1.0 sources before removal. Kept on purpose: - Workarounds for upstream bugs or limits that are still present in 2.1.0. - Code that reads conversations written by older runtimes: V1-migrated tool names and metadata, `workspaceID` data, task summary titles, `session-legacy` replay. - Code that recognises and upgrades old CLIs and live older daemons: 1.x replacement, beta recognition, 2.0.11 service discovery, 2.0.15 native upgrade, `/api/status` and `/api/health` identification. ## Removed or changed **Server** - Negotiation: one "not modern → `canonical_api`" rule replaces the pre-2.0.4 legacy schema recognition, and runs before #1029's `native_contract` check. - The transport no longer rewrites `/api/status`. - Desktop skills no longer send the pre-2.0.4 `location` and `slash` fields. - The legacy `auth.json` usage fallback for daemons without `credential.list` (pre-2.0.20) is removed, along with its UI reason and the i18n key in 10 locales. A missing endpoint still fails safely. - Workspace selectors are rejected up front, without a native resolution request. - CLI service probes try `/api/info` first. An admitted daemon no longer costs two authenticated 404s on every check. **UI** - Remaining V1 `session.idle`/`session.status` branches: Missions store, pending discovery (UI and server), `eventAffectsMessages`. - `server.instance.disposed` and the now-unused `rehydrateInstance`. - The V1 `worktree.ready` envelope (the handler now reads the V2 shape). - V1 tool-state titles and the `success` status alias. - Part `time.start` and `time.end`. - Text stored as objects or segment arrays. - `deriveMessageStatus`. - The V1 `error.data.message` shape. - `projectID` and `location` fallbacks on `session.created`. - The replay-only `session.message.content.updated`. - The unreachable `output.answers` fallback. **Fixtures, Missions and docs** - Legacy branches removed from the location, fork, families, pruning and automation native fixtures. The WSL setup fixture now compares against the reported version instead of 2.0.11. - Unused 2.0.21 launch helpers removed. - The Missions native and trajectory fixtures also run on the minimum lane. - The capability proof checks the reported version. - Stale 2.0.2x labels now say "as of the 2.1.0 minimum". **Follow-ups from the #1029 post-merge review** - Test fixtures no longer send the ignored `recent: ""` compaction field (18 sites). - The manual compaction-isolation fixture accepts any published version at or above the minimum. - `CONTRIBUTING.md` wording updated. 114 files, +319 / −1117: source +90 / −487, tests/fixtures/CI +214 / −604, i18n −10, docs +15 / −16. ## Validation (rebased on dev with #1029) **Typechecks:** server and UI pass. **Server tests** - Touched areas: 480/480. - Full server CI step: 2430 pass, 0 fail, 7 skipped, 1 cancelled. The cancelled test is the `index.test.ts` real-process shutdown test; it hit its 5 s timeout under load. It passes alone (4/4), and that file is unchanged versus dev. **UI unit tests** - Touched files: 230/230. - CI steps: 574/574, 200/200 and 519/519. **Browser suites**, one at a time: - Provider and service usage: provider-usage 13/13, service-usage 3/3. - Missions: mission-visibility 3/3, mission-control-feedback 5/5, mission-lifecycle-revision 10/10, mission-lifecycle-navigation 10/10, mission-current-passage 1/1, mission-native-family 11/11. - Transcript and rendering: compaction-responsiveness 5/5, session-rendering 47/47, reasoning-collapse 3/3, render-cost 17/17, tool-images 4/4, system-messages 10/10. - Other: search-highlight 11 pass (1 skipped by its env gate), panel-extensions 13/13. **Native fixtures on an isolated 2.1.0 CLI:** location, session-fork, automation, session-pruning, missions native, missions trajectory, provider-usage, Missions capability proof and compaction-isolation all pass. The WSL setup fixture was not run (it needs a WSL distro with a Linux CLI). ## Left for later - `RuntimeIdentity.discovery` is now write-only. - `ownsLocation` has an unused `_client` parameter (about 30 callers). - A test-only V1 translation in `auto-accept-manager.test.ts`. - Out of scope: HTML-entity decoding (a product decision), the `MutableHashMap` loop, the pruning-UI import-order workaround, unused log-based Missions readers, and the unshipped managed-owner module with its 2.0.24-pinned test. Oversized source files touched: `stores/instances.ts` ~2,209, `message-block.tsx` ~1,601, `workspaces/manager.ts` ~1,104, `tool-call.css` ~1,047, `tool-call.tsx` ~865, `opencode-data.ts` ~865, `api-types.ts` ~784, `session-events.ts` ~606, `recurring-day-fixture.ts` ~535. |
||
|
Pascal André
|
d6a890fba7
|
chore(opencode): qualify 2.1.0 and adopt its native contracts (#1029)
Adopt the OpenCode 2.1 native replay and compaction contracts, align client/plugin pins and set minimum and recommended runtime to 2.1.0. Preserve authenticated contract recognition for future/custom runtimes and explicit installation/restart boundaries. Preserve historical conversations through official projection-based pruning revisions and independently checked migrations from 2.0.3, beta-19271 and 2.0.32. Retain ownership, execution claims, stale-selection checks and transaction fences. Update setup, help and qualification evidence. Isolated Windows native qualification and integration checks cover pruning UI, historical reimport, Compare/Wayfinder, recurring Missions, builds and typechecks. Document broad-suite limitations and outstanding platform/package/mobile acceptance; this merge does not publish CodeNomad 1.0.0. |
||
|
Pascal André
|
73c0621d0d
|
fix(sessions): wire finish, retry and usage signals to OpenCode V2 events (#1033)
## What changes for the user
Four things that silently stopped working with OpenCode V2 work again:
- **"A session finished" notifications** arrive again. A successful or
failed run notifies. A run you stopped yourself does not.
- **Provider retries** show the retrying status and the countdown toast
again.
- **Usage statistics** refresh after each run.
- **The token usage line** under assistant replies (preference,
transcript filter row and hotkey) shows each settled reply's tokens and
cost again.
Per-session transcript reducers are also released again once a run has
settled.
## Why
OpenCode V2 declares `session.idle` and `session.status` in its schema,
but core never publishes them. Runs end with
`session.execution.{succeeded,failed,interrupted}`, and retries arrive
as `session.retry.scheduled`. These features were still keyed only to
the V1 events.
The token usage line had a second problem: it was drawn from V1
`step-finish` parts, which V2 never produces. V2 stores tokens and cost
on each assistant message instead.
A new isolated native fixture,
`scripts/test-session-lifecycle-native.mjs`, confirms this on CLI 2.1.0.
It uses its own storage, port and fake provider, and never the shared
service. In its complete, retry, fail and interrupt scenarios, it sees
no `session.idle` or `session.status` event. Upstream 2.0.27 sources
show the same: these events are declared but never published.
## How
- **Finish notification:** sent from the V2 terminal path after
`session.active` confirms the run ended.
- Succeeded and failed runs notify.
- User and shutdown interrupts stay silent; idle-timeout interrupts
notify.
- Subsessions and unknown sessions stay silent.
- A stray `session.idle` cannot cause a duplicate.
- **Retry:** `session.retry.scheduled` sets the retry state and the
transient toast. The next attempt or the end of the run clears them.
- **Run-end detection:** a shared `lib/native-execution-events.ts`
drives the usage refresh and reducer retirement.
- **Reducer retirement:** it also waits for queued prompts, so prompts
left in the inbox after an interrupt stay listed.
- **Usage line:** moves to `components/message-usage.tsx` with the
existing classes.
- **Removed:**
- the dead V1 `StepCard`, its step-part types and CSS;
- the V1 `session.idle`/`session.status` handlers.
- **AGENTS.md:** one bullet so future features wire to V2 lifecycle
events.
Left for the follow-up cleanup PR: the remaining dead `session.idle`
fallbacks in pending discovery, Missions triggers and test fixtures.
## Validation
New tests that fail on unmodified dev and pass here:
| Suite | dev | this PR |
|---|---|---|
| lifecycle unit | 3/4 fail | 4/4 |
| retirement | 8/9 fail | 9/9 |
| browser `usage-metrics` | 3/3 fail | 3/3 |
| browser `service-usage` | 2/3 fail | 3/3 |
- UI typecheck is clean.
- **Passing unit suites:**
- opencode-data-idle 9, runtime-contract 4, session-native-events 8,
message-part-grouping 6
- opencode-transcript-replay 17, opencode-compaction 11,
session-pruning-projection 2, session-pruning-pagination 6
- session-request-authority 77, opencode-data 30, message-timeline-v2 2,
transcript-visibility 8
- missions 1, instances-pending-compaction 7
- **Passing browser suite:** `system-messages` 10/10.
- The native lifecycle capture passes.
Oversized files touched:
| File | Lines |
|---|---|
| `message-block.tsx` | ~1,760 (down ~240) |
| `message-section.tsx` | ~1,630 |
| `opencode-data.ts` | ~905 |
| `session-events.ts` | ~670 |
| `message-timeline.tsx` | ~645 |
| `message-base.css` | ~675 |
| `session-request-authority.test.ts` | ~2,400 |
| `opencode-data.test.ts` | ~1,215 |
|
||
|
Pascal André
|
debbdce33f
|
feat(missions): add a "Compare two models" Mission template (#1026)
## Summary Adds a fifth Mission template, **Compare two models** (`compare`). It runs the same bounded task on two different models and ends with a blind verdict. - **Creation:** the user picks **model A** and **model B** in the main creation form. Both are required and must name different models (provider + model id; a reasoning variant alone is not a different model). This is enforced on every creation path: HTTP, prepare, recurrence create and agent-started missions. - **Roles:** `model-a`, `model-b` and `comparator`. - A and B share one instruction text and report contract. - The coordinator writes the task, inputs and criteria once, and gives both byte-identical briefs. - The server refuses a run task whose brief differs from its sibling's, or whose per-task execution would change its role's model. - **Blind judge, always on:** the comparator works on neutral X/Y labels. - It reports one versioned `comparison` artifact: the A/B task references, per-criterion scores for both runs, sourced observations, and a verdict `a | b | equivalent | inconclusive`. - Completion requires both runs and that comparison. - **Judge model:** frozen once at creation, like every other role. - An explicit judge is kept; otherwise the judge copies the coordinator's effective model. When that model is unknown, both stay on the native default. - Replays and retries therefore reuse the stored profile. - The editor warns when the judge's model equals A or B. - **Readers:** the verdict, both model names, a score table and evidence by path. Hashes stay under Technical details, for current and archived recurring passages. The template came out of evaluating Harness2's comparison loop. It deliberately has **no** lesson, human approval, budget or duration handling, and leaves the Wayfinder human gate unchanged. Up to five models, per-run worktrees and launching from the composer's model picker (OpenChamber-style multi-run) are left for later. `AGENTS.md` records the single editor exception: the A/B selectors sit outside the collapsed Options disclosure. All ten locales are updated. ## Size and upkeep 62 files, +837/-96: | Part | Lines | |---|---| | Product code (about 16 files are one-line template-list hooks) | +280/-57 | | Locales (13 keys × 10) | +131 | | Tests | +409 | | Docs | +17 | `missions/control.ts` stays oversized (~1,500 lines). ## Validation - Full server suite: 2,426 tests pass, 7 existing skips. Root and server typechecks, the server build and the plugin build pass. - UI: 45 unit tests and 36 browser tests pass. - The native trajectory fixture, extended with a compare case, passes on OpenCode 2.0.31. It checks two distinct models, a one-newline brief difference refused with the journal unchanged, a real blind judgment and a completed mission. The native contract and recurring Q fixtures also pass. - Regressions cover: - distinct-model refusals on every creation path; - brief and override refusals; - artifact validation and the completion policy; - judge freezing at creation, revision replay, and retry after a coordinator model change; - editor inheritance and readable evidence. - Independent review rounds ended with no P0-P3 findings. - The editor and reader were checked from screenshots of the real Solid components in the browser harness, not in a packaged app. |
||
|
Pascal André
|
362efb5911
|
test(missions): fold the one-time decision journey into the trajectory fixture (#1024)
## Summary #1023 fixed one-time Wayfinder decisions with about 85 lines of product code but 410 lines of tests. Its 248-line native script re-implemented the daemon, bridge and workspace setup that `test-missions-native-trajectory.mjs` already has. `native-invocation.test.ts` also carried overlapping cases. - The decision journey is now one case of the trajectory fixture, reusing its private daemon, shipped plugin, bridge, workspace and real subagents. The case covers: - refusal before an answer, with no journal mutation; - a native child question answered through the authenticated UI route; - completion by discovery without a supplied artifact. - `scripts/test-missions-wayfinder-decision-native.mjs` is deleted. - `native-invocation.test.ts` (162 to 90 lines) keeps one test per distinct behaviour: - concurrent isolation and stale invocations; - exact `Exit.fail`/`Exit.die` preservation; - interruption joining a raw read that ignores abort, through the real `acquireNativeHumanAnswers` adapter; - the per-check deadline between two successful checks and after an expired one. - No product code changes. Net -260 lines. ## Validation - With the pre-#1023 `managed-owner-plugin.ts` substituted in memory, the trajectory case fails after the UI reply with `Native human answer graph unavailable`. Restored, all 9 checks pass on OpenCode 2.0.31. - Detaching reads from the runner, or converting errors to defects, makes the unit tests fail. - The full server suite passes (2,410 tests, 7 existing skips), as do the server typecheck, the plugin build and bundle test, and the native contract fixture. - An independent review ended with no P0-P3 findings. |
||
|
Pascal André
|
c42cfe740a
|
fix(missions): run the one-time human gate in the invoking native graph (#1023)
## Summary A one-time Wayfinder mission could never complete a decision task. The decision child asks its native question, the human answers it in CodeNomad (authenticated UI reply, durable mark confirmed `via: "ui"`), and the coordinator's decision report is still refused with `Native human answer graph unavailable`. The one-time human gate is built in `managed-owner-plugin.ts` from the plugin setup graph. That graph lacks the Location, Form and Database services that `acquireNativeHumanAnswers` requires. Recurring passages build their own gate in the Job's Location graph (`native-recurrence-due.ts`), so they were not affected. This is why the recurring Wayfinder journey (Q) kept passing while the one-time path was broken. ## Fix - `native-invocation.ts` captures each invoking native graph with `AsyncLocalStorage` around the plugin's tool executes and forwarded Missions RPC handlers. The one-time gate runs its reads in that graph. - Concurrent invocations stay isolated. A missing or finished invocation is refused, never served by another invocation's graph or the setup graph. - Each complete human check gets its own 10 s budget, the bound `native-human-evidence.ts` already uses. Its nested SQL/Form/storage reads share that budget, which is not reset per query. - Interruption or expiry aborts those reads. The borrowed graph is released only after every started read has settled. A truly non-interruptible native finalizer must still finish first; this is documented. - Expiry surfaces as an ordinary refusal. - Recurring runners are unchanged. ## Validation - New native fixture `scripts/test-missions-wayfinder-decision-native.mjs`. It drives the shipped plugin on a private daemon with a synthetic provider: a real child asks a native question, and the reply goes through the authenticated UI route. - Before the answer, the decision report is refused with no journal mutation. - After it, the decision completes by discovery, without a supplied artifact. - On unmodified `dev` it fails with the error above; with this change it passes (OpenCode 2.0.31). - Unit regressions in `native-invocation.test.ts` use the real `acquireNativeHumanAnswers`. They cover invocation isolation, missing or stale invocations, Effect errors, interrupted and blocked reads, and successive checks separated by slow work. Each new regression fails on the earlier code. - The full server suite passes (2,413 tests, 7 existing skips), as do typechecks, the plugin build and bundle test, and the native `test-missions-native`, contract, trajectory, family-control and recurring Q fixtures. After rebasing onto #1022 (UI preferences only), the server typecheck and the 34 targeted human-answer tests pass again. - An independent review loop ended with no P0-P3 findings. |
||
|
Pascal André
|
b4f1dde4f8
|
feat(missions): coordinator hand-offs, task interrupts and native decision evidence (#1013)
Completes the coordinator frictions of #1009 left after #1011 (points 4 to 9) and repairs the recurring Wayfinder human-mark journey checks. mission.interrupt({ taskKey }) stops a retired native task's conversations through the authenticated bridge: the coordinator's direct children whose first user message carries that task's canonical assignment header. Each family is interrupted deepest first, then the conversation, with lifecycle Stop's post-interrupt recheck, settle and quiet verification; queued inputs are cancelled under the worktree-deletion fence. It refuses while any open task lives in that conversation's family (reuse or nesting chains, or its actor), and never touches the coordinator, other tasks or the plan. mission.prepare creates a paused one-time hand-off through the editor's prepareMissionCreation pipeline, holds and fences, and never starts it. A trusted preparedBy gives the preparing coordinator read-only visibility (inspect({ missionID }), inspect({ list: true })), never control. Retries read the journal's creation event first and are reported uncertain, never as nothing created. mission.inspect({ taskKey }) adds the task's observed native conversations as advisory evidence; the task-key parser is shared with the UI. A native Wayfinder decision readout may omit its artifact: the gate's discover() derives candidates from exact native structure only and verifies each; only a complete discovery with exactly one candidate fills it. requestID "auto" briefings may let the server pick the revision. One replacement may merge several retired tasks, and the task reader lists every predecessor. Scheduled passages, which have no backend route, are not offered the new tools. The Q and N journeys queried a retired human-marks key pattern; they now read HUMAN_MARK_STORAGE_PREFIX, and the Q UI run exercises discovery natively. Validation: the full server suite passes (2,383 tests, 7 existing skips). Isolated native fixtures pass against a private OpenCode 2.0.31: test-missions-native, trajectory, contract, family-control, and recurring journeys ABCD and QN. The task-reader browser suite and bundle regression pass; typechecks show only existing diagnostics. Three gatekeeper rounds; the last found no P0-P3 issue. Closes #1009. |
||
|
Pascal André
|
1173beb37c
|
fix(missions): compact coordinator tool results and state the decision rule (#1011)
Coordinators driving a real Wayfinder mission hit three costly frictions (#1009): every mission tool mutation echoed the whole map (about 50 KB after ten tasks), the canonical assignment prompt only existed inside that response, and the decision role read as a self-contained analysis although completing it requires the human's own answer to a native question. mission.delegate, revise, report and briefing now return a compact readout (missions/tool-result.ts): disposition, current revision, status, run state, frontier and the affected tasks, plus the contract and exact assignment prompt for a declared native task. Briefs, reports and the objective stay out; mission.inspect keeps the full map, and mission.inspect({ taskKey }) rereads one task with its contract and current prompt. The returned revision feeds expectedRevision and basedOnRevision directly. Reports name the task the control actually resolved, including an independent actor's omitted taskKey. The native Wayfinder decision role, the coordinator contract and native decision declarations state the rule verifyHumanDecision enforces: the task's own conversation asks through the native question tool and the user answers in CodeNomad; self-contained analysis belongs to research. Independent-mode coordinators, which that gate does not check, do not get it. The refusal shows the exact provenance shape the gate validates, kept aligned with nativeDecisionProvenance by a test. Refusals for a withdrawn readout and unsettled withdrawn work explain what to do, a briefing citing missing or retired tasks names them, and the Missions skill matches. No journal, gate, ownership, RPC or UI contract changes. Interrupting a retired task's native child, multi-task replacement, a paused-mission creation tool, native execution visibility and Form IDs remain open. Validation: 1,104 Missions server tests pass (one existing skip), with new compact-result, task reread, retired readout, briefing source, implicit report key, refusal shape and decision-rule tests. The isolated native Missions, trajectory and contract fixtures pass against OpenCode 2.0.31. Server typechecks show only the existing diagnostics. Two gatekeeper rounds; the second found no P0-P3 issue. Refs #1009. |
||
|
Pascal André
|
54958f4e83
|
fix(tauri): prevent Windows event-loop refcount corruption (#996)
## Summary
Fix repeated Windows heap-corruption crashes in the installed Tauri
build. The pinned runtime exposes clonable, thread-safe handles whose
unsafe context graph contains Tao's non-atomic `Rc<EventLoopRunner>`.
IPC-worker clone/drop traffic races the event loop's reference count and
can free the runner prematurely.
- Use `Arc` for that internal Windows runner counter, retaining
main-thread confinement of runner state and the target's existing public
threading contract.
- Add an isolated regression using the real pinned Wry runtime's public
handle API, with a negative control that reverses only this counter in a
temporary crate copy.
- Add the Windows regression to CI and document the captured failures,
compatibility rationale and removal criteria.
This is a local compatibility correction for the runtime CodeNomad
ships. [tao#1290](https://github.com/tauri-apps/tao/pull/1290) proposed
the same counter change but was closed **without merging**, because the
underlying contract violation is Tauri moving/cloning the non-Send
target. That distinction is recorded explicitly. Related reports:
[tauri#15408](https://github.com/tauri-apps/tauri/issues/15408) and
[tauri#15793](https://github.com/tauri-apps/tauri/issues/15793).
## Validation
- `node scripts/test-tauri-runner-refcount.mjs --baseline`: **9 native
crashes / 10 negative-control processes; 5 / 5 corrected passes**,
800,000 handle clones plus teardown per process.
- `node scripts/test-tauri-input-deadlock.mjs --baseline`: keydown,
keyup, char, syschar, IME and instrumented IME-boundary checks pass; the
original/reverted negative controls reproduce their expected deadlocks.
- `cargo build --locked --release -p codenomad-tauri`: passes.
- `rustfmt --check` on the new fixture and `node --check` on its runner:
pass.
- Corrected release executable installed locally on the affected Windows
machine, retaining the existing resources and updater verification
public key; original executable and matching new symbols archived
locally.
The runtime reproduction needs no JavaScript or web page. The Virtua
0.53.5 upgrade is absent from the crashing `
|
||
|
Pascal André
|
1f132dbb32
|
docs(help): list Remote Control before direct access (#990)
Reorder the shared help navigation to present Remote Control before direct access in all ten locales. Keep existing Settings behavior unchanged: Direct access starts collapsed locally and opens automatically when the server listens on the network. Update the help ordering regression. Final targeted review found zero actionable findings; all nine help tests pass, covering 25 pages across ten locales. |
||
|
Pascal André
|
d36f8a703b
|
fix(opencode-setup): offer OpenCode 2 when an old or foreign OpenCode blocks setup (#982)
# Offer OpenCode 2 when an old or foreign OpenCode blocks setup ## Problem CodeNomad prefers the `opencode` found on PATH and only installs or updates OpenCode through a verified `@opencode/cli` npm installation. When PATH held OpenCode 1.x — from the npm package `opencode-ai`, or from winget's `SST.opencode` (still 1.19.0) — setup reported no active OpenCode service and offered no action at all, only "update manually". For npm users this was a real dead end: `opencode-ai` and `@opencode/cli` both claim the `opencode` command, so npm refuses to install OpenCode 2 over it (EEXIST). ## Expected behavior **OpenCode 1.x installed with npm.** Recognized only from the package's `package.json` and the shim's actual target, never from a version string. Setup offers **Replace OpenCode 1.x with OpenCode 2** behind a confirmation. The confirmation states that the data folder is kept and that OpenCode 2 imports 1.x conversations itself; CodeNomad does not convert them. On confirm, under the existing installation lock, `opencode-ai` is removed from that npm prefix and the existing shared installation path installs and verifies `@opencode/cli`, registers PATH and implies no daemon restart. Consent carries the exact confirmed installation (`path`, `version`); the route validates it, the service compares it with current status and the installer re-checks it under the lock, refusing any mismatch. A broken 1.x install whose `--version` fails can still be replaced. Before uninstalling on Windows, every native executable owned by the legacy package (including nested `opencode-<os>-<arch>` packages used by 1.0–1.15.0) is checked for use. npm failures map to "in use", "1.x still installed" or "partially removed" (with manual instructions) from npm's error code only. If installation fails after removal, the panel reports it and offers a plain install as retry; nothing is retried automatically or by another mechanism. **Foreign installations (winget, Homebrew, curl, manual).** Never modified. The foreign version probe is asynchronous, bounded to 5 s and kills its process tree on timeout; an unknown result keeps the PATH command's priority and expires after 60 s, the setup panel's Check action forces a fresh probe, only one probe per command runs at a time, and successful results are cached by path, mtime and size. When the PATH executable is unusable or below the minimum (the notice names the minimum version), setup offers **Install OpenCode 2 for CodeNomad** into the user npm prefix, and CodeNomad then uses that managed copy. The panel says the older copy is untouched and that the terminal `opencode` may still start it. When the resolved winget package folder proves the `SST.opencode` ID, it adds that `winget uninstall SST.opencode` is optional (text only, never executed). A working foreign OpenCode 2 keeps today's PATH priority. **Mixed case.** With winget's copy first on PATH and an npm 1.x behind it, only the npm package is replaced, with confirmation. **Custom executable** chosen in settings is never overridden or installed over. ## Verified facts - npm bins: `opencode-ai` 1.18.10 / 1.19.2 → `opencode`; `@opencode/cli` 2.0.30 → `opencode`, `opencode2`. - OpenCode 1.x and 2.x share `<data>/opencode/opencode.db`; the 2.x server runs a V1 migration layer copying 1.x sessions (checked in upstream tags v2.0.0–2.0.15). - winget `SST.opencode` is a portable zip; user scope links `%LOCALAPPDATA%\Microsoft\WinGet\Links\opencode.exe` to `…\WinGet\Packages\SST.opencode_<source>\opencode.exe`; machine scope uses `%ProgramFiles%\WinGet\…`. ## Known limitations - Machine-wide winget installs and a customized winget Packages root are not covered by tests; an old executable there still gets the install-alongside action, without the winget label. - The 1.x → 2.x conversation import is upstream behavior, verified from source rather than on a real history. - POSIX symlink layouts and the POSIX process-group kill are covered by tests that run only on Linux/macOS. - A real running 1.x process holding its executable was simulated with a read-only file; npm's mid-uninstall EPERM/EBUSY parsing is tested with synthetic stderr. - For up to 5 s after startup, before the first foreign probe completes, a launch keeps using the PATH command. ## Validation - Server: 93 pass in touched areas (2 pre-existing POSIX-only skips); full suite 2341 pass, with 2 failures in untouched files (`meta.test.ts` OS-name expectation on the test machine; `binary-validation.test.ts` timing, passes alone). Coverage includes legacy shim recognition and rejections, consent, remove-then-install under lock, failure and retry, winget symlink/hardlink layouts with PATH order, winget + npm 1.x, working vs unusable foreign installs, custom executable, status/upgrade logic and route errors. - Browser: 33/33 setup tests, including replace (cancel/confirm/failure/retry), broken 1.x, the winget notice and an outdated foreign 2.x. - Real npm on Windows: `scripts/test-opencode-legacy-replacement-native.mjs` installs published `opencode-ai@1.18.10` and `1.15.0` in temporary prefixes, reproduces EEXIST, finds the nested native executables, refuses mismatched consent, then performs the confirmed replacement to 2.0.29 without starting a service. - Server and UI typechecks clean; new strings in all 10 locales. |
||
|
Pascal André
|
9cd0b4b901
|
feat(stats): display service-wide activity statistics (#968)
## Behavior Preferences gains a **Stats** section covering the **entire connected OpenCode service**: all projects, independent clones and subsessions. Every locale states this scope explicitly, because native project IDs span independent clones and cannot be presented as folder-scoped. - **Periods:** rolling 7, 30, 90 or 365 days. - **Figures:** input, output, reasoning and cache tokens; recorded USD cost; session, subsession, prompt and step counts; a per-model table; daily activity. - **Not shown:** transcripts, polling, and provider billing or quota precision. The Usage label stays reserved for provider subscriptions. ## Boundary - **Endpoint:** authenticated `GET /api/workspaces/:id/service-usage` returns native `session.stats` with explicit `scope: "service"`. - `tools` is always `none`. - Periods are bounded to 366 days. - Project, directory and tool selectors are rejected (400). - A connection or workspace change during the read fails closed. - **UI:** an in-memory display snapshot per period. It revalidates on mount, on settled session events (`session.idle`, `session.deleted`, prune) and on reconnect. - **Preferences windows:** the `usage` section is added to the Electron, Tauri and UI native allowlists. ## Validation - Server, UI and Electron typechecks pass. - Backend: `service-usage.test.ts` 3/3. - Browser: dashboard, Preferences reachability, Preferences window and startup scenarios, 5/5. - Unit: `preferences-window.test.ts` 2/2. - Native: `scripts/test-service-usage-native.mjs` passes on an isolated copy of OpenCode 2.0.29. It covers a worktree, an unrelated repository and an independent clone, with synthetic generation and a private home/database only. ## History This was originally #796 (8/8). Because the series was stacked, #796 was squash-merged into the MCP Code Mode branch (#795) rather than `dev`. It is split out here so it can land on its own. Review fixes are included: an in-memory cache instead of `localStorage` keyed by non-persistent workspace IDs, the status-card surface role and spacing tokens. |
||
|
Pascal André
|
b4be76c978
|
feat(plugins): native package check and update (6/8) (#794)
## Behavior
Package-backed plugins in Status → Plugins get one compact action beside
their name. Activating it opens a menu naming the exact native
operation:
- **Check updates for {target}**: `PackageSearch` icon.
- **Update {target}**: `Download` icon, shown once the target is
outdated.
The tooltip states that an update changes the daemon-wide shared package
cache. Busy actions pulse but keep their own icon; `RefreshCw` stays
reserved for the list refresh. Global/Project activation switches are
unchanged. Local, builtin and SDK sources never offer package actions.
A package that fails before exporting a plugin ID stays visible as a
target-only row, with check/update and failure details in its tooltip.
No activation switch or fabricated ID is created, and the row is
replaced by the ordinary plugin row once native loading succeeds.
Pending admission is keyed by instance and target and survives
hiding/remounting. Failures toast only for the live owner. Every
completion invalidates the display snapshot, and nothing is replayed
automatically.
## Native boundary
Only `POST /api/plugin/check` and `POST /api/plugin/update` are added to
the instance allowlist. They go through the existing directory-ownership
and worktree-deletion admission, so a foreign location is refused
whether it is in the query or the body. Native OpenCode validates
targets against the current Location inventory and serializes updates
per target. There is no `location.reload` and no daemon restart.
## Validation
- Server and UI typechecks pass.
- `instance-proxy.test.ts`: 56/56, including owned check/update and
foreign query/body locations rejected before forwarding.
- Browser: `plugin-controls` and `plugin-packages` pass, 10/10
scenarios. Captures inspected for LTR, RTL, narrow and
failed-package-only layouts.
- `scripts/test-plugin-packages-native.mjs` passes on an isolated copy
of OpenCode 2.0.29 with a loopback npm registry. It covers 1.0.0 → 1.1.0
update detection, unknown-target rejection and native live reload, using
a private home/database/npm config/cache only.
## History
PRs 1–5 of this series were squash-merged into `dev`. This branch now
merges `dev` and carries only its own plugin-package changes plus review
fixes (25 files).
Size notes: the existing `http-server.ts`, `instance-proxy.test.ts` and
locale settings files exceed the size guidance.
|
||
|
Pascal André
|
c0d53f13d4
|
docs(help): multilingual help site with in-app Help menu and palette entry (#859)
## Summary A complete public CodeNomad help site in the app's ten languages, published on GitHub Pages (https://neuralnomadsai.github.io/CodeNomad/) and opened from the app. - **Content:** 25 pages in 8 sections (Start, Workflows, OpenCode setup, Remote access, Customize, Extensions, Desktop, Help), written for OpenCode power users and covering the current version only. It includes everything user-relevant from `README.md`, `packages/server/README.md` (server, network, auth, TLS, Remote Control) and the user-facing dev-docs, with flags, defaults, labels and safety boundaries checked against source. - **Languages:** en, fr, de, es, he (RTL), ja, ne, ru, tr, zh-Hans. Interface labels reuse each locale's own app strings; native desktop menu names, code, commands, flags, paths and anchors stay unchanged. - **Site:** `scripts/build-help.mjs` renders `docs/help/<locale>/<slug>.md` with translated chrome (`docs/help/i18n/`), stable `{#id}` anchors identical across locales, same-article language links with hreflang, a root language chooser, and a first-party offline per-locale search (Ctrl/⌘+K, substring matching for CJK, Devanagari and Hebrew, hidden without JS). No analytics or remote resources. - **Validation:** `npm run test:help` fails on any missing page or string, heading drift, broken link/anchor/asset or invalid search target. `.github/workflows/help-pages.yml` validates PRs and deploys only from `dev`. - **App entry points:** one `open-help` command for the palette and a new **CodeNomad Help** item at the top of the Electron and Tauri Help menus. It opens the help in the invoking window's UI language through the existing external opener, falls back to the root URL for windows without the handler, and reports failures without replay. - Documents the strict boolean environment-variable rule from #959 and the updater entry points from #960. ## Review Delivered as a CodeNomad mission with independent review loops, each to zero findings: - English content audit (5 passes, 14 fixes) and technical gatekeeper (2 passes) before translation. - After translation: QA, UX review, and a final multilingual gatekeeper (35 translation/label findings fixed, then verified), plus a visual fix for the search focus ring and a verified sync with #960. ## Validation - `npm run test:help`: 9/9 (25 pages × 10 locales, strict, including negative tests); `npm run build:help`: 250 pages. - `node scripts/test-help-browser.mjs`: 44/44; Playwright: 500 page visits at 390 and 1280 px, all locales, no overflow, no external requests. - UI help-command and desktop-updates browser tests 19/19; help URL unit tests; Electron menu tests; UI and Electron typechecks; Tauri `cargo test` 272/272. |
||
|
Pascal André
|
4e0b62bc7f
|
build: ship the Linux deb from Electron and the Windows installer without a ZIP (#955)
## Summary One download per need, with fewer duplicate or unused assets: | | Before | After | |---|---|---| | **Linux Electron** | portable `tar.gz` | **`.deb`** | | **Linux Tauri** | `.deb` + AppImage | **AppImage** (self-updating) | | **Windows Tauri** | ZIP wrapping the installer + the same installer as `.exe` | **`.exe`** only | | **Updater signatures** | `latest.json` + separate `.sig` assets | **`latest.json` only** | ### Linux: Electron deb, Tauri AppImage - The Electron deb installs as root, so electron-builder's post-install script gives Chromium's `chrome-sandbox` the `root:root` ownership and `4755` mode that a user-extracted archive cannot. Electron starts **with its sandbox** and without any manual step. This fixes #541 properly. - The package is named `codenomad` and **conflicts with / replaces** the former Tauri deb (`code-nomad`). Both ship `/usr/share/applications/CodeNomad.desktop`, so without this, installing over an existing Tauri deb would fail on the shared file. - The deb declares Electron's full runtime closure. electron-builder's default `Depends` omit `libgbm1` and ALSA, which previously arrived only through Recommends. ALSA is declared as `libasound2t64 | libasound2`, because `libasound2` is a multi-provider virtual package on Ubuntu 24.04. - Debian versions: dev builds (`<stable>-dev-<date>-<sha>`) become `<stable>+dev.<date>.<HHMMSS commit time>.<sha>`, so they install as upgrades after their stable base and in order on the same day; other prereleases keep electron-builder's `~`, which sorts before the release. The workflow rewrites the control `Version` with `dpkg-deb` when it differs; PR and stable builds rewrite a copy to a synthetic dev version and check that fields, files, modes, owners and control members are preserved. - Tauri Linux builds only the AppImage (`tauri build --bundles appimage`). - No unused electron-updater metadata is generated (`publish: null`). ### Windows: installer only - The Tauri NSIS installer is published directly as `CodeNomad-Tauri-windows-x64-<version>.exe`. It is also the signed updater payload, so signed builds upload it once. - The ZIP that wrapped the same installer is no longer published. - The WinGet automation defaults now point to the `.exe`. ### Updater signatures - The updater reads each signature from `latest.json`, never from a `.sig` asset. Staging still verifies every signature and its trusted comment and records it in the receipt, and publication still requires every payload's uploaded digest to match. - Releases no longer carry `.sig` assets, and staging deletes any left on a rebuilt tag by older builds. Rebuilt tags also delete obsolete Electron `tar.gz`, Tauri deb and Windows ZIP assets. ### Docs - **README:** shows the deb and AppImage commands. The AppImage uses the static type2 runtime, so it needs no `libfuse2`; `--appimage-extract-and-run` covers environments without FUSE. The Wayland/NVIDIA command now targets the AppImage. - **BUILD.md, `TAURI_UPDATER.md` and the WinGet guide** describe the new formats. ## Migration note Installing the Electron deb over a Tauri deb switches the app from Tauri to Electron: - `code-nomad` and `codenomad-tauri` are removed, and the launcher becomes `CodeNomad`; - server configuration is shared, but desktop window state is not migrated. Tauri deb users never had in-app updates, so the release notes should say this. The AppImage is their Tauri option. ## Validation - **Electron deb packaging (CI):** checks package, conflicts, replaces and version metadata, the contents, the post-install `chmod 4755` step, the resources/asar smoke checks and `ldd`. - **Electron deb install (CI):** installs on Ubuntu 24.04 **without recommends**, so `ldd` proves the declared `Depends` are enough. It installs over a stand-in `code-nomad` package, then checks that the old package was replaced, the owner of the desktop entry, `/usr/bin/CodeNomad`, `chrome-sandbox` `root:root 4755` and shared libraries. - **Version mapping:** the mapping, the ordering against stable, later releases and same-day builds, and both repack branches were checked with dpkg 1.22.6 on Ubuntu 24.04. The repack keeps the control fields and root ownership. - **Dependencies:** every declared dependency resolves on Ubuntu 24.04, either as a real package or through its t64 provider. - **Updater scripts:** `updater-artifacts.test.mjs` passes, including signature-in-manifest publication with no staged `.sig`. - **Workflow:** the YAML parses. - **Independent review:** no blocker. The major finding (missing deb dependencies) and the minor ones (dev version ordering, stale BUILD.md and README command, unchecked exit codes, unused updater metadata) are addressed. ## Follow-ups outside this PR - **WinGet:** the `WINGET_WINDOWS_ASSET_NAME_TEMPLATE` repository variable still pins the `.zip` name and overrides the new default. Before the next stable release: - update it to `.exe`, or delete it; - check that the automated `winget-pkgs` PR declares a direct `nullsoft` installer without the old ZIP fields, and correct it if not. Until then, a stable release's WinGet job waits for the ZIP and fails without side effects. - **Ubuntu desktop trial:** test the Electron deb on a real Ubuntu desktop. |
||
|
Pascal André
|
8e8ca15934
|
chore(opencode): qualify runtime 2.0.29 and align client/plugin pins (#948)
## Summary - Recommend and pin OpenCode **2.0.29** (`@opencode/client`, `@opencode/plugin`); the technical minimum stays **2.0.27** since 2.0.28/2.0.29 keep Effect 4.0.1. - Add 2.0.29 as a reviewed contract profile beside 2.0.27; 2.0.28 and future/custom labels keep authenticated negotiation. - Test fixture only: the recurring Missions host declares the `credential` domain that the 2.0.29 Promise adapter reads eagerly (the managed owner spreads `ctx`, dropping the Proxy fallback). No product code change. - Two new isolated fixtures for upstream behavior changes: bounded output-length continuation, and rejected Promise tools / native denial. - Compatibility docs, CONTRIBUTING, AGENTS and architecture guide updated. ## Upstream review - OpenAPI: same 118 paths; additive schema changes (config `policies`, provider/model `compatibility`, `encoding`). - Private LocationServiceMap/Form/Permission/queue contracts used by the pending snapshot: unchanged. - Effect stays 4.0.1. ## Validation (Windows, isolated CLIs/databases, never the shared daemon) - 2.0.29: plugin runtime, automation, pruning/history/proxy, Missions contract/family control/full journey, session environment, fork, aside, prompt skills, Git degraded/init, provider usage/accounts, temporary workspaces, blank-session cleanup, output-limit continuation, Promise tool failure, system settings discovery, native upgrade 2.0.15→2.0.29. - 2.0.27 (minimum): plugin runtime, automation, pruning, Missions contract/family, session environment, fork, aside, prompt skills, blank cleanup. - Server: 2235 passed / 7 skipped / 0 failed. UI: 1524 passed. Tauri crate 268/268, updater handoff 1/1, UI updater flow 13/13 (dev base includes #786). ## Known, not caused by this change `scripts/test-permission-receipts-native.mjs` times out identically on 2.0.27 with the previous pins; tracked separately. |
||
|
Pascal André
|
dac236c8fd
|
feat(tauri): signed cross-platform updates with stable and preview feeds (#786)
Desktop Tauri builds now update themselves in place on Windows (signed NSIS), macOS x64/arm64 (signed .app.tar.gz) and Linux x64 (signed AppImage), and Linux gains AppImage distribution. The application no longer shells out to `winget upgrade`; WinGet remains a distribution channel. Updates follow the same two feeds as the server notifications: `stable` offers GitHub's latest final release when it is newer; `preview` (dev + release) offers the newest publication of any kind, ordered by publication because dev labels reuse their base version. The saved `server.updateFeed` selects the feed (otherwise the build label). Only releases carrying their signed `latest.json` are installable, so releases still building are never offered. Native code owns URLs, keys and installers: renderers pass only the feed and, after an explicit "Install and restart", the accepted version. The manifest must announce exactly the selected version and `requireSignedVersion` binds it to the signature. Full verification precedes shutdown; installation and restart are admitted atomically with an all-window flush; timeouts, cancellation and failed cleanup discard the installer without replay. Failures belong to the installing window, survive reloads and are reported once; concurrent checks report "busy". Menu actions reach only the focused local application document. The vendored tauri-plugin-updater 2.12.0 runs its Windows exit callback only after a successful installer launch. Publication stages four verified payloads (signed version required) and publishes each release's `latest.json` only after validating every receipt and uploaded digest; rebuilt tags drop a stale manifest first. The signing private key reaches only `tauri build` steps. Unsigned builds and PR runs publish nothing. Debian/RPM and unsupported formats use the release-page fallback. The Tauri CLI minimum is 2.11.5. Validated by eight rounds of independent review (zero findings on both native/CI and renderer/docs), 268 native tests, script and browser regressions, real signed update trials on Windows and Linux (from loopback endpoints, before feed selection), and published-package trials on Windows, Linux and macOS x64. A production-signed dev prerelease, macOS signed updates and draft restoration across an update remain to be exercised. |
||
|
Pascal André
|
5dd8150f62
|
test: stabilize three intermittent CI failures on dev (#941)
## Summary Stabilizes three tests that failed intermittently on recent PR runs regardless of the change under review (including #786 and others). Each failure came from the test harness, not from product code; no product code changes. - **Session pruning UI (Windows):** header actions take pointer events only while their message is hovered or focused, and the virtualized row can be replaced while scrolling into view. Playwright's click then hit `.message-item-header-row--top` and retried without re-hovering until timeout (`test-session-pruning-ui.mjs:192`). The response cleanup action is now activated from the keyboard only while the live button holds focus, transient detachment is retried, and Enter is never pressed once the confirmation dialog is visible. - **`mission-native-family`:** `timeline-previews.ts` deliberately aborts optional `outlinePreview` requests whenever the requested marker set changes within the same session. The test counted such aborts as failures unless the active session had changed; they are now recorded as superseded reads. Full `outline` reads keep their stricter rule. - **`family-authority-identity-fence` (server):** Git 2.46+ detaches automatic maintenance after commits; its late trace2 `exit`/`atexit` events (child session of the commit) landed in a trace the test had just cleared to prove a fence is process-free. The test's Git invocations now disable automatic maintenance and gc. ## Context Recent `dev` merges went in with failing `tests` jobs: an earlier failing step (for example `Test server`) skips the browser step, so new browser failures stayed hidden. The `git-history`, `panel-extensions` and `project-git-lifecycle` breakages were already fixed by the test commits in #940; this PR addresses the remaining intermittent ones. ## Validation - Pruning UI runner: 3 consecutive local passes with an isolated official OpenCode 2.0.28 runtime. The first draft of this fix failed deterministically on detachment, confirming the race locally. - Identity fence suite: 5 consecutive local passes (the Linux Git maintenance race itself is confirmed by CI). - `mission-native-family`: 11/11. |
||
|
Pascal André
|
2570764c41
|
feat(files): initialize Git from the Files panel for plain folders (#933)
## Summary When Git is available but the opened folder is not a repository (temporary workspaces, plain folders), the Files panel's Changes and Commits views now say so and offer **Initialize Git**. Directory-only mode, where the backend cannot run Git, is unchanged. ## Design - **Route:** `POST /api/workspaces/:id/git-init` accepts only the exact opened folder. - It refuses directory-only mode, folders already inside a repository, unowned folders and folders being deleted. - It checks that OpenCode resolves the same folder as the project directory, then calls native `vcs.init` once, without retry. - A 501 maps to a localized "not supported" message. - **Refresh after init:** - The server re-reads the worktree inventory and resets the git-status cache. - The UI refreshes file caches, worktrees, project metadata and the session list. - Initialization changes the folder's native project ID, so stale project metadata would otherwise leave later session pages empty. - **No confirmation dialog:** creating `.git` is non-destructive and easily undone. - **Also fixed:** a spurious "detached HEAD" suffix on non-repository folders in the worktree selector. ## Validation - Server unit and route tests: authorization, refusals, 501, refresh. - New browser regression `git-init.test.ts` (2/2): empty state, button, refreshed Changes and branch, 501 message with no retry. The existing Files panel suite passes 18/18. - Isolated native check `scripts/test-git-init-native.mjs` against a private OpenCode 2.0.27 daemon. - Server and UI typechecks pass. Oversized files touched: `workspaces/manager.ts` (~1307 lines) and `lib/api-client.ts` (~809 lines). An independent gatekeeper review will be published before the admin merge. |
||
|
Pascal André
|
34ad2fbeb5
|
fix(plugins): wait for plugin registration before the first plugin RPC (#925)
## Summary On the first seconds after a CodeNomad start, the timeline could show "Timeline unavailable" (the full index read failed) until a manual Retry or session switch. The OpenCode log shows every bundled-plugin refusal (HTTP 400 on `/api/rpc/codenomad.session-pruning/*`) 3–4 s after a backend start, and never otherwise (10/11 10:45 and 22:43, 10/12 18:10). Cause: the bundled plugins register their RPCs only while a backend presence lease exists, and check presence every 2 s (`desktop-plugin-presence.ts`). A stopping backend removes its lease, so the plugin unregisters; a new backend writes a lease, but the plugin only notices at its next check. A backend RPC in that window is refused, and the route reports it as unavailable. The timeline index is simply the first such call. This PR fixes the ordering rather than retrying refused reads: - **Plugin side.** Each presence follower records which current-namespace leases it has observed while registered. Once every follower of that directory in the native process (one per loaded Location) has done so, a `<lease>.ready` marker is written beside the lease. Marker IO stays outside the serialized reconciliation, so it never delays or swallows a presence check. Read-only legacy namespaces are never written. Observations move to a v2 shared map (lease names); older bundle copies keep their v1 map. - **Backend side.** After writing its lease, the backend waits for that marker (local file check every 100 ms, bounded to 8 s, never rejects; disposal ends the wait and removes the marker with the lease). `DesktopPluginLifecycle.ready()` exposes the current installation's readiness and `WorkspaceManager.desktopPluginsReady()` forwards it. - **Routes.** Every bundled-plugin RPC caller awaits `desktopPluginsReady()` before its first call: timeline/history navigation, history, pruning batches, pruning, panel extension assets and the pending-request snapshot (which otherwise took the refusal as "unsupported"). Pruning routes wait before entering the worktree deletion fence, so the wait never holds it. After the bounded wait the call proceeds and its real result is reported, so an actual failure stays visible. ## Validation - New `desktop-plugin-readiness.test.ts`: readiness after registration and marker cleanup on stop; no marker while a follower is still registering; no acknowledgement without presence and no writes to an older backend's directory; readiness settles at once when the backend stops first. Negative control (marker acknowledgement disabled): the two readiness tests fail. - Route regression: a timeline read does not call the plugin until readiness settles. - Existing presence, installation, lifecycle, automation, missions, pruning installation, pending snapshot and route suites pass, including the strict shared-scan counts. A first version awaited marker IO inside reconciliation and made the missions presence tests time out; marker IO is now detached. - Server typecheck; plugin bundles build (pruning, automation, missions). ## Notes - Scope is the bundled pruning plugin's RPCs (timeline, history, pruning, panel assets, pending snapshot). Missions and automation follow the same presence contract and also receive markers, but no extra backend gating is added for them here. - The recurring "Question and permission recovery is incomplete" warning is a separate issue (captures show complete 200 responses and no plugin refusal around it) and will be handled in its own PR. |
||
|
Pascal André
|
dd5a1f387d
|
fix(opencode): share host plugin runtime and require 2.0.27 (#920)
## Résultat Corrige le chargement des plugins CodeNomad avec OpenCode 2.0.27 et établit cette version comme minimum pour les prochaines releases et les prereleases dev. Aucun déploiement de l’application active ni redémarrage du daemon partagé. ## Cause démontrée - Le runtime natif passe d’Effect 4.0.0-rc.112 à 4.0.1. Le bundle précédent reproduit `cache.stackFrame` sur une CLI 2.0.27 isolée. - Embarquer Effect 4.0.1 ne préserve pas la 2.0.26 : échec inverse `cache.scheduler`. - Les schémas 2.0.27 consomment `Schema.isStartingWith`, absent du moteur 2.0.26. Le plancher est fondé sur cette rupture mesurée, pas sur une liste de versions testées. ## Implémentation - Pins client/plugin synchronisés à 2.0.27 ; Effect et le SDK public des plugins sont fournis par OpenCode, hors bundles natifs pruning/Missions/automation. - Réglages de build partagés et régression qui interdit une seconde copie du runtime ; smoke natif ajouté à la matrice minimum/latest. - Diagnostic `plugin_runtime` traduit dans les dix locales ; versions futures et personnalisées conservent la reconnaissance authentifiée du contrat. - Adaptations du SDK : annulation des lectures projet, références de credentials externes et connexion fournisseur externe avec formulaire natif, sans fallback OAuth/API key ni rejeu. - Le runtime OpenTunnel du backend reste isolé et inchangé. Aucun tunnel, route ou identité distant n’est modifié. ## Validation locale - Échec reproduit sur 2.0.26 et réussite sur 2.0.27 pour les variantes de bundle comparées. - Suites natives isolées automation, pruning/historique/proxy/concurrence/redémarrage et Missions réussies sur 2.0.27. - Régressions ciblées de build, store/serveur et navigateur (diagnostic du minimum, connexion externe et brouillon conservé) réussies ; typechecks UI/serveur/Electron/OpenTunnel réussis. - Suite serveur complète et CI multiplateforme encore en validation à l’ouverture ; aucun résultat entièrement vert anticipé. La revue gatekeeper indépendante sera publiée ici avant fusion. Les anciennes preuves de qualification restent historiques, pas une promesse de support des moteurs antérieurs au nouveau plancher. |
||
|
Pascal André
|
81fb513558
|
feat(missions): native project coordination, briefings and tracking (#866)
# Missions: product specification ## Product goal Missions coordinates complex work through native OpenCode conversations. CodeNomad provides creation, controls, human attention and result reading; OpenCode owns execution. One-time objectives and finite daily recurring passages share the same planning and reading experience. No OpenCode modification is required. ## Create and configure - **Flexible mission**: free-form objectives and bounded delegation. - **Debugging**: diagnosis, implementation, independent standards/specification reviews and fresh validation. - **Exploration**: bounded decisions and parallel investigation, with explicit native human questions where required. Creation presents an objective, a short optional title, verbatim working notes, coordinator/task profiles and native or independent task-session policy. Optional choices stay collapsed. A single **Create** button saves a prepared one-time mission or paused recurring schedule without starting anything. **Play** is a separate explicit action for both. Settings → Missions contains defaults for **all new missions**, with optional exceptions for each of the three types, including Flexible. A type exception overrides the global value; an unset field shows the inherited value. Defaults never reconfigure existing missions or busy actors. Reusable briefs contain creation inputs only; loading copies them into a normal draft and deletion preserves executions. **Save as brief** is also available from a selected one-time mission, including a completed mission: it copies objective, verbatim notes, template, stored profile choices and task-session policy; the mission title prefills the brief name, never copying execution identities or results. Profiles choose an agent, model and optional reasoning variant. Coordinators use primary/all profiles; native task actors use subagent/all and independent actors use primary/all. Business roles remain separate from native session identities. Actor continuation preserves the accepted profile. The native subagent-depth editor is separately Location-scoped and applies to all OpenCode conversations there, not just missions. It shows the configuration file, effective value and override. Conditional Save preserves the original file expectation and never automatically reloads or restarts OpenCode. ## Missions panel The first toolbar holds only general actions: **Create**, **Settings** and **Refresh**, aligned right. Settings opens the Missions settings section directly, using the existing native Preferences window on desktop. A native refusal shows an error rather than opening a second embedded window; browser and remote windows retain their embedded settings. The current-mission line contains a leading chevron, the selected title and a small status mark: - Clicking the **chevron** expands a persistent inline list; selection leaves it open. - Clicking the **title** opens a transient popup; selection, outside interaction or Escape closes it. - Both lists show titles and status marks, with full labels in tooltips and accessible text. Titles truncate only at the available row edge. - Search appears only when the measured list exceeds its maximum height, and remains available while a query is present. - The closed chevron indicates activity/attention in other missions using the same visual vocabulary as the session list. - Only the picker changes the selection, remembered per project; opening a mission's conversation never reselects a mission. Selected-mission controls are separate: **Play/Pause**, **Stop**, optional recurring **Run now**, then **Summary**, **Open coordinator conversation**, **Edit** and **Delete**. Destructive actions require confirmation. **Request an update** is a text button below the icons, available only while meaningful; its pending/uncertain state is retained without automatic replay. The **Tasks** disclosure contains only the declared dependency tree, not a duplicate task list. It is initially open, remembers its state and uses the remaining panel height down to the window bottom rather than a fixed task-height cap. Rows retain full-width selected/hover backgrounds across connectors and controls. A task's exact conversation shortcut appears on desktop hover/keyboard focus, and remains visible on touch. Mission selection is remembered per project and changes only through explicit mission selection/creation. Opening a coordinator or task conversation in the session list never changes the selected mission. Conversation shortcuts remain available from the mission panel to the coordinator and exact task conversations. The session-list files are unchanged relative to `dev`; restoring the full cached session hierarchy is supplied by the separately merged #841. ## Plan and native execution The coordinator declares tasks, dependencies, roles and expected outcomes. Ready work can run in parallel through ordinary native subagents. Recursive decomposition follows OpenCode permissions and configured depth; the product imposes no delegation target or root fallback. Independent sessions remain available for an explicit Location, lifetime or existing-root requirement. The task-session policy is frozen per mission. Tasks have stable keys/generations; conversations have exact native identities. Business dependency edges never stand in for native ancestry. Native task returns and business settlement are separate: a coordinator records the actual returned result/evidence, then finalizes the mission. A notification/admission acknowledgement is not proof of consumption or completion. ## Results and human interaction Long objectives, briefings, task results, evidence and plan history open in the central reader above the transcript. Reader eyes toggle the exact target and highlight it. Task results come before the original brief and technical details. A missing/unavailable reader target must not leave the transcript hidden. The coordinator publishes dated, bounded briefings explaining delivered results, remaining work, obstacles and the next step in plain language. Briefings remain separate from task settlement and observed activity; exact request identity is required to acknowledge an explicitly requested update. Attention contains real native Forms and permissions. Obstacles reported in prose are not automatically human requests. Native interruptions retain conversation provenance and drafts in the shared interruption dock. A template's required human decision counts only when answered through the CodeNomad UI, locally or from a live paired Remote Control device; a simple UI-answer mark records that provenance. Users give direction or ask questions by writing in the coordinator conversation (**Open coordinator conversation**). From the panel itself, the only coordinator message is **Request an update**; its pending/uncertain state is retained by identity and never replayed automatically. Reports, plan history and cleanup receipts stay secondary in reader/technical surfaces. Optional managed-session cleanup preserves coordinators, shared/reused/moved sessions and roots with descendants. ## Lifecycle and recovery For one-time missions: - **Play** starts/resumes explicit mission intent; **Pause** parks mission dispatch/notifications and interrupts the observed active native family. - **Stop** is terminal and interrupts observed descendants deepest-first, then registered roots/coordinator, with bounded rechecks for parent wakes caused by child cancellation. - Native inbox cancellation uses exact authorized mission/subagent work. Pause preserves deferred results for explicit Play; Stop removes the identified queued work/results that would wake a stopped coordinator. - Per-target receipts record observed interruption and family coverage. Incomplete or unconfirmed interruption is shown as **Some sub-agents may still be running**, never as proven recursive suspension. - **Refresh** reconciles state first; an explicit refresh click may retry a still-unconfirmed lifecycle action under its original identity. Reconnect and ordinary display reads never resend mutations. - **Play** offers targeted recovery only when native observation establishes the applicable interrupted state, not merely because activity is unknown. Active background descendants retain the active/Pause presentation. Native interruption does not undo completed filesystem/tool effects. Resuming a paused mission lets the coordinator decide how to continue or re-delegate interrupted work; there is no hidden task replay engine. ## Recurring missions Recurring setup adds permanent instructions, a title, a daily local time/timezone and explicitly followed project conversations. Saving creates a paused schedule; Play arms it and Run now requests one finite passage. The OpenCode service/plugin owns scheduled passages while both CodeNomad UI and its intermediary backend are closed. One native Job per running schedule sleeps until the earlier of the next due time and one hour. On waking it rereads the clock/document and admits only the latest due civil day newer than the stored daily cursor; there is no backlog. Native execution terminal events also wake observation after a debounce, but are not settlement evidence. Before native effects, conditional storage records deterministic passage, coordinator and start-message identities. Lost replies reconcile those exact identities rather than creating new attempts. A passage archives only after the coordinator and descendants are inactive, inboxes are empty and no relevant native Form, permission, Shell or background subagent remains. Unknown coverage stays pending. Passages end as completed with a final report, native terminal failed, or ended-without-report/interrupted. Only completed passages advance followed-conversation cursors. Schedule history is bounded to 30 passages. Civil-time DST gaps/repeated times and entirely skipped days resolve deterministically. Pause/Stop cancel the schedule Job; those schedule actions do not prove an already-running passage family stopped. Stopped is terminal. After service restart, a desired-running schedule without its Job is **Interrupted**, awaiting explicit Resume. Resume reconciles pending work, never sends a continuation; a turn cut by restart settles interrupted/ended-without-report. ## Durability and UX Mission journals and schedule documents retain tasks, roles/profiles, results, plan revisions, controls, notifications and bounded history. Conditional writes and original request identities protect mutation retry. Authority, Location ownership, fresh per-send environment and connection/deletion fences are checked at admission. Ordinary native permissions govern tool use. UI remains compact and square, localized in all supported languages, keyboard-accessible and usable on touch/narrow/RTL layouts. Cache-first display reads revalidate on visible demand and native invalidation, without polling or clearing known data on uncertain recovery. Loading, missing capability and uncertain effects remain explicit. ## Shared integration scope The PR also includes supporting shared-runtime corrections; these are not limited to the Missions tab: - Session outcome and generation-recovery reconciliation retains uncertain interruption state across reconnects and checks native outcomes before clearing it. Native message pages clamp to the service's 200-message limit. - Pending-request recovery retains known requests through incomplete coverage and connection transitions; native ownership and deletion fences remain authoritative. - Keyboard offset and the compact composer help strip preserve reachable input controls without changing composer height limits. Touch overflow actions suppress duplicate compatibility clicks. - Workspace text saves enter the existing worktree mutation fence; sandboxed panel asset reads fence connection changes. Worktree scans retain validated family identity and custody. - The worker-based Git process runner uses an ESM-safe worker entry, and CLI service discovery shares bounded command deadlines. - Desktop/backend profile identity is explicit for Missions' owned storage. Profile-scoping signals are internal to that relationship, not permission for independently launched applications to inherit a profile. - Shared rendering/localization includes a Turkish tool-call label correction. - Session-list startup restoration exposes a settled signal (`stores/session-list-restoration.ts`, hooked in `session-api.ts` and `instances.ts`). Missions display reads wait for it so the session list loads first; it settles on success, failure, timeout or abandonment and is reset when a workspace is removed. Session-list components and styles are unchanged. These callers are included in integration review and their regression tests, rather than treated as an unchanged dependency surface. ## Current limitations - Editing/deleting recurring schedules is not implemented; those icons in the selected mission's action bar are disabled for schedules. - An uncertain one-time creation (lost reply after the request was sent) is held in window memory with no status endpoint; Create stays blocked for that window until reload. Definitive refusals before any native effect re-enable Create immediately. - Saving a brief from an existing recurring schedule is not implemented; the selected-mission action currently covers one-time missions only. - Task conversation lookup for older unbound native tasks reads a bounded coordinator-message window and recognized exact assignment evidence. Older/unrecognized delegations may have no shortcut; no conversation is guessed from titles or timings. - Running native calls may not expose their child ID until completion. The panel can instead identify a direct child by its first canonical assignment message, within a bounded direct-child page; unrecognized or out-of-bound children remain unlinked. - Native task profiles are recorded, but ordinary subagent launch still relies on the coordinator passing the declared agent/model/variant to OpenCode. Omitted model parameters can inherit the coordinator's model; profile storage alone does not enforce launch parameters. - One-time recursive interruption is best-effort and bounded, not a durable guarantee that every descendant stays stopped. Partial/unknown coverage remains visible. - Recurring Pause/Stop cancel scheduling, not guaranteed recursive suspension of a running passage. - Native qualification uses isolated services; mock-only and source-review evidence never substitute for real native acceptance. Final validation results are published separately in the PR reviews. - Managed-service restart and some lost-reply/clock-conflict/human-decision journeys still have offline-only evidence. - If an admitted passage start is removed by pruning before its lost durable write is reconciled, that original start identity can become unavailable for deduplication. ## References - [Mission contract](https://github.com/NeuralNomadsAI/CodeNomad/blob/experiment/missions-native-subsessions-20261003/dev-docs/MISSIONS.md) - [Recurring contract](https://github.com/NeuralNomadsAI/CodeNomad/blob/experiment/missions-native-subsessions-20261003/dev-docs/MISSIONS_RECURRING_SIMPLE.md) - [Native qualification](https://github.com/NeuralNomadsAI/CodeNomad/blob/experiment/missions-native-subsessions-20261003/dev-docs/MISSIONS_RECURRING_SIMPLE_QUALIFICATION.md) |
||
|
Pascal André
|
07cde5ffc2
|
fix(release): retain local remote-tunnel dependency after version bumps (#907)
## Summary Fix the release failure at `Set workspace versions`: https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/38032483689 The server requested `@codenomad/remote-tunnel@0.1.0`, but release versioning changed that private workspace to the release version. npm then attempted to fetch the unpublished package from the registry and failed with HTTP 404 before any binaries were built. - Reference the internal build-time adapter with `file:../remote-tunnel`, including lock metadata. - Fix every existing workspace-versioning caller without changing individual CI jobs or publishing the private package. - Keep all external library pins and the adapter Effect isolation unchanged. - Add a small offline native npm regression covering stable/prerelease versioning, clean installation and the local workspace link. ## Validation - Regression fails with the old dependency declaration and passes with the fix: `node scripts/test-release-workspace-version.mjs`. - Actual complete repository manifests/lockfile pass prerelease `npm version` and offline `npm ci`; only workspace version metadata changes. - Clean locked workspace installation passes. - Remote-tunnel typecheck passes. - Full server production build including UI, plugins and remote-tunnel bundle passes. - Bundled remote-tunnel runtime imports successfully. - `git diff --check` passes. Cross-platform installers are not rebuilt locally. Existing user work is untouched; CI is not waited on or monitored. |
||
|
Pascal André
|
0aba9f45a7
|
feat: temporary instances that are kept or discarded when closed (#899)
Refs #889 (étape 1 ; le déplacement d’un projet gardé vers un dossier choisi reste hors périmètre). ## Comportement - **Création** : bouton « Nouvelle instance temporaire » sur l’accueil et commande de palette. CodeNomad crée un dossier vide sous son dossier de configuration (`temporary-workspaces/<date>-<id>`) et l’ouvre comme un onglet normal, nommé « Temporaire · HH:MM », avec une icône de sablier, hors projets récents. - **Fermeture** (X, Ctrl+W) : dialogue **Garder / Jeter / Annuler**, puisqu’un onglet temporaire fermé ne pourrait pas être rouvert. - **Garder** : le dossier et ses conversations deviennent un projet récent nommé, sur place. - **Jeter** : conversations et dossier supprimés. - Le clic droit sur l’onglet propose aussi « Garder comme projet ». - Au redémarrage, l’onglet revient toujours marqué temporaire. ## Mise en œuvre - Dossier sans Git : OpenCode le range dans le projet « global », mais CodeNomad filtre déjà les conversations sur le dossier exact, donc rien ne se mélange. - Le statut temporaire est l’appartenance à un registre (`temporary-workspaces.json`), pas l’emplacement ; les entrées dont le dossier n’existe plus sont oubliées. - Garde-fous de **Jeter** : - seulement les enfants directs enregistrés de la racine temporaire ; - refus si une conversation tourne ou si le dossier est ouvert dans un autre onglet ; - exécution sous le fence de suppression des worktrees ; - conversations supprimées enfants d’abord ; - workspace fermé avant l’effacement du dossier, avec réessais pour Windows ; - le dossier reste enregistré si l’effacement échoue. - Le store d’alertes gagne un dialogue de choix générique : Annuler plus des choix ordonnés, le dernier ayant le focus, et toute fermeture valant annulation. ## Validation - Serveur : `temporary-workspaces.test.ts` (4/4) ; 438/439 tests serveur `workspaces` + `server`. Le seul échec est le test de charge de `pending-requests`, qui passe seul et est sans lien. - UI : `temporary-instances.test.ts` (4/4) ; `tab-chrome.test.ts` (6/6, Electron ignoré), avec marqueur d’onglet, entrée de menu et dialogue de choix sur les vrais composants ; typecheck et build. - Natif isolé : `node scripts/test-temporary-workspaces-native.mjs <CLI>` contre OpenCode 2.0.26 sous Windows. - **Jeter** supprime conversations parente et enfant, fichiers et dossier ; une conversation d’un autre dossier survit. - **Garder** conserve le dossier et sa conversation. - Le PID du daemon isolé reste inchangé. - Le typecheck serveur n’a que les erreurs préexistantes liées à `@codenomad/remote-tunnel`, non construit localement. ## Fichiers volumineux touchés `App.tsx` (~990 lignes), `stores/instances.ts` (~2 340), `workspaces/manager.ts` (~1 280), `folder-selection-view.tsx` (~1 070), `stores/preferences.tsx` (~1 480). |
||
|
Pascal André
|
9dd4b3f059
|
feat(remote-control): add Remote Control over OpenTunnel alongside direct access (#668)
Adds Remote Control alongside direct/LAN access. A phone or another computer pairs with CodeNomad and continues its sessions from anywhere, without an inbound port. The transport is OpenTunnel, the blind TLS relay used by OpenCode: TLS ends inside the CodeNomad backend, and nothing has to be deployed. - packages/remote-tunnel wraps @opentunnel/client. The server build bundles it with its own Effect 4.0.x, so the published server has no runtime dependency on a private workspace package. CodeNomad claims its own route on the device's shared identity and never deletes it. - A remote-only loopback ingress marks its sockets as remote, so local privileges come from isLocalRequest(), never the peer address. The gate runs before CORS, auth and routing: - exact tunnel Host, and the public Origin on mutations; - stripped forwarding headers; - origin-form targets only, judged as routed (decoded, cut at ';'); - host-only paths denied; - a paired device required, except for the public UI bundle. - Host-owned pairing: a single-use five-minute code, hashed device credentials with 30-day idle expiry, and a __Host- cookie. Revocation or eviction closes live streams. A revoked device is asked to pair again, keeping drafts. - The Cloudflare Worker/Durable Object relay, the custom E2EE protocol and the browser transport shims are removed. Electron and Tauri keep the backend alive after the last window only while Remote Control is enabled. Validation: - the real createHttpServer is exercised through the ingress, plus raw-socket canonicalization tests and device registry tests; - recovery unit and browser tests; - an opt-in end-to-end run through the hosted relay; - a packaged smoke import of the bundled runtime; - five gatekeeper rounds to zero findings, and green CI on all desktop targets. |
||
|
Pascal André
|
260249cfee
|
fix(tauri): prevent WebView2 F6 browser-process crash (#881)
Closes #875. ## Captured cause A trusted, foreground-checked F6 reproduced the black interface on installed Tauri 0.20.1-dev-20261007-c995044b / WebView2 154.0.4258.62. The native host remained responsive, but the WebView2 process tree exited. An offline Crashpad dump with matching Microsoft symbols identifies a browser-process null dereference in `MultiContentsView::GetActiveContentsContainerView`, reached through `chrome::FocusNextPane` and native pane-focus rotation. This is not a hard refresh or the earlier Tao input deadlock. The dump remains local because it can contain secrets. ## Mitigation - Disable F6 browser actions only, through `ICoreWebView2AcceleratorKeyPressedEventArgs2`, on each created local, preferences, remote and preview webview. - Preserve DOM delivery, including configured F6 shortcuts; retain all unrelated browser accelerators. Older runtimes without the per-key interface swallow only F6. No version gate or global accelerator disabling. - No callback locks, IPC, message pumping, app/controller capture or additional preview capabilities. Electron and other platforms remain unchanged. ## Validation - 196/196 Windows Rust host tests, serial mode. - Real isolated Tauri/WebView2 154.0.4258.62 tests in frameless and decorated windows: F6, Shift+F6 and Ctrl+F6 browser policy disabled while DOM delivery remains; F8 policy/delivery untouched; continuing JavaScript heartbeat; no ProcessFailed. - Positive native runs now verify the effective isolated profile and final post-input heartbeat advancement under deliberately conflicting inherited overrides; both framed/frameless runs pass. The negative stopped-heartbeat check correctly rejects otherwise successful keyboard checks. - Frameless post-input capture visually inspected. No installed application or shared OpenCode daemon replaced or restarted. - Windows release build passes (`cargo build --release --bin codenomad-tauri`); packaged-resource smoke checks pass. Existing dead-code warnings remain. The minimal baseline does not reproduce the captured installed-app crash. Native fixtures validate the prevention mechanism and keyboard preservation, not a full application A/B reproduction. No fixed installed-app, Electron, Linux or macOS runtime qualification is claimed. See `dev-docs/TAURI_WINDOWS_F6_CRASH.md`. |
||
|
Pascal André
|
dc7d3fae2c
|
test(tauri): fence F6 fixture profiles and post-input liveness
Address both gatekeeper findings: sanitize inherited WebView2 overrides before creating threads, force the fresh owned user-data folder and controlled browser arguments, and verify the environment's actual user-data directory. Every runner launch injects conflicting temporary overrides and checks that their folder stays unused. Require heartbeat advancement during the final two post-input intervals, after F8 confirms the last input arrived. Add a negative native check that deliberately stops only those heartbeats and verifies the fixture rejects it even though all key-policy/delivery checks pass and ProcessFailed is absent. Positive framed/frameless and negative checks pass on WebView2 154.0.4258.62. |
||
|
Pascal André
|
2da2dadb25
|
fix(tauri): block WebView2's crashing F6 browser focus action
An offline, symbolicated dump identifies the captured Windows F6 failure as a WebView2 browser-process null dereference in MultiContentsView reached through FocusNextPane. Prevent only that native browser action on every created local, preferences, remote and preview webview. Use the per-key WebView2 accelerator policy to preserve DOM delivery and configured UI shortcuts. Hosts without that interface swallow only F6 as a safe fallback; other accelerators, capabilities and platforms stay unchanged. Handlers capture no application/controller state and do no locking, IPC or message pumping. Add a fresh-profile, static-loopback native fixture and ownership-fenced PowerShell runner for F6, Shift+F6, Ctrl+F6 and an untouched F8 control. Native decorated/frameless checks and 196 serial Rust host tests pass. Document the captured stack and the limitation that the minimal baseline does not reproduce the full installed-app crash; no fixed installed-app retest is claimed. |
||
|
Pascal André
|
aa2776efa7
|
feat(extensions): add bounded current-session assets for API 2 panels (#874)
Add the shared, explicit API 2 session.assets.read capability required by the independently distributed MCP Assets addon. Keep API 1 context-only, preserve one general activation checkbox, and require consent tied to the exact installed package digest. Use the bundled native history integration for bounded metadata pages and exact embedded tool-result bytes, with session/Location ownership and final consent revalidation. Fence native/backend disconnects, generation changes and stale responses; refresh after failed tool results and direct pruning. Admit bounded source dimensions before host bitmap decoding and preserve thumbnail aspect ratio. Include the new native modules in the packed plugin as well as the shipped bundle. Two autonomous gatekeeper rounds ended with zero P0–P3 findings on 9da8513326583c7e2b56c5f86554817d478d0cbf; the initial three P2s have regression coverage. Local validation passed 16 browser, 14 server/image, seven package/presence and three bundled-installation checks, both shared typechecks, and the outside-checkout native fixture with official OpenCode 2.0.24. CI native plugin tests passed on Windows/Linux/macOS, as did runtime-contract and compatibility jobs. Admin merge is explicitly requested by the maintainer. Global CI is not green: its three permission-fallback-diff Copy patch timeouts also occurred in the parent PR #872 (run 37632060353), and Windows reported two unchanged cross-host election-test failures. Preserve these failures as follow-up diagnostics rather than claiming full CI success or modifying unrelated paths in this PR. No protection settings are changed. |
||
|
Pascal André
|
c995044b64
|
feat(extensions): install independently distributed right-panel addons (#862)
## What changes I add independently distributed right-panel UI extensions and an official online catalogue in Customize right panel. Users browse/search available addons, choose one and confirm installation directly from its exact GitHub Release, without a manual ZIP download, rebuilding CodeNomad or restarting OpenCode. Manual ZIP installation remains available. I publish the curated index, contribution rules and Session info demo at https://github.com/NeuralNomadsAI/CodeNomad-Extensions. That repository can host several official addons; the index can also reference author-owned repositories. Separate means independent of the main application repository, not a mandatory repository per addon. I show the manifest and exact archive SHA-256 before trust confirmation. Installation starts disabled; users enable it for all projects in the server profile or for the exact opened folder. Replacement requires the previous digest and revokes every activation grant. Removal is explicit. Packages and grants stay outside project/OpenCode storage. I keep author code out of the main renderer. API 1 exposes only session ID, locale and appearance through a per-mount MessageChannel. It does not expose filesystem, transcript, images, credentials, native commands or the OpenCode proxy. Frames are sandboxed without same-origin access and receive a restrictive CSP; obsolete responses and ports are fenced on project/session changes, disconnects, revocation and replacement. I document the package, permissions, API compatibility, scope, release/checksum and maintainer rules in `dev-docs/PANEL_EXTENSIONS.md`, with a standalone starter in `examples/panel-extension/`. GitHub's source ZIP is not an installable package. There is no arbitrary URL installer or automatic update. I load catalogue metadata only during discovery. Inspection and installation each revalidate a fresh index, exact ZIP digest and full manifest; unsupported APIs/permissions cannot install. Downloads are bounded, deadline-limited, credential-free HTTPS requests to GitHub's exact release hosts, with constrained redirects. A withdrawn or changed selection cannot become a different trusted package. Offline catalogue failures leave installed addons and ZIP installation available. ## Scope and limits I keep #801's assets gallery for a separate follow-up. It needs a bounded, authorized image/history capability rather than access to internal stores. This PR only establishes external distribution and a minimal context API. Windows Tauri may inject native bridge objects into subframes: object presence is not a grant. My isolated WebView2 fixture proves parent command execution while direct/raw child calls do not reach it, and verifies context delivery plus DOM/network restrictions. A trusted hostile extension can still stall its renderer or attempt self-navigation; this is not process isolation or a universal offline guarantee. The installer warns users to trust the author. I have not run a native Electron/macOS/Linux qualification or changed the shared daemon. The runtime implementation is shared between desktop hosts; native GUI validation here is Tauri only. ## Validation - UI and server typechecks. - 14 focused server/registry/manifest tests. - Real right-panel browser tests for ZIP consent, activation scopes, replacement, revocation, context changes, stale reads and frame isolation. - Five catalogue/server checks and seven right-panel browser scenarios cover metadata-only browse/search, online consent, withdrawal, incompatibility, offline ZIP fallback, hashes/manifests, redirect restrictions and size budgets. - Live public GitHub index and Release download matched SHA-256 `cf80226a40dd077a6a8cc2a4b65bbb46bf33619d62007982bd7dcea34ae4545f`; installation and activation used a disposable isolated store. - `node scripts/test-panel-extension-native.mjs` on Windows, using the application's locked Tauri dependencies and an isolated browser profile: parent native call allowed; child native calls, parent DOM and network APIs blocked; session context delivered. - UI build, Windows Tauri release build (`--no-bundle`) and packaged-resource smoke passed. Full browser suite results are recorded in the follow-up validation comment. Existing oversized files touched only for integration: `packages/server/src/api-types.ts` (~735 lines), `packages/server/src/index.ts` (~713), `packages/server/src/server/http-server.ts` (~2,438). |
||
|
Pascal André
|
00029c8b04
|
fix(pending): stop cold-worktree recovery fallback; qualify OpenCode 2.0.24 (#865)
## Summary
- Qualify and pin the generated client/plugin at OpenCode **2.0.24**,
recommended independently of the unchanged **2.0.7** technical minimum.
- **On every runtime version**, automatic Form/permission recovery uses
only the authenticated loaded-only broker. Missing capacity stops
recovery non-authoritatively; it never falls back to ordinary lists
across historical/inactive worktrees.
- Retain known requests and editor drafts through unavailable/partial
recovery and rehydration, and show a localized recovery-incomplete
status even when no request is known. Only explicit settlement
reconciliation may use ordinary lists at the attempted request's
authorized location. Keep mutation fences and settlement tombstones.
- **Remove the private reader's runtime and Effect version allowlist.**
An untested/custom/prerelease/missing version label no longer disables
recovery. Registration checks the real native RPC capability; each read
validates graph, existing-only lease, queue, codec and identity
contracts. These checks fail safely without mass-loading fallback.
Tested versions remain evidence, not grounds for blocking other
versions.
## Contract audit
The authenticated isolated 2.0.24 daemon exposes 117 native OpenAPI
paths vs 116 on 2.0.22. The new `/api/vcs/init` is not exposed by
CodeNomad. Of 167 structural schema changes, most add declared
`LocationNotFoundError` failures to location-sensitive routes; other
changes add optional `ServerInfo.capabilities.persistentPty`,
WorktreeError's literal `_tag` and the VCS-init error. Published
declaration changes: 11/30 client files (+service-probe), 3/60 plugin,
8/36 protocol and 3/102 schema files (three retired IDE/question
declarations removed). No removed declaration is imported by CodeNomad;
no consumed dependency establishes a higher minimum.
The upstream source audit leaves LocationServiceMap, Form, Permission
and RPC contracts unchanged; the Location-services wrapper changes only
its TypeScript error parameter. Effect remains rc.112. The published
native implementation chunks are hash-checked against separate receipts
before each isolated fixture run.
Native SDK service contender/probe/PTY handoff internals change, but
CodeNomad retains its selected-CLI lifecycle adapter and bounded
authenticated registration fallback rather than using
`Service.ensure/stop`. **No shared daemon restart, storage mutation or
OpenCode PR is part of this change.**
The source audit also covers compaction-agent model/budget selection,
ChatGPT's temporary remote-model synchronization removal, local-provider
discovery/cache sharing, text-capable default selection, bounded MCP
connection/catalog retries and OAuth callback timing, Windows
instruction ancestry, skill frontmatter, subagent text boundaries and
PTY runtime storage/availability. These remain native-owned; no
CodeNomad adapter change is justified by the consumed contracts.
`dev-docs/OPENCODE_V2_COMPATIBILITY.md` records the consequences and
limits: synthetic account tests are not real OAuth/provider
certification, compaction isolation does not exhaust alternate
summarizer configurations, and no desktop terminal-survival test across
service restart is claimed.
## Native loaded-only evidence
### Follow-up: unjustified version lock removed
At the user's explicit direction, remove both
`PENDING_SNAPSHOT_NATIVE_VERSIONS` and the Effect-version equality
check, as well as all version checks in registration and reader
execution. The reader no longer accepts or consults an executing-version
argument. Regression coverage registers across 2.0.7–2.0.24,
newer/custom/prerelease/missing labels and a context whose `app` getter
throws if accessed. Actual malformed/missing contracts, unsafe data,
eviction/disposal races and timeouts remain non-authoritative. The rule
against blocking untested versions is recorded in `AGENTS.md`.
The source comparison across published tags 2.0.7–2.0.24 finds an
unchanged LocationServiceMap and existing-only lookup, RPC contracts and
queue-list interfaces. Changes in older releases affect Form
cancellation feedback/state and permission rejection feedback, not queue
listing. All these tags use Effect rc.112. This is source evidence, not
a claim that all eighteen releases have passed native fixtures.
After gate removal, **29/29 reader/broker/admission tests pass**, as do
server typecheck and pruning build. Fresh published native fixtures on
**2.0.23 and 2.0.24 pass**, recovering permissions/global Forms with 100
cold candidates (three actual Git worktrees), four native boots
before/after and zero cold constructions. The fresh bounded
**full-server run on the follow-up passes: 888 passed, 0 failed, 6
skipped (894 tests, 76 suites)**. Receipts: `no-gate-server.log`,
`no-gate-native-23/receipt.json`, `no-gate-native-24/receipt.json`,
`matrix-source-inventory.json`, `server-all-no-gate-final.log`.
The follow-up also records the distinction between pinned build
dependencies and an independently updated external service in
`AGENTS.md`; no README changes. Independent read-only gatekeeper review
of the **full diff**
`1abeba78043fc6ec1fac4eb57eb6c82a541cf66e..e159068bc0a37a668814c1c5a031115dea38ed28`:
**APPROVE, 0 findings**, 59 independent targeted tests passed plus an
isolated reactive check. The review is published separately on this PR;
it is an agent review, not human approval or deployment acceptance. At
the pre-merge CI inspection, runtime contracts (minimum/latest),
OpenCode compatibility (Linux/Windows/macOS) and native pruning
(Linux/macOS) passed; general tests, native pruning on Windows and Tauri
tests were still in progress. Earlier cancelled/skipped runs are not
passes. The user explicitly requested an admin merge after zero
gatekeeper findings; no all-green CI claim is made.
The committed Bun fixture now uses the same managed `.ts` plugin
discovery shape as production, not configured-package directory
resolution. It uses an authenticated unmodified published HTTP router
in-process, with an in-memory database, private discovery paths, no
listener/service discovery and no external provider.
| Published runtime | Preloaded Locations | Locations after recovery |
Native boot logs before/after | Cold candidates | Cold constructed |
|---|---:|---:|---:|---:|---:|
| 2.0.22 | 4 | 4 | 4 / 4 | 100 (three actual Git worktrees) | 0 |
| 2.0.24 | 4 | 4 | 4 / 4 | 100 (three actual Git worktrees) | 0 |
Both runs recover three permissions, six Forms including three global
Forms. They exercise absent/present backend presence, two backends
retaining registration, expiry, return and final disposal, coexistence
with the existing Promise pruning RPC, authenticated 401 rejection,
schema limits and non-authoritative failures. The boot-log assertion
also detects briefly constructed Locations even if they later disappear
from the map.
Short-fixture RSS: 2.0.24 460,599,296 → 461,824,000 bytes; 2.0.22
463,929,344 → 461,701,120 bytes. These are receipts, **not a memory
profile or comparable deployment soak**, and do not attribute the
reported 10 GiB to this fallback.
## Validation
Environment: Windows, Node **25.2.1**, Bun **1.3.14**. All native checks
use owned processes, synthetic providers/configuration/data and explicit
isolated CLI paths; never the shared daemon or user database.
- `bun scripts/test-pending-snapshot-native.mjs <qualified-packages>
<fresh-output>`: passes separately on published 2.0.22 and 2.0.24.
- 2.0.24 native automation, pruning parent runner,
Location/worktree/proxy/event relay, environment, fork, aside, degraded
Git, prompt skills, provider usage/accounts, permission receipts and
blank-session cleanup: **12 suites pass**.
- Minimum 2.0.7 with the same 2.0.24 client/plugin dependencies: **nine
isolated suites pass** (automation, pruning,
Location/worktree/proxy/relay, environment, fork, aside, degraded Git,
prompt skills and blank-session cleanup). Operation-specific
usage/account/receipt checks do not establish a new global minimum.
- `test-compaction-isolation-native.mjs <2.0.24-cli> --context-mib 2`:
passes with native compaction and outline enabled; the second session
completes before releasing the first session's provider gate.
- Focused UI pending recovery, compaction, Forms and permission
lifecycle: **37/37 pass**. Coverage includes 100 cold worktrees on
unsupported capability, reconnection, request retention, per-kind
mutation fences, settlement reconciliation, late supported/unsupported
responses and compaction admission.
- Final browser dock/selection/mobile regressions: **44/44 pass**. The
incomplete status appears with no known request at 393 px, has no
horizontal overflow, preserves a typed answer on repeated unavailable
recovery and disappears only after full recovery. Real-shell provenance,
recursive interruptions, Android keyboards and per-conversation drafts
remain covered.
- Server/UI typechecks and shared server/UI/plugin builds: pass.
- Final full server unit run after dependency reinstall, `node --import
tsx --test --test-concurrency=2 'packages/server/src/**/*.test.ts'`:
**888 pass, 0 fail, 6 skipped** (894 tests, 76 suites). An earlier
unbounded parallel run exceeded the existing 30-second pending-broker
deadline; the bounded rerun passes without changing that deadline.
- Broad UI unit tests: **1189 pass, 2 fail**. Both failures are
reproduced from unmodified base `
|
||
|
Pascal André
|
6f6edbbcb9
|
perf(ui): skip redundant outline and superseded Markdown work (#852)
## Summary I reduced two independently demonstrated sources of redundant work in the UI shared by Electron and Tauri: - I reuse the timeline projection when the outline snapshot, resident marker identities and translated labels have not changed, preserving reactive locale updates and structural marker changes. - I discard superseded or disposed Markdown invocations before parsing and before publishing results, including same-key language retries and cache hits. Related to #851, **not a confirmed fix for its Linux Electron freeze**. I have not reproduced the reporter's environment, and this PR intentionally does not close the issue. Native events, transcript authority and OpenCode service lifecycle are unchanged. ## Evidence and validation - Real native-dispatcher/SessionView fixture with 10k outline entries: 64 sub-bucket deltas trigger **64 full-history projections before / zero after**; changed text buckets, locale and final text still update. - Real Markdown/parser instrumentation: cold burst **33 parses before / one after**, warm burst **32 before / one after**. Disposal, same-key retries, cached results, theme/highlight, wrap and full-source copy are covered. - 100 browser regressions passed (70 renderer/parser/outline + 6 full-source-copy + 24 history-navigation/reasoning), plus 3 outline unit tests; UI typecheck passed. - Independent gatekeeper: **zero actionable findings**, with 60 browser and 6 unit tests passed independently. - Windows Tauri `build --no-bundle`, packaged-resource smoke and isolated launch/capture/close passed. I did not replace the installed app or restart OpenCode. No Electron desktop build/test was run; Chromium fixture tests do not establish Linux Electron host behavior. - The initial concurrent history/reasoning regression run hit a shared Vite cache `EPERM` on Windows and timed out; all 24 affected checks passed when rerun sequentially. The broad synthetic stream profile still shows pauses and does **not** demonstrate an overall responsiveness win. I recorded the measured work reductions and remaining limits in `dev-docs/STREAMING_RESPONSIVENESS.md`, with reproducible profiling scripts. |
||
|
Pascal André
|
8ce70ec414
|
fix(performance): recover pending requests without warming historical Locations (#840)
Recover pending Forms and Permissions through a fixed presence-owned RPC in the existing bundled plugin, without warming historical native Locations. Validate established execution-host origin, complete coverage, directory/Git ownership, WSL aliases and every placement before admitting capability. Keep generic RPC forwarding closed and preserve non-authoritative failures. Observe native compaction before event ownership routing and defer expensive legacy discovery before inventory reads and at forwarding. Preserve concurrent holds, bounded missed-end probes, exact settlement reconciliation grants, per-kind mutation fences, global/idle Forms and settled-request tombstones. Never replay ambiguous mutations. Share presence observations, not registrations or execution authority. Integrate current dev receipt and event-ownership changes. Reassert the native connection after permission receipt preparation and before granting settlement reconciliation or dispatching mutations. Reject overflowing raw JSON numbers, including unknown metadata, without altering native numeric codec strings. Use eight-directory UI batches with the unchanged request deadline and URL budget rather than weakening ownership checks or extending timeouts. Add scoped broker, reader, presence, proxy, compaction and UI lifecycle regressions plus an opt-in isolated native reader fixture. Independent Gatekeeper reviews are published on the PR; R1's numeric overflow finding is fixed and rechecked on the final head before merge. The private reader is qualified for native 2.0.22 / Effect rc.112 only. The global minimum and already-recommended 2.0.22 remain unchanged. Unsupported runtimes retain guarded legacy recovery. This mitigates CodeNomad's load amplification, not the upstream Bus issue or previously retained Locations; installed-application freeze resolution, deployment and daemon restart are not claimed. Preserve bootstrap-warming and bounded-scan limitations. |
||
|
Pascal André
|
a076d01e79
|
fix(history): fill search pages and remove redundant counting (#839)
## Summary - Continue sparse history scans until a bounded result page is filled, publishing matches progressively across sessions. - Remove the automatic count traversal. Show page-local results and messages scanned directly from search responses, with no scan when opening an empty search. - Project text-only content in SQLite, reduce bounded RPC round trips, and share identical location checks only inside a request. ## Validation - UI/server typechecks and targeted server/store tests passed. - Chromium regression covers progressive results, pagination, workspace scope, technical toggle, empty results and absence of statistics requests. - Isolated native OpenCode 2.0.22 fixture passed, including all 242 workspace matches across two sessions and pruning/ownership regressions. - Synthetic benchmark: text search materializes 9.6 KB instead of 145 MB; CPU gain is modest because SQLite still parses stored JSON. See dev-docs/SESSION_HISTORY_QUERIES.md. ## Review Independent gatekeeper review and post-rebase validation in progress; findings will be addressed before administrator merge. |
||
|
Pascal André
|
961f2792b6
|
feat(chat): preserve permission decisions and richer question receipts (#838)
## Summary - Persist all permission decisions: allowed once, always allowed and rejected, with request context and known reasons. Distinguish CodeNomad, automatic Yolo and native settlements. - Keep receipts visible alongside transcript messages even with hidden tools; provide paginated source-less session receipts. Ownership-checked bounded reads, atomic profile storage, deletion cleanup and stale-read fencing. - Enrich completed native question receipts with selected-option descriptions, verbatim custom answers and a disclosure for other choices. Translate labels in all ten locales. ## Validation - Locked dependencies installed; server and UI TypeScript checks pass; production UI build passes. - 126 targeted server regressions during implementation, then 26 receipt/replier/service checks against the pinned client passed. - 20 receipt/dock browser tests and 21 history navigation tests pass; 5 question decoding/copy tests pass. - Rendered captures inspected at 393/1100px in light/dark, including long text and pagination. ## Persistence boundaries Native permission events are ephemeral: past lost decisions cannot be reconstructed. Receipts are CodeNomad annotations outside native search/copy/export. Storage namespaces follow execution host, native root and authenticated channel; credential rotation starts a new namespace. Bounded text excludes metadata/diffs. ## Review Autonomous independent gatekeeper review will be published and repeated until zero findings before the user-requested admin merge. ## Maintenance Existing oversized files touched: server/http-server.ts (~2415), server/api-types.ts (~717), server/index.ts (~707), ui/message-section.tsx (~1566), ui/lib/api-client.ts (~650). |
||
|
Pascal André
|
c05f7956d6
|
fix(events): prevent relay timeout on worktree discovery waits (#837)
## Summary Follow-up to merged #835: fix the demonstrated dependency behind real `Instance event relay routing timed out` disconnects, not duplicate connection notifications. Existing diagnostics captured relay ownership blocked in `getWorktrees -> WorktreeInventory -> POST /api/worktree/refresh`, including a refresh pending beyond 150 seconds and a separate ~220-second completed call. That exceeds the unchanged 60-second relay job deadline, so the shared relay reconnects and Usage correctly clears for all projects. Event authorization now uses a separate **registered-only** native worktree inventory and never starts or joins native strategy discovery. Native project/checkout checks, physical Git membership, clone exclusion, configured roots, nested-folder and WSL projection remain in the shared catalogue implementation. Native/local invalidation and workspace disposal fence both inventories and their distinct directory-cache namespaces. Ordinary request authorization and explicit worktree discovery retain refresh and read-your-writes behavior. Full-location checks receive the connection attempt's abort signal. No timeout increase, swallowed reconnect, stale authorization fallback or quota-specific workaround. FIFO lanes, ownership retries, generation/workspace fences and retained-work budgets are unchanged. ## Validation - Baseline-red production-manager + relay reproduction: hold discovery unresolved and require the linked-worktree event to route before releasing it. - All **248 workspace tests pass**, including event order/reconnect, ownership, no-Git, WSL, configured Git roots and inventory invalidation. - Server TypeScript check passes. - Isolated OpenCode **2.0.22** location/worktree/event fixture passes, including real pre-refresh native registration and ordered real session events during a held fixture-manager discovery request. - Isolated no-Git native prompt/recovery fixture passes. - `git diff --check` passes. ## Scope / limitations The native refresh's internal delay is not claimed fixed; the relay no longer depends on that unnecessary discovery operation. Actual transport failures and other stuck native reads still trigger bounded reconnect/reconciliation. Compaction and window-resize jank are not established causes or fixed by this PR. The installed application, shared daemon, user settings and independent #824 worktree are untouched. This conversation remains attached to `D:\CodeNomad`. Existing oversized source touched: `packages/server/src/workspaces/manager.ts`, approximately 1,260 lines. No unrelated size-only refactor. Independent Gatekeeper review will be published against the exact PR head, with findings resolved and fresh passes until zero findings before the requested administrator merge. |
||
|
Pascal André
|
394482f97f
|
feat(accounts): native account controls and opt-in Codex quota selection (#793)
Expose the approved active-account dropdown with persistent credential-keyed drafts and always-visible add/rename/remove actions. Enrich only native fallback labels with a sanitized Codex login while keeping all credential values server-side. Persist opt-in automatic selection for supported OpenAI OAuth accounts and admit one fresh-quota-verified native activation before the next prompt/custom command, with local manual/policy fences, ownership and deletion admission, no model changes, and no prompt or mutation replay. Preserve dev's Missions revert and document service-wide selection and external-client compare-and-set limitations. Validated both package typechecks, the UI build, 812 server tests, 865 CI-selected UI unit tests, isolated native 2.0.22 synthetic-account/YAML fixtures, and focused Chromium/native bridge regressions. Final admin merge explicitly requested by the user; platform/runtime/native checks are green while the general tests job is still in progress. |
||
|
Pascal André
|
c954841f09
|
revert(missions): undo PR #673 without dropping later dev changes
Revert merge
|