Make Mission Control actionable with create/edit/delete, persistent disclosures and selection, task dependencies, native attention requests, execution comparisons and a long-content reader above the mounted transcript. Preserve drafts and native per-window layout, and arbitrate browser/reader gestures without losing the preview target.
Add coordinator-only mission.revise with revision CAS, idempotent replay, linked replacements and explicit dependency changes. Retain withdrawn task contracts and late reports, require terminal settlement for outstanding native admissions, and attribute human metadata edits in the bounded history. Mission deletion tombstones the map without deleting conversations.
Cover lifecycle and revision semantics with backend regressions and the isolated OpenCode 2.0.18 fixture, including the repaired authenticated late-report notification. Validate real Solid UI restoration, editor retry identity, native background Forms, transcript/draft preservation, layout cleanup and ten-locale parity. Record Kandev research, scope decisions and separate follow-up opportunities.
Provision codenomad.missions through connected-daemon discovery and independent backend presence instead of requiring a source plugin in every project. Bundle the integration for Electron and Tauri, retain project-scoped mission journals across shutdown, and use the same secondary surface as Status.
Complete the existing native actor execution work: persist explicit agent/model/variant choices, validate catalog selections and avoid switching busy actors. Admit assignment and report writes through the authenticated desktop bridge with durable-contract verification, session ownership, connection and worktree fences, and per-send profile environment synchronization.
Advance the older source branch client/plugin pin to 2.0.11 and retain its bounded runtime metadata adaptation. The isolated 2.0.16 mission fixture passes native catalog, selection, busy queues, conflict, environment, reports, reconnect and idempotence checks. Server, UI and plugin typechecks, 31 mission tests, 10 lifecycle/transport tests and six resource-layout tests pass.
Align server/UI client and bundled plugin pins with the latest stable runtime while preserving the demonstrated 2.0.7 timestamp minimum. Review the published declarations and authenticated native schema: pairing and Shell signal additions require no CodeNomad API adaptation.
Make the isolated native upgrade fixture follow the recommendation while retaining its 2.0.15 source boundary and live-daemon PID assertion. Extend setup version coverage and update the current compatibility and architecture references.
Validate both minimum/current native runtimes, historical migrations, server/UI tests, setup and tool-image browser scenarios, typechecks and production bundles. Record the intermittent Windows Node pruning/UI heap exit and successful diagnostic rerun without claiming its cause is fixed.
Display HTML and JSX tags literally in user messages, pasted-text disclosures and user timeline previews while keeping existing assistant HTML rendering. Preserve stored prompt text, Markdown formatting and code entity spellings, and isolate literal render requests and caches from older sanitized HTML entries.
Escape both HTML tokens and Marked raw-region text tokens so malformed source remains visible text. The first independent gatekeeper pass identified the raw-region bypass; it was corrected and covered by unit/browser regressions. The second independent pass found zero findings after additional raw-region variant checks.
Fifteen Markdown tests, two focused browser scenarios, the existing held-tool-scroller regression, UI typecheck/build and an isolated historical-source renderer comparison passed. The tested assistant HTML DOM matches v0.19.0; user rendering intentionally differs because v0.19.0 also interpreted user tags. Remote CI was still in progress at the explicitly requested admin merge.
Use one Attach file action for native device selection and retain project-scoped @ references in the active session worktree. Remove the duplicate upload entry and composer server browser, document the outside-project scope change, and translate attachment origins and feedback across all locales.
Share serialized, bounded byte ingestion across picker, drop and clipboard. Fence open pickers and late reads across session/worktree/lifecycle changes, preserve edits and newer selections without stealing focus, release rejected-read budgets, and restore failed custom-command drafts by attachment identity. Validate project directories through existing workspace ownership before filesystem listing/search.
Cover the behavior with 20 attachment and 11 session-aside browser scenarios, attachment/submission/persistence units, server budget/proxy/ownership regressions, and isolated native Windows picker fixtures. Three independent review passes corrected five P2 findings and ended at zero; the final merged-head review confirmed that result. UI checks/build, Tauri release build and native picker smoke passed. Remote CI was still in progress at the explicitly requested admin merge.
Match OpenCode's TUI by interrupting only the selected session with resume:true. The previous Stop/double-Escape action interrupted active descendants in parallel; a background child's completion notification could wake the parent after its interruption had already settled, producing new model activity after Stop.
Keep background children independently owned and directly interruptible when selected. Native control/steering input retains TUI resume semantics rather than introducing a separate CodeNomad cancellation policy.
Cover selected parent/child scope in store tests and both gestures through real Chromium composer and keyboard handlers using the generated native client. Include an isolated native fixture with a temporary HOME/database, private server and loopback provider that reproduces the cascade restart and verifies selected-session interruption. UI typecheck, production build and both browser regressions passed on the reviewed branch; full-CI failure triage is documented in the PR.
Backport upstream tao#1215 unchanged onto Tao 0.34.6 to correct the same-thread native input mutex deadlock identified in a symbolized Windows hang dump. Preserve the existing Tauri dependency/API line, all non-Windows sources, licensing and exact published-crate/patch provenance through a workspace Cargo override.
Add real isolated Win32 reentry regressions for keydown, keyup, character, system-character and IME input. Original-crate controls reproduce bounded deadlocks; the backport passes all five cases. Independently cover the IME lock boundary with temporary-source instrumentation and require an IME-only lock-order mutation to fail, preventing keyboard pre-peeking from masking an IME regression.
Independent gatekeeper pass 1 identified the IME coverage gap; pass 2 on 462f9eac reports zero actionable findings and independently reran all controls. Full local Tauri tests passed 181/181. Administrator squash merge requested by the user; remaining CI jobs were still running at merge.
Delegate verified shared npm updates from OpenCode 2.0.15 onward to the native CLI with bundled Node/npm, a scoped prefix and registry, and Windows running-image retention. Preserve first-install and older-migration preflight, version/launcher verification and explicit daemon activation.
Retain installation ownership and the temporary adapter if an outer timeout, signal or output limit leaves descendant exit uncertain. Allow native timeout cleanup to finish and preserve original failures.
Validated with 37 targeted updater/route regressions, server typecheck, isolated live Windows 2.0.15-to-2.0.16 qualification, and a successful NSIS build/install of the initial implementation. Independent gatekeeper review found one timeout issue; the second pass after correction reported zero findings. Administrator merge explicitly requested by the user; final-head remote CI is still running.
## Summary
Retire the prerelease private OpenCode installation completely as an
executable source. Automatic selection now uses PATH and the
conventional shared user npm installation. Existing private files are
neither migrated nor deleted.
- Remove the private installer, receipt reader and fallback
introduced/retained by #756.
- Ignore saved private selections and reject validation/launch from
`~/.local/share/codenomad/opencode`, including private PATH entries.
Prevent installation into that retired prefix.
- Remove private-copy descriptions from all ten locales and update the
runtime policy documentation.
- Keep supported custom installations, native shared-service
ownership/authentication and explicit restart behavior.
## Reproduction and scope
The initial genuinely empty-profile test passed, but it did not match
the affected machine: that machine had no Git and retained a private
prerelease OpenCode copy.
On the exact installed `v0.20.0-dev-20260923-baf674fc` Tauri artifact,
seeding a valid private copy plus its `selected` receipt and `current`
marker makes setup report `state: ready`, `installationSource: legacy`,
and suppresses the missing-installation screen. The new desktop
regression fails against that release with `ready !== missing`.
With rebuilt server/UI resources in an isolated copy of the same Tauri
host, the identical private-copy scenario reports missing, offers
installation, installs the shared npm package, authenticates OpenCode
2.0.15 and resumes the requested folder without Git. This demonstrates
the missing-setup cause; it does not claim to explain every initially
reported startup slowdown.
## Validation
- 59 targeted server tests passed: discovery/install/update, retired
paths, binary selection, Windows/WSL spawn and binary validation routes.
- 13 real-component setup browser tests passed.
- 23 focused retirement/launch tests passed after the final network-path
preflight adjustment.
- UI TypeScript check passed; production server/UI/automation/pruning
build passed.
- Installed-release private-copy reproduction failed as expected;
corrected isolated Tauri acceptance passed.
- `git diff --check` passed.
Desktop qualification uses isolated profiles, services and databases.
The sole simulated installation side effect is HKCU PATH registration,
captured by a fixture preload; bundled npm installation, package
verification, native-parent service start and authenticated API checks
are real. The shared user daemon and installed application were not
replaced by the fix. Remote CI is pending.
## Maintenance notes
Existing oversized files touched: `packages/server/src/api-types.ts`
(~583 lines) and `packages/ui/src/lib/i18n/messages/*/settings.ts`
(~625–639 lines). No size-only refactor is included.
Prefer terminal PATH and a common user npm installation, migrate historical private and official npm copies, and retain explicit authority for custom and WSL executables. Preserve running daemon ownership and defer locked Windows updates. Align recovery and settings presentation across locales.\n\nReviewed through an independent gatekeeper loop (final zero-finding review on e33a6a16). Validated 34 targeted server tests, 13 browser scenarios, typechecks, isolated Windows npm installation and real historical migrations. Full CI browser job has unrelated existing system-message search failures reproduced locally; merge requested with administrator authority without waiting for CI.
## Summary
Follow-up to #750: Git is a prerequisite for full CodeNomad
functionality, but its absence must not prevent users from consulting
their agent and asking it to help with installation.
- Keep workspace startup and ordinary conversations available without
host Git. Only the explicitly opened physical directory authorizes
sessions in this mode; do not infer sibling worktrees from native
project IDs.
- Preserve Git/worktree operation requirements and return an actionable
`git_required` failure for those operations.
- Inform the agent via the owned native `codenomad.git-availability`
instruction before prompts/custom commands. Include the backend platform
and distinguish the backend account from WSL/remote agent execution.
Remove the entry once Git is available, while preserving other
instruction keys. There is no Git setup UI or installation gate.
- Keep deletion admission safe across Git availability transitions by
draining/blocking overlapping ancestor and descendant directory
identities.
- Narrow initial project-wide session lists to the opened directory in
degraded mode; reject existing project-scoped cursors rather than
reinterpreting their native pagination scope.
- Teach the UI session inventory to request exact-directory pagination
for degraded roots while retaining unknown repository membership. Owned
children with inaccessible parents remain local display roots,
preserving their native parent metadata; worktree selection is
unavailable until Git recovers.
- Bound advisory context synchronization independently from fail-closed
profile-environment synchronization. An advisory timeout does not replay
or prevent the original send; disconnect and runtime-generation fencing
still apply.
## Validation
- Targeted server regressions cover real workspace-manager/proxy
admission without Git, foreign/child/alias directories, initial lists
and native cursor scope, worktree operations, deletion fencing,
environment admission and advisory timeout.
- Existing workspace lifecycle, inventory, native Git-worktree identity,
directory-authorization and worktree-deletion route suites pass.
- Real isolated OpenCode **2.0.7 and 2.0.15** fixtures: Git absent from
both backend and daemon PATH; project open, session creation,
instruction synchronization, prompt admission, model request containing
degraded context, assistant reply, and removal of stale instruction
after backend PATH recovery. Private databases and a local synthetic
provider only.
- Server/UI TypeScript checks and production server/UI/plugin builds
pass. Generated-client prefix regression also passes (bounded Node test
runner for its retained UI handles).
- Added no-Git unit/native qualification to the existing
Linux/Windows/macOS compatibility workflow. Local native runs were on
Windows; cross-platform CI outcomes are reported separately.
- Final UI coverage: 88 store/tree/startup/authority tests, 13
worktree-browser tests, and 43 transcript/session-rendering browser
tests pass.
The earlier #751 instruction-proxy correction remains necessary and is
covered by its existing regression tests. This change addresses the
separate missing-Git admission failure.
Validation includes isolated minimum/current native suites, historical migrations on Linux/Windows/macOS, targeted unit and browser tests, production builds and two independent gatekeeper reviews with zero actionable findings. Retain startup diagnostics for an unexplained intermittent Windows pruning/UI process exit; the complete instrumented Node 24.20.0 rerun passes locally. Known system-message search fixture timeouts remain documented. Admin merge explicitly requested; runtime activation and desktop installation remain separate actions.
Replace timestamp-based automatic deletion with fresh native content checks and local activity, draft, attachment and connection fences. Preserve sessions with queued input or children, fail closed on uncertain reads, and refresh the message proof before deletion. Keep explicit deep-clean semantics separate and count only successful deletions.
Run automatic cleanup in a coalesced background sweep so historical reads never block new-session activation or the first prompt. Add 40 cleanup regressions and an isolated native fixture wired into minimum/latest runtime CI.
The baseline fixture reproduces native conversation loss; fixed behavior passes on OpenCode 2.0.7 and 2.0.14. All 157 targeted tests and UI/Electron typechecks pass locally. Two independent gatekeeper rounds concluded with zero findings after correcting creation-path latency. Full GitHub Actions CI was still pending at the authorized administrator merge.
Follow up #737 with a shared focused-or-MRU menu snapshot, UI-thread refresh serialization, lock-free native calls, popup-tracking deferral and atomic admission before native getters. Preserve remote/Preferences isolation and trailing state publication after native tracking. Iterative independent gatekeeper review reached ZERO FINDINGS after fixes; isolated real Windows popup/focus/concurrent-request and mouse-selection acceptance passes, alongside Rust and Electron/UI regressions. Administrator merge requested by the user. CI is not fully green: final checks pending, baseline migration/system-search failures and an unexplained initial Windows pruning UI exit are documented in the PR gatekeeper report.
Reserve /btw in the composer and autocomplete, using session.generate to answer from the current native context in a non-modal Markdown window. Bare /btw opens the question form; answers can be copied or retried without adding transcript, inbox or child-session records.
Keep side-request cancellation independent of the main execution, fence late results on cancellation, replacement, session changes and disposal, and preserve unsent file/image attachments. Authorize only the reviewed session-scoped generation route through existing ownership and worktree-deletion checks. Add all ten locales and shared square window styling.
Cover routing, Markdown, attachments, concurrent main prompts, cancellation races and narrow layouts with ten browser scenarios, plus proxy regressions. Verify native idle and busy behavior with isolated local-provider fixtures on OpenCode 2.0.7, 2.0.11 and 2.0.12; include the fixture in minimum/latest CI. UI/server typechecks, twelve adjacent unit tests and diff checks pass.
Integrate dev at 306c2ba4, including full-history search, cached global timeline navigation and README updates. Preserve the new RPC/client methods alongside managed setup, explicit restart/reload and the technically justified OpenCode 2.0.7 minimum.
Correct the incoming standalone plugin manifest to include navigation-scope, outline-index and outline-preview. Both the existing packed-entrypoint regression and independent gatekeeper review identified the omitted dependencies; the corrected package resolves outside the source checkout.
Validate 643 server tests (2 skipped), 154 UI store/reducer tests, 29 browser scenarios and both typechecks. The rebuilt bundled plugin passes the complete isolated native 2.0.7 suite with rendered UI, including 241-message history cleanup and 1501-message global navigation/restore parity. Record pre-merge evidence in the compatibility register.
Integrate the current dev baseline while retaining PR 723's server-backed full-history search and direct navigation. Resolve the sole message-section conflict by keeping the bounded history query flow instead of reinstating the superseded resident-page traversal and resident-result reconciliation.
Preserve dev's system-message visibility and untracked search locator changes. Validate UI and server typechecks against the updated locked dependencies, plus browser regressions for restored checkpoint reconciliation and current-session search navigation.
Replace the arbitrary 2.0.11 floor with the 2.0.7 native step-timestamp boundary, keeping 2.0.11 as the separately recommended qualification target. Unlisted, prerelease and custom runtimes negotiate authenticated API requirements; preserve complete CLI labels so unknown builds neither fail solely by name nor enable unintended automatic upgrades.
Finish retiring pre-2.0.4 location/worktree/credential/Form serialization and obsolete catalog events while preserving internal identity, import/cursor authorization, pruning claims and connection fences. Remove the unused global package-manager installer and clean generated server output before packaging so deleted modules cannot survive incremental builds.
Distinguish missing setup, technical incompatibility and optional updates in the shared UI, including minimum rationale and optional restart wording. Retain a usable daemon through older discovery CLIs, check reload capability independently, and suppress installation when bundled npm is unavailable.
Validated 622 server tests, 7 browser scenarios, real reducers and fixture guards, production native suites on 2.0.7 and 2.0.10, and synthetic 2.0.3-to-2.0.7 history migration. Independent gatekeeper re-review closed the production version-parser finding. CI now qualifies the source-defined minimum and latest; rebuilt desktop acceptance is recorded separately.
Restore provisional timeline geometry through optional content-addressed index chunks, bounded independently from drafts and attachments. Validate durable session/location/project/revert identity, preserve other restored state when an index chunk is missing, and reuse immutable normalized values and encoded leaves during scroll or draft captures. Fence older renderers with a graph extension and retain monolithic-host compatibility.
Revalidate native structural indexes using stable checkpoint ranges and return only changed structure. Grow the live tail before adding ranges, reserve a complete block within each RPC page budget, and schedule a trailing scan when messages arrive during a fixed-horizon read. Route bulk-cleanup completion and ambiguous failure through the shared coalesced refresh path so the final invalidation cannot strand an obsolete native transcript window.
Cover large partition round trips, corruption isolation, restoration clear/disable, offline edits/pruning/deletions/appends, manifest growth, deletion-hole pagination, active-window refresh races and Solid trailing scans. All 21 Chromium navigation cases, package typechecks, packaged-resource smoke, Electron state tests and isolated OpenCode 2.0.5 integration pass. The second independent whole-PR gatekeeper review reports zero actionable findings; installed-app restart verification remains pending and is documented explicitly.
Build rail geometry from a structural native index of IDs, sequence, types and technical-part counts. Project that metadata in SQLite without transporting or parsing full message bodies in JS. Bounded 16384-entry pages replace 256-entry excerpt scans, and indexing runs independently of transcript hydration. Remove the excerpt-loading countdown.
Retain up to sixteen structural snapshots with a 200000-entry LRU budget, allowing one larger active index. Unchanged session returns reuse the index without a read; message changes refresh only the last 32 indexed rows and arrivals. Preserve destructive-mutation, undo, connection-generation and route ownership fences.
Restore bounded Markdown hover and focus previews. Fetch visible-nearby excerpts in batches of twelve, prioritize the hovered marker and cancel obsolete demand. Keep a separate 512-excerpt cache with on-demand age revalidation. Unavailable excerpts show no empty popup, and arriving content cannot alter marker geometry or load a transcript window.
All nineteen browser navigation cases pass, including blocked transcript/excerpt hydration, exact scrollbar extent, native thumb gestures, rich historical/resident previews, six intervening session indexes and tail-only live refresh. Six SQL tests, three route race tests, UI/server typechecks, packaged-resource smoke and the full isolated OpenCode 2.0.5 native/UI fixture pass. Record installed desktop cold-index responses of 2.05s for 11210 messages and 0.58s for 4857 messages; the warm-switch run was interrupted by user selection and is not claimed as qualified.
Large-session desktop switching reproduced repeated restoration requests for the same absent anchor. Distinguish anchor_missing in the bounded native window RPC from ownership and revert conflicts. Automatic restoration recovers once through a fresh visible latest page and replaces the stale saved cursor only after success; explicit navigation and authority failures retain their error semantics.
Cancel view-owned initial reads when hidden, release their request authority before an immediate return, and prevent obsolete hydration callbacks from reviving after away-and-back navigation. Pause outline scans while transcript hydration is loading, preserving their accepted cursor and completed display. Add the user-approved lightweight timeline scrollbar separator, hidden when its measured content does not overflow.
Record the real Windows desktop baseline and remaining priorities in SESSION_HISTORY_STRESS_REVIEW.md: 62.62 MiB of transcript responses, repeated outline scans, transient heap growth and main-thread stalls. Separate observations from unproven leak or CPU attribution, and document the live-event merge, incremental metadata and byte-budget work still needed.
Validate 18 browser navigation cases (17 in the complete run and the corrected localized conflict assertion in a targeted rerun), four active-load lifecycle tests, seven navigation store/routes tests and both typechecks. The complete isolated native Windows OpenCode 2.0.5 UI fixture passes, including missing-anchor RPC semantics and native outline/window parity.
Do not treat a newer CLI's stopped status as proof that its older shared daemon is absent. Resolve native service metadata read-only through the selected execution host, match the channel's credential/configuration unambiguously, and authenticate historical metadata routes before admitting the registered endpoint. Repeat discovery inside ensure before starting.
Fail closed for malformed or oversized records, ambiguous identity, authentication failures, timeouts and existing WSL registrations with forwarding errors. Distinguish fresh configuration with no native registration, preserve the shared loopback policy including 127.0.0.2, and translate mounted/aliased WSL metadata through the selected distro.
Add lifecycle regressions and bounded, isolated packaged desktop acceptance. Both rebuilt Electron and Tauri retain an actual 2.0.3 daemon through installation until explicit restart, then activate 2.0.11 and resume the pending folder. Normal installation/reload and all three WSL modes pass. Final gatekeeper review reports no actionable findings; full server suite passes 621 tests with two skips.
Exercise the real Windows-to-WSL service lifecycle and plugin provisioning through native, mounted and aliased discovery roots. Use guarded fixture-owned registrations, unique service ports and fully isolated environments; record actual watcher behavior, measured lease heartbeats, explicit reload, restart and cleanup.
Characterize reload with a held synthetic provider stream and native pending Form, Shell and PTY. Verify one successful provider request without replay and record native resource teardown. Update all locale descriptions to explicitly include terminals and background commands.
Bound the whole fixture, native requests, predicates and cleanup independently. Handle detached event-consumer failures immediately while preserving awaited failure reporting. Seven guard regressions and final real aliased reload-safety acceptance pass; autonomous gatekeeper re-review reports no remaining fixture findings.
Ensure a wedged migration reports a failure instead of retaining a native fixture indefinitely. Apply a whole-run deadline and per-request cancellation through the generated client, bound startup/version probes, and reject repeated pagination cursors.
Escalate termination only for the child spawned by the fixture, with bounded graceful/forced waits and explicit failure if termination cannot complete. Keep cleanup in finally blocks and add workflow timeout backstops.
Gatekeeper re-review reports no remaining findings in acceptance/CI paths. Three failure-guard regressions pass; native historical migrations pass again on Windows and Linux with the guards enabled.
Keep activation explicit after optional upgrades while reconnecting backend authority to the newly selected executable. Supported running daemons remain usable and new workspaces can open when restart is deferred. Recheck executable selection and execution-host eligibility before mutating the shared service.
Publish verified installations with immutable, exclusive version receipts. Concurrent older installs cannot downgrade a newer selection, and same-version Windows publishers no longer replace an open receipt. Continue reading previous current markers.
Cover the gatekeeper findings with real manager/shared-service ownership regressions, browser recovery tests, and concurrent installer tests. Extend native migration to beta and stable seeds, same-version Forms durability controls and historical provider connections. Provide the POSIX shell explicitly in the no-system-Node fixture, fixing Linux/macOS installation CI isolation.
Require stable OpenCode >=2.0.11 <3.0.0 from authenticated daemon metadata before functional clients and plugin provisioning. Keep bounded contract recognition, connection-generation fencing and native ownership checks while retiring old request, response and event conversions.
Unify missing and outdated runtime recovery with Preferences. Install exact stable releases through bundled Node/npm into a verified versioned user prefix, preserve custom and WSL selections, and separate installation from explicit shared-service restart through the native-parent starter. Fence stale setup responses, retain pending folder opening and never replay prompts.
Certify isolated 2.0.3-to-2.0.11 history migration with executable hashes, untouched seed storage, paginated messages, forks, compaction checkpoints, location moves and pending inbox data. Add minimum/latest cross-platform migration and installation gates, packaged npm closure checks, real Solid recovery regressions and supported-contract authority tests.
Validated server/UI types, focused unit and reducer suites, browser captures, actual packaging-prepared Node 24.20.0 installation without system Node, and native location, automation and pruning fixtures. Document packaged-desktop, WSL, broader historical-state and remote-CI evidence as remaining release gates.
The installed Windows application returned only four metadata entries from a 10,763-message session because the outline's wall-time budget included cooperative event-loop waits. Remove scheduler time from pagination and bound each page by 256 rows and 24 MiB of parsed source payloads instead. Yield every 16 rows in both outline and message-window reads, preserving cancellation without paying one scheduler round trip per message.
Regression coverage advances the clock across each observation, checks full metadata pages, verifies cancellation releases the read transaction, and proves byte-budget pagination retains the first unread message. Strengthen the isolated native fixture to require full small-record pages. Seven navigation/store/route checks and the server typecheck pass.
Align the server/UI OpenCode client and bundled plugin at 2.0.11. Route canonical server.info through authenticated discovery, preserve legacy step timing, and honor hidden Forms protocol fields without rendering their inputs or dropping defaults.
Reconcile terminal tools into the bounded visible transcript and fence native reducer history reads against intervening events. Discard stale pages and coalesce trailing reads so a late settlement snapshot cannot remove a newer streaming assistant. Preserve lifecycle, generation, disposal, location and historical-data safeguards.
Qualify the latest stable runtime in CI and record the resolved version. Each CodeNomad release fixes its minimum supported OpenCode version to the latest stable available when that CodeNomad release ships. Keep one shared compatibility reference and detailed evidence in PR/CI history rather than per-version reports.
Validation includes isolated native runtime/proxy/pruning, automation, environment and fork acceptance; hidden Forms browser coverage; deferred settlement/new-execution regressions; 112 final targeted UI tests, typechecks and production builds. Gatekeeper findings were fixed and independently re-reviewed before merging.
Cancel deferred active-marker reveals when the reader scrolls or interacts with the global rail, and reveal without a smooth animation. A previous selection must not move or unmount the next click target while its distant window is still loading.
Extend the Chromium latest-intent regression to keep the next destination visible beyond the reveal delay. Update the isolated native pruning UI fixture to proxy history routes and provide the same service-location inventory used by whole-session cleanup.
Validated all five browser navigation cases, the UI typecheck, packaged-resource smoke checks, and the complete isolated OpenCode 2.0.5 native/UI pruning fixture, including whole-session confirmation and persistence after reload.
Extend the existing history-query plugin with bounded outline and anchor-window reads so timeline and current-session search can reach distant passages without loading intervening transcript pages. Share daemon-storage identity binding, preserve location/project/revert authorization, enforce payload budgets and retain overlapping neighbors for reading-position restoration.
Route timeline, search and missing restoration anchors through the existing message-load authority fences. Keep the visible transcript during navigation, let the latest requested destination win, reject late results after cancellation or leaving the session, and retain historical reading positions during live generation.
Restore a discreet timeline scrollbar with stable reserved geometry. Only marker rectangles narrow; icon dimensions and vertical spacing remain fixed across hover, focus, RTL and fractional zoom. Include localized loading/retry UI and document the navigation contract.
Validated with server/plugin/route regressions, 75 UI store tests, 56 distinct Chromium cases, server/UI typechecks, UI/plugin builds and an isolated Windows OpenCode 2.0.5 fixture comparing 1501-message navigation against native export and message reads. Installed desktop and other-platform validation remain separate.
Replace transcript-wide API downloads with bounded plugin-side history scans. The search window now offers session/workspace scope, message and technical-content snapshots, paginated excerpts and explicit single-message previews that do not populate or displace the resident transcript window.
Plan whole-session technical cleanup using compact IDs, revisions and counts, then execute batches through the existing synchronous SQLite ownership and durable execution-claim fences. Preserve text and pre-compaction history semantics, refuse changed or active content, retain atomic retry receipts, and expose progress, cancellation and partial failures.
Bind reads to the authenticated daemon storage, constrain cursors and payload sizes, and validate every contributing location against local worktree ownership before publishing workspace counts or excerpts. Keep native RPC access narrow, preserve migrated global history, add translations for all locales, and retain search-input focus with the new controls.
Validation: 56 server/plugin/route tests, 45 UI store tests, 43 transcript browser regressions and 8 search/utility-window browser tests passed. Server/UI typechecks, the UI build and bundled plugin build passed. The isolated Windows OpenCode 2.0.5 fixture verified 241-message counts/search/cleanup, exact batch retries, active-claim refusal, pre-compaction discovery and existing concurrency/cache behavior. Desktop release interaction and other native platforms remain separate validation.
## Summary
Live transcript events were measured arriving 139–160 seconds late
through CodeNomad while the direct native stream arrived in 22–55 ms.
Serial event routing awaited ownership checks across every logical
workspace before accepting the next SDK event.
- Buffer before slow routing I/O, preserving per-session/PTY/Shell
ordering and independent per-recipient FIFO delivery.
- Share validated ownership checks by recipient and complete native
location; fence inventory invalidation, disconnected generations and
stopped/reopened workspace incarnations.
- Bound retained jobs, payload size and routing age; reconnect through
normal authoritative recovery on overflow instead of silently dropping
deltas.
- Cancel pending session lookups and add rate-limited stage-specific lag
diagnostics without event contents.
## Base
Rebased onto upstream/dev at 7312ac22, including #717 and #718.
## Validation
- 43 targeted server routing/worktree regressions passed.
- Server TypeScript compilation and diff whitespace check passed.
- Isolated native OpenCode 2.0.9 fixture passed, including a
deliberately blocked recipient and another subscriber on the same SDK
client.
## Desktop testing
A Windows Tauri build of this PR is being prepared for manual testing
with the existing profile. Live before/after measurements will be added
after installation.
## Summary
- Upgrade the standalone Node executable bundled with **both Tauri and
Electron** from **22.22.2 to 24.20.0 LTS (Krypton)**.
- Add a single exact `.node-version` pin consumed by the runtime
preparation script and all Node CI setup steps, replacing the previous
Node 20/22 build/test split. Official archive SHA-256 verification and
executable-only packaging are preserved.
- Set **macOS 13.5 minimum** explicitly in both desktop bundle manifests
and update the build documentation. This compatibility change was
explicitly accepted by the requester.
- Strengthen packaged-resource smoke checks: verify the bundled Node
matches the pin, reject stale runtimes, and exercise ESM imports
including the native OpenCode V2 client from the packaged server
directory.
- Add regression coverage for the shared runtime/CI pin and macOS
minimum-version parity.
## Scope and compatibility
This updates the Node process running the CodeNomad backend. It does
**not** upgrade Electron 39 or its internal Node/Chromium, WebView2, the
user's Node installation, or the independently managed OpenCode daemon.
No application dependencies or lockfile versions are changed.
Node 24's official macOS binaries require 13.5 rather than Node 22's
11.0. Windows x64/ARM64 and Linux glibc x64/ARM64 keep their existing
Node platform floors. No additional platform or musl support is
introduced.
The Windows x64 Node executable increases from approximately **83.04 MiB
to 89.06 MiB** uncompressed. Final installer/archive size changes have
not been measured. This is a runtime maintenance update, not the
deferred packaging-size optimization.
## Validation
Performed in an isolated worktree on Windows with the official,
checksum-verified **Node 24.20.0 / npm 11.19.0** distribution:
- [x] Clean `npm ci`; lockfile unchanged.
- [x] UI, Electron, and server TypeScript checks.
- [x] Server suite: **391 passed, 2 platform-skipped, 0 failed**.
- [x] Electron Node-level native-logic suite: **192 passed**.
- [x] Packaging/runtime regression tests: **6 passed**.
- [x] `npm run bundle:server --workspace @codenomad/tauri-app`: rebuild
UI/server resources, stage production dependencies,
download/check/extract Node 24, and run packaged
startup/import/loading-asset checks.
- [x] Negative smoke: the previous release's packaged Node 22.22.2 is
rejected with a version mismatch.
- [x] Desktop manifest schema checks (Tauri numeric-format annotations
ignored by the standalone JSON schema validator).
- [x] `git diff --check`.
The preliminary compatibility study also loaded all 14 direct server
dependencies and the packaged `msgpackr-extract` N-API binary under Node
24, with a successful serialization roundtrip.
## Remaining release gates / existing warnings
- [ ] Cross-platform CI builds and tests on the final head.
- [ ] Native GUI launch, restore, OpenCode streaming, shutdown, and
restart verification for the rebuilt desktop applications. Resource
smoke tests and Node-level Electron tests are **not** a complete
native-release approval.
`npm ci` still reports the existing 49 dependency advisories; this PR
does not run an unrelated dependency upgrade. npm 11.19 also warns about
existing install scripts awaiting `allowScripts` coverage. `actionlint`
reports only the pre-existing constant-false condition in
`build-and-upload.yml` (now line 816).
The touched `build-and-upload.yml` remains approximately 913 lines; no
unrelated workflow refactor is included.
## Summary
I added **Fork after this message** to completed agent responses and
user prompts. Both actions keep the selected message and open the new
conversation with an empty composer. The source conversation and its
draft are preserved.
I resolve the cut against native message history, including hidden
records and cursor pages. A tail fork checks the native boundary; if
another client appended in the meantime, I discard that fork rather than
open the wrong history. Pending prompts and unfinished responses do not
offer the action.
Closes#693.
## Validation
- UI typecheck passed.
- 7 fork regressions and 65 existing request-authority tests passed.
- 5 Chromium scenarios passed: prompt, historical response, latest
response, unfinished response, and narrow overflow menu. These exercise
the real SessionView, empty composer, preserved source draft, and
absence of an extra prompt.
- The isolated native fixture passed on OpenCode 2.0.10 and beta-19271,
including page crossings, a hidden model-change message, both tail
roles, and preserved source history. I used private homes/databases and
left the shared daemon untouched.
- I added the unit regression to CI; the browser regression is picked up
by the existing browser suite.
The shared UI implementation applies to Tauri and Electron. I have not
rebuilt or installed a desktop binary.
## Maintenance note
The touched existing files are already large: `session-api.ts` (~1,826
lines), `message-item.tsx` (~817), and `session/session-view.tsx`
(~693). I kept the new boundary logic in a separate module.
## Summary
Apply the existing CodeNomad profile environment **before every prompt,
custom command and session-shell send**, then forward the request only
after OpenCode acknowledges it. This makes profile changes available to
local commands even when the shared daemon is already running.
No per-conversation settings UI, polling, session-opening writes or
daemon restart. The implementation lives in the shared server for
Electron/Tauri/web parity.
close#711; awaiting reporter validation rather than automatically
closing the issue.
## Implementation
- Build a complete execution-host snapshot; preserve PATH and other
inherited values, normalize Windows key collisions, and exclude internal
authentication/storage variables. WSL reads its selected distro's
environment instead of sending Windows PATH/HOME.
- Apply after ownership checks and worktree mutation admission, using
the pinned native connection. Fail the send on environment errors, stale
connection or disconnect; never log the native environment request body.
- Update help and failure messages in every locale. Changes and removals
take effect on each conversation's next send.
## Validation
- Server suite: **586 passed, 2 platform skips**.
- Focused UI send/SDK/authority tests: **112 passed**.
- Server, UI and Electron typechecks; production UI build passed.
- **OpenCode 2.0.9 / Windows native fixture:** real WorkspaceManager +
guarded proxy + native shells, two conversations, changes/removal, no
mutation on read, Git Bash, unchanged daemon PID. Independent
configuration/database/port; only the fixture service was stopped.
- Reproduction: `node scripts/test-session-environment-native.mjs
<absolute-opencode-executable>`.
## Scope
This changes local session command environments, not provider/MCP/LSP
configuration or daemon-internal temporary files. The native environment
belongs to a session: another client or a new send during existing work
can replace it. Queued prompts do not get individual snapshots, and
native-created subagents are not automatically intercepted. Details:
`dev-docs/SESSION_ENVIRONMENT.md`.
Existing oversized files touched narrowly:
`packages/server/src/server/http-server.ts` (~2,300 lines),
`packages/server/src/workspaces/manager.ts` (~1,200 lines), and
`packages/ui/src/lib/i18n/messages/*/settings.ts` (~600 lines each).
## Summary
Restore the saved project/conversation promptly, preserve restored tabs
when later hydration fails, and remove a filesystem heartbeat that
repeatedly invalidated OpenCode configuration.
## Root cause and reproduction
PR #666 placed desktop plugin presence leases beneath the authenticated
OpenCode configuration discovery root. Updating their mtimes every two
seconds triggers recursive configuration watchers and expensive
revalidation across loaded locations.
With CodeNomad closed and the same shared OpenCode daemon left running,
updating only a temporary file in that directory reproduced the
slowdown:
- Quiet: 77–92 ms for the same 200-message request.
- File mtime updated every two seconds: 5.3–8.8 seconds.
- Updates stopped: 71–138 ms.
The pre-#666 server/UI comparison was only a partial baseline: native
reads recovered after startup, but the older UI also exhibited
restoration failures.
## Implementation
- Derive a sibling plugin storage namespace from the connected daemon's
authoritative discovery root. Move new heartbeats outside its
recursively watched configuration tree.
- Migrate existing managed inside-root storage while retaining read-only
observation of older backends' leases. Preserve existing outside-root
storage, independent backend lifetimes, and native WSL path translation.
- Seed saved selection identity before HTTP hydration, prioritize the
saved project, and hydrate its conversation directly. Preserve bound
project tabs across subsequent hydration errors/timeouts and respect
user selection changes.
- Load model/agent catalogues when the client becomes ready and retry
reads superseded by the initial stream connection.
- Publish session lists without waiting for runtime-status reads; merge
delayed status results without overwriting SSE updates or local
admissions. Use lightweight status reconciliation for liveness.
- Bound secondary reads across projects, coalesce Shell refreshes, and
prevent duplicate catalogue/Shell refreshes through the native
transcript projection.
- Preserve directory authorization while avoiding Git mutation-identity
resolution on reads; reject unrelated Git common directories before
native worktree inventory scans.
## Validation
- Targeted UI and server suites covering reconnect races, status
authority, background queue cancellation, projection isolation, Shell
refresh coalescing, and ownership enforcement.
- 19 plugin path/lifecycle/migration/presence tests passed.
- Six browser restoration scenarios covering Electron/Tauri, saved
selection, user selection, and hydration timeout behavior passed.
- Isolated OpenCode 2.0.9 integration fixture passed: native
provisioning, plugin availability, independent leases,
shutdown/reopening, and OS watcher verification that heartbeats do not
modify the configuration tree. A negative control using the old storage
placement fails that assertion.
- Typechecks, complete server/UI/plugin build, and `git diff --check`
passed.
- Installed usual-profile Tauri validation on the requested
conversation: launch-to-display 3.86 and 5.33 seconds; initial
200-message requests 178–239 ms; latest forced reload 218 ms. No
intermediate wrong conversation selection observed. Verified all three
saved projects and the real model menu.
## Remaining observed edge case
A forced reload racing restoration of an old scroll position can still
show the existing history retry control. Retrying succeeded. This PR
addresses the reproduced latency trigger and startup restoration races;
it does not claim that every scroll-restoration edge case is resolved.
## Summary
- Add autonomous native browser previews for Electron and Windows Tauri,
using the authenticated backend/native bridge already shared with
desktop inspection.
- Ship one bundled **`codenomad.automation`** V2 plugin for browser,
inspect, act and screenshot. All tools are available by backend
presence; ordinary desktop startup prepares the instrumentation. Remove
the Developer Mode toggle, marker-based activation and activation
restart requirement.
- Provision through native discovery using the **connected daemon's
authenticated `config.get` roots**, including WSL and reconnects. Share
installation/lease mechanics with pruning, preserve user-authored
entries and older backends' leases, and unwind stale or interrupted
preparation.
- Preserve session/location ownership, inspected-host pinning, browser
registration/navigation generations, local-window targeting and
authenticated transport. The OpenCode daemon remains externally owned.
## Gatekeeper review — September 18, 2026
Merged current `dev` at `96ef38c6` and repeated independent UI, native
and server reviews after each finding until all three scopes reported
**zero remaining actionable findings**.
Corrections include ordinary-project discovery without Developer Mode;
connected-daemon namespace selection and stale lease cleanup; Tauri
child-webview capability isolation, native-window counting,
primary-renderer reload cleanup, fragment navigation, snapshot lock
ordering and deadline-fenced protocol dispatch; and Electron guest
readiness, redirects and explicit navigation intent. Shared-frame
regressions also cover insecure HTTP and late/rejected native IPC.
### Architecture decision
Current OpenCode V2 documents MCP `_meta.sessionID`; the historical
missing-session-metadata argument no longer applies. A single native V2
plugin remains appropriate for the requested unified automation surface:
it reuses the existing authenticated transport and native controllers,
supports backend presence, and needs no second protocol server or
mode-based permission framework. Plugin loading, tool availability and
execution targeting are separate concerns.
## Validation
- Full server suite: **570 passed, 2 skipped**.
- Electron native suite: **214 passed, 4 skipped**.
- Tauri native suite: **180 passed**.
- Real Solid/browser preview suite: **14 passed**, including real
isolated Electron guests and insecure HTTP.
- Actual isolated OpenCode automation fixtures: **beta-19271, 2.0.3,
2.0.5 and 2.0.7**. Covers mismatched backend/daemon environments, late
discovery, all four tools without activation, execution fences,
independent leases, shutdown and reopening.
- Full isolated native pruning fixture on **2.0.7**, including
concurrency, durable claims, payload isolation, backend presence,
restart and worktree/location integration.
- UI, server and Electron typechecks; Electron production build; Windows
Tauri release build (`--no-bundle`); focused Rust formatting and `git
diff --check`.
- Electron and Tauri packaged-resource smoke checks, plus five desktop
packaging regressions including loading the dependency-free automation
bundle from both layouts.
- CI now runs automation discovery across the runtime matrix, includes
2.0.7, and uses Xvfb for real Electron renderer regressions on Linux.
## Validation boundaries
The fixtures never use or stop the shared daemon or a user's database.
Actual WSL runtime execution and a live packaged WebView2 interaction
smoke were not performed in this pass; WSL resolution and Tauri
controller/capability behavior have focused regressions. The currently
running desktop artifact was not replaced. Agent interruption remains
deadline-based rather than end-to-end native cancellation.
Cross-platform CI must validate the pushed head.
## Summary
Bound miss-triggered ownership refreshes and retain completed worktree
inventories with demand-driven stale-while-revalidate reads for display
consumers.
The shared native event bridge awaits directory ownership sequentially.
Previously, each new foreign directory discarded the inventory and its
negative cache, triggering another complete native/Git scan. Twenty
foreign directories caused 21 inventory loads; the ownership regression
now requires two and covers explicit invalidation and expiry.
The manager also used to retain only an in-flight inventory promise.
Sequential UI reads therefore repeated the complete scan.
`WorktreeInventory` now retains the last successful snapshot:
- Display reads reuse it immediately. Expiry (10 seconds) or
invalidation only schedules one background refresh when a consumer next
reads it; there is no polling timer.
- Concurrent callers share the scan, failures retain display data with
demand-driven retry backoff, and invalidation fences obsolete results
with serialized trailing validation.
- Directory authorization uses validated reads, which wait if the
snapshot is stale. Family create/move/delete checks force a fresh scan.
Workspace disposal fences pending results.
- A changed completed snapshot publishes `workspace.worktreesChanged`;
existing UI consumers queue a reload behind older HTTP responses.
Unchanged scans do not create notification feedback loops.
- The selector opens before the reload completes. Duplicate selection
notifications during inventory reconciliation no longer dismiss an open
menu or produce a family move, and a delayed response cannot reopen a
dismissed menu.
## Measurements and scope
- Before the initial miss-refresh correction, the installed renderer
lagged native events by 331-336 seconds, versus 42-84 ms on a direct
read-only native subscription.
- The first post-restart sample caught up to 340-699 ms, but a
subsequent 45-second sample still showed session median 851 ms, p95 12.2
seconds, and overall spikes of 15.5 seconds. The corresponding direct
native session median was 52 ms and p95 339 ms. This is **not a complete
startup/event-latency fix**.
- A real 165-worktree inventory measured location.get 22 ms, native
refresh 282 ms, and native list 5 ms, versus 24,067 ms for the whole
CodeNomad inventory. The local validation/annotation pass launches three
Git commands per inspected checkout.
- This memory cache removes repeated display scans and lets warm display
reads continue while stale data refreshes. It does not persist across
backend restarts or reduce the cost of a cold or required authoritative
scan. The serial event bridge can still await such validation.
## Validation
- 110 targeted server tests passed: inventory cache (6), ownership
directory cache, event bridge, workspace lifecycle/routes, worktree
routes, family transactions and evacuation.
- Five existing UI worktree store tests passed with browser conditions.
- Four Chromium tests passed: pointer/keyboard/touch actions, background
completion racing an older HTTP response, immediate cached opening and
Escape dismissal during a blocked refresh, and creation/selection by
stable ID.
- The isolated native location/worktree fixture passed against OpenCode
2.0.7, including real branch rename, cached reuse, lazy invalidation and
forced validation with native events connected.
- Server/UI typechecks, emitted server TypeScript, UI production build
and diff check passed.
## Installed state
Only the earlier compiled ownership-cache module (`70af9c84`) has been
installed locally. The new inventory cache and selector changes are
built and tested in the existing worktree but have **not** been deployed
to the running installation. No shared daemon or user profile was
restarted or modified for these new tests.
## Summary
Manage complete session families across the opened local repository's
native OpenCode worktrees. This supersedes #642 with the V2
implementation and addresses #319.
- OpenCode owns `worktree.refresh/list/create/remove`; CodeNomad
supplies the default directory, named-branch policy, local repository
scope and verified family transactions.
- A project is the opened local checkout and its registered worktrees,
identified through the physical Git common directory. Independent clones
sharing an OpenCode project ID stay separate.
- Session rows, composer selection, search and the Git panel follow
native `SessionInfo.location.directory`. Durable metadata is preserved,
but old `worktreeSlug` metadata does not override native placement.
- Creation uses the selected checkout's revision and the main local
checkout's `.codenomad/worktrees` parent. Uncommitted edits stay in the
source checkout. External registered worktrees remain discoverable.
- Keep copy/open/delete actions in the accessible selector, remove the
redundant action bar, hide root-workspace badges, and explain “Create
and use” in all ten locales.
## Current base and native contract
This branch includes merged `dev@e47e01c6`, including #697's separately
reviewed discovery/status compatibility fix. UI/server pin
`@opencode/client@2.0.4`; the independently managed daemon has no
exact-version startup gate.
- Complete bounded inventories use opaque native cursors; continuations
send only the cursor.
- Moves are serialized across complete families, block active sessions,
verify authoritative native locations and roll back partial failures.
- Native move events refresh placement and the catalogue without
speculative cross-project transfers.
- Opaque worktree identifiers are separate from mutable branch labels.
The main checkout cannot be removed.
- Native detached creation is followed by ordinary Git branch selection,
preserving Git's refusal to reuse a checked-out branch;
branch-attachment failure cleans up through the native API.
- Agent placement instructions distinguish creating a checkout, one-off
commands and moving the conversation's execution context. Explicit
attachment choices are preserved.
## Deletion safety
- Physical checkout reservations cover published and in-flight logical
workspaces.
- Project serialization and deletion fences cover all family
source/destination checkouts.
- Complete inventories and cross-project checks run inside the deletion
fence, including nested workspaces and owned Shell/PTY resources.
- Canonical path, filesystem identity, registration, branch, HEAD and
active sessions are rechecked before removal. Replacement checkouts fail
closed; rollback requires the original identity.
## Recovery and Git-panel corrections
Validation on the real repository exposed serial enumeration of 162
worktrees and concurrent ownership misses launching overlapping
inventories. Git annotations now run with bounded concurrency, pending
catalogue reads are shared, and negative ownership results are
snapshot-cached. A regression exercises 40 concurrent misses.
The Git panel now treats its complete local staged/unstaged inventory as
authoritative instead of resurrecting native-only stale rows. It also
rechecks the selected worktree/request after waiting for native VCS
status.
## Validation
Latest integration validation:
- Isolated official **OpenCode 2.0.0 and 2.0.7**: production
discovery/status, native worktree discovery/create/remove, selected
HEAD/default parent/named branches, independent-clone scope, stable IDs,
nested paths, checked-out/dirty guards, complete family moves and
rollback.
- Real Solid selector browser tests: mouse, keyboard, touch, actions
without session movement, creation source and returned stable ID.
- Targeted server ownership/cache/manager/proxy/route/location tests; UI
session projection/request-authority/lifecycle tests; family
evacuation/rollback and Git model regressions.
- UI/server typechecks and production server build including the UI.
- Installed Windows Tauri application on the actual repository:
dedicated session creation/use, native location and row/composer badges,
Git marker visibility, move back, and agent `session_move` reflected in
both badges.
- Rebuilt UI/server resources installed; full Developer Mode restart
restored the original conversation. Disposable sessions, marker,
worktrees and branches cleaned up. The original conversation remained
attached to `pr649-final`.
- `git diff --check`.
An immediate post-restart desktop run exceeded a 30-second
refresh-button wait; the subsequent completed run passed. These checks
validate the workflows, not a startup latency bound or exhaustive
compatibility of every OpenCode payload.
Earlier branch validation also covered Electron/Tauri native actions,
packaging and desktop parity; those results remain in the PR's
historical validation comments. Detailed contract and latest evidence:
`dev-docs/WORKTREE_SESSION_PLACEMENT.md`.
## Residual limit
OpenCode and Git expose no shared snapshot/CAS transaction. CodeNomad
narrows races with reservations, locks, fences and repeated
authoritative checks; unrelated processes can still mutate state outside
those controls.
## Summary
Follow-up to #695: restore connections to OpenCode 2.0.7, whose
authenticated service metadata endpoint is `/api/info`. Built directly
on current `dev` (`aa51cbb9`).
- Probe `/api/status`, then `/api/health`, then `/api/info`, advancing
**only on HTTP 404**.
- Preserve credentials, the absolute deadline, bounded/validated
responses, and reject redirects.
- Record the discovered route and adapt the pinned client's `GET
server.status()` call to `/api/info`.
- Preserve OpenAPI contract negotiation for unknown releases; no 2.0.7
special case or new minimum version.
**OpenCode 2.0.0 remains supported by the existing health path.** Its
real isolated daemon passes the connection and native location
regression fixture with this change.
This PR contains only the service discovery/transport fix and its
tests/docs. Worktree catalogue performance/cache changes remain in #649
and are not dependencies of this fix.
## Evidence
Comparing all 132 generated-client HTTP method/path pairs against the
installed 2.0.7 OpenAPI schema found 131 unchanged pairs and the
status/info difference fixed here. Experimental routes were already
covered by #695; no additional experimental-route migration is needed.
## Validation
- [x] 44 focused host/WSL lifecycle, shared-service, transport and
negotiation tests
- [x] Server TypeScript check
- [x] Real isolated OpenCode **2.0.0**: production health discovery,
canonical `client.server.status()`, legacy location identity, Forms,
Shell/PTY scoping, SSE, foreign cursor/session refusal and exact move
rollback
- [x] Real isolated OpenCode **2.0.7**: production info discovery,
canonical `client.server.status()`, modern worktree location and
obsolete-selector rejection
- [x] Staged whitespace check
Native fixtures use dedicated temporary databases/configuration and do
not target the shared user daemon. These checks establish discovery and
targeted contract behavior, not an exhaustive certification of all
runtime features.
Signed commit: `16d10fcd`.
Closes#694
## Status
This PR contains the stable 2.0.4 client migration, authenticated V2
discovery fallback and shared cross-runtime compatibility
implementation. The validation results below are local execution
evidence; the newly added CI matrix must also run on the updated PR
head.
## Published changes
- Pin UI/server to official `@opencode/client@2.0.4` and the bundled
pruning plugin to `@opencode/plugin@2.0.4`, with the corresponding
lockfile migration.
- Probe authenticated `/api/status` first. Fall back to earlier V2
`/api/health` **only on HTTP 404**, retaining the endpoint, credentials,
64 KiB response bound and absolute deadline. Authentication, transport,
server and malformed-status failures do not trigger fallback.
- Migrate the canonical UI/server contract to stable Forms, permission
decisions, command names, interrupts, renaming, forks, message lookup
and inbox delivery.
- Update the guarded proxy for stable methods/paths, native
active-session envelopes, native `cursor.next`, global Form directory
headers and current resource/plugin events.
- Follow the renamed upstream platform binary `bin/opencode(.exe)` while
retaining public CLI aliases.
Discovery success alone does not establish compatibility with an earlier
runtime's conversation APIs.
## Shared cross-runtime compatibility
### Shared cross-runtime integration
- Introduce one connection-scoped adapter under
`packages/server/src/opencode/compatibility/`, used by both the guarded
UI proxy and direct server callers, including Yolo.
- Select the contract using authenticated daemon identity rather than
the CLI executable's version. Recognize unknown publications through
authenticated, bounded OpenAPI negotiation instead of an exact
runtime-version gate.
- Bind authorization, client, transport and profile to one connection
generation. Fence actual mutation dispatch after asynchronous body
preparation; prevent late old streams from publishing or invalidating
their replacement.
- Translate earlier V2 routes, methods and payloads before sending.
Never retry a mutation speculatively after 400, 404, authentication or
transport failures.
- Normalize legacy HTTP inbox timestamps, including compaction
admission, before the pinned Solid reducer. Preserve the distinct native
SSE inbox schema and durable event metadata.
- Restore legacy catalog/content invalidation and permission-event
convergence. Preserve meaningful method/path/status/profile diagnostics
and native 401 error envelopes.
### Location authority and pruning
- Preserve legacy workspace identity internally through request
serialization, catalog/cache keys, Forms, imports, cursors, events and
exact move rollback. Modern public APIs continue to reject obsolete
workspace selectors.
- Authorize complete locations before translating directories or
synthesizing upstream Form/location headers. Keep native cursor tokens
unchanged.
- Preserve session/path ownership, worktree mutation fences and the
restricted proxy allowlist. Generic RPC, plugin management and
destructive revert commit remain blocked.
- Carry verified legacy identity through pruning membership checks,
preview and the existing transactional storage/claim fence; do not relax
deletion checks.
- Treat native idle records as control records, retaining
identity/outcome without fabricated assistant text.
- Add a common multi-runtime CI matrix and the audit/evidence register
in `dev-docs/OPENCODE_V2_COMPATIBILITY.md`, including preserved
historical architecture findings.
## Local validation
All native tests use isolated synthetic daemons, configuration and
databases, never the shared daemon or user storage.
| Check | Result |
| --- | --- |
| Same native suite on beta-19271, 2.0.3, 2.0.4 and 2.0.5 with pinned
client/plugin 2.0.4 | Passed |
| Full native pruning suite with non-null legacy workspace identity on
beta-19271 and 2.0.3 | Passed |
| Rendered UI on modern 2.0.5 and beta-19271 with non-null identity |
Passed |
| Native 2.0.5 suite inside Ubuntu/WSL, using a temporary Linux
filesystem root | Passed |
| Server tests (after CI follow-up) | 500 passed, 2 skipped |
| UI store tests | 441 passed |
| Electron native tests | 194 passed, 4 skipped |
| UI/server/Electron typechecks | Passed |
| UI/server and Electron production builds | Passed |
| Windows Tauri release executable (`--no-bundle`) | Passed |
| Electron/Tauri packaged-resource smoke checks | Passed |
| Desktop packaging invariants | 4 passed |
| `git diff --check` | Passed |
The native matrix exercises the actual shared connection, generated
client, UI fetch adapter and guarded proxy: voice-off/on instructions,
prompts, commands, session Shell, background Shell output
cursors/removal, UI/Yolo permission acceptance and rejection, busy inbox
delivery/cancellation, interrupt/wait, staged revert clearing,
session/global/worktree Forms, native pagination, export/import,
same-directory legacy identities, scoped events, foreign authority
refusal and exact rollback.
Pruning coverage includes actual storage identity and execution claims,
busy refusal, idempotency, competing admission, next-model payload, fork
isolation, pre-compaction history, restart, backend presence
disposal/reopening and crash expiry. Rendered tests cover
individual/group/response/session cleanup, confirmation counts,
persistence and reload.
## Autonomous gatekeeper review
Review/fix/retest loops concluded with no remaining actionable findings
in the reviewed transport/lifecycle/proxy,
identity/UI/events/pruning/rollback, scripts/CI and rendered-fixture
scopes.
Corrections included dispatch-generation races, compaction admission
normalization, independent negotiation cancellation, first-request
profile resolution, preservation of streamed 401 envelopes and direct
Shell/PTY identity propagation. A final rendered failure was traced to
the fixture awaiting only the first RPC of a cross-message deletion; the
fixture and regression now await every affected message. Production
deletion guards were not relaxed.
This scoped approval does not close the separately preserved historical
architecture findings.
## Validation boundaries
### CI follow-up
The first run on `a0c1c943`
([35142559235](https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/35142559235))
failed in five native jobs. The local bundle tests had missed the
standalone npm archive's missing sibling import, and Windows legacy jobs
exposed a short-path versus canonical-path project comparison. The
dependent artifact-comment job reported that same build failure.
The follow-up makes the plugin's identity primitives self-contained,
adds an isolated npm-file-list regression for all exported entrypoints,
and corrects project identity selection with alias and nested-repository
regressions. The packed-plugin failure was reproduced before correction;
the corrected installed package passes the native suite on Windows 2.0.4
and Linux/WSL 2.0.4/2.0.5. The corrected 2.0.4 shipped bundle also
passes rendered/native pruning. Fresh full beta-19271 and 2.0.3
`--legacy-pruning` suites pass under a reproducing Windows short-path
TEMP root after the final exact-directory fix. Independent final reviews
approve packaging/documentation and worktree identity with zero
actionable findings. Remote checks on the new head remain the CI
authority; these are local follow-up results.
- Full interaction with the installed desktop application through
Developer Mode was not verified because Developer Mode is inactive. The
release executable and packaged-resource checks above are build/smoke
evidence, not a fresh-install interactive certification.
- Remote run
[35146390688](https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/35146390688)
at `486e856d` passes all runtime-contract jobs, Windows/Linux native
pruning, service compatibility, general tests and both Tauri checks.
macOS passes packed-plugin loading/pruning, then times out on late
bundle discovery. The fixture now canonicalizes its root before daemon
startup to align `/var` configuration paths with `/private/var` FSEvents
paths. Late installation remains mandatory and asserts the plugin was
initially absent; failures now upload isolated diagnostic
logs/inventory/captures. Actual macOS confirmation remains pending on
the new head.
- Interactive native TUI validation was not performed.
- The passing WSL result is Linux-native execution inside WSL, not a
complete Windows-host/WSL desktop traversal. With the fixture's
configuration directory under `/mnt/c`, conversation/proxy checks passed
but late plugin discovery timed out; the otherwise equivalent
Linux-filesystem run passed. Mounted-configuration late discovery
remains a documented environment limitation.
- Other audited publications are declaration-reviewed, not individually
native-certified. The four-runtime matrix does not imply universal V2
compatibility.
- Earlier PR artifacts do not contain the completed cross-runtime
implementation; use artifacts built from the updated head. Local passing
results do not imply that the updated remote CI has completed.
## Summary
Restore selective deletion of completed assistant tool/reasoning content
after OpenCode removed `session.messageUpdate`, without forking OpenCode
or opening a generic RPC proxy.
The original draft's unconditional `maintenance_required` stub is
replaced by a working **experimental, explicit opt-in** plugin path for
the audited `0.0.0-beta-19419` runtime. The default remains read-only.
Unknown runtimes/storage and active native execution fail closed.
Nothing is installed or enabled on app startup.
## Implementation
- Keep individual/message/group/session cleanup entry points. Send
selected technical indices and a canonical SHA-256 revision, never
arbitrary replacement content, SQL, database filenames or
caller-selected locations.
- Use an ownership-checked CodeNomad broker with a fixed RPC
ID/method/location and worktree-deletion fence. Keep the removed PATCH
and generic RPC routes blocked.
- Bind the plugin's explicitly configured database connection to the
actual daemon DB with a fresh `ctx.storage` challenge. Inside a
synchronous SQLite write transaction, recheck
directory/project/workspace ownership, native durable execution claim,
staged revert/compaction state, event ownership and retained payloads.
- Rely on the audited native **write-ahead execution claim before runner
history reads**, not an `idle` check, plugin mutex or `BEGIN IMMEDIATE`
alone. Never set or release the native claim ourselves.
- CAS only the completed assistant's content array. Preserve IDs,
ordering, text, snapshots, usage and metadata. Commit a content-free
idempotency receipt atomically with the change; identical retries cannot
delete a second shifted block.
- Emit the custom invalidation after commit. Re-read via the native API,
invalidate the SDK transcript and pending rotations, and fence late
reads against newer invalidations. Add a public-API TUI cache companion
and reconnect handling.
- Correct native Windows path encoding; support more than 4,096 selected
parts within explicit request/message budgets.
- Provide an independently packable plugin with main and `./tui`
entrypoints, deployment/safety docs, and a Windows/Linux/macOS native
package CI matrix. Plugin installation remains manual and separately
approved.
## Validation performed locally
| Check | Result |
|---|---|
| Server/plugin/SQLite/broker/proxy tests | 72 passed |
| UI actions, events, SDK projection and stale-read tests | 60 passed |
| Plugin/SQLite/TUI-companion tests under Node 22 | 30 passed |
| Server and UI TypeScript checks | Passed |
| Production UI build | Passed; existing large-chunk warnings |
| Official Windows x64 beta-19419 executable | Passed on a private
daemon and generated DB |
| Independently packed and installed plugin | Same native test passed,
outside the checkout |
The native integration test uses the real beta-19271 network client
against the official beta-19419 runtime, with a local synthetic provider
and no credentials. It verifies actual preview/prune RPC, refusal while
a primary generation holds the native claim, both prompt/transaction
orderings, idempotent retry, two event subscribers, native re-reading,
the subsequent primary model payload, fork isolation, pre-compaction
history without summary changes, and persistence after server restart.
The new three-OS native CI matrix must pass on this head before merge.
No CI result is inferred from the local Windows run.
## Boundaries and remaining validation
- This is a reviewable opt-in implementation, **not general availability
across OpenCode versions/providers/platforms**. Exact runtime gating is
intentional; don't widen it without re-auditing/testing.
- Interactive official TUI, two native CodeNomad windows/scroll
behavior, WSL, provider-specific continuation state and budget/token
estimates are not claimed as validated. TUI companion tests use its
cache contract, not an interactive terminal. Two HTTP subscribers are
not two GUI windows.
- Existing bulk cleanup is per-message and reports failure counts;
dedicated installation/capability and bulk progress/cancel UI are not
added here.
- Existing summaries/native checkpoints, fork copies and already
assembled/sent requests are not retroactively scrubbed. Historical usage
remains historical usage; mock token values are not a token-savings
measurement.
- This changes persisted V2 content, not only visibility. It frees
reusable SQLite pages but does **not** promise a smaller physical file.
No VACUUM, V1 cleanup, durable-event rewriting, automatic backup
restoration or universal repair is included.
- No active user DB was changed, no shared-daemon plugin installed, no
shared OpenCode service stopped/upgraded, and no native desktop
executable/profile rebuilt or replaced. Tests use isolated synthetic
data only.
## Documentation
- [Request flow and validation](dev-docs/SESSION_PRUNING_RPC.md)
- [Audited safety boundary](dev-docs/SESSION_PRUNING_SAFETY.md)
- [Explicit deployment and
recovery](dev-docs/SESSION_PRUNING_DEPLOYMENT.md)
References: anomalyco/opencode#44984, anomalyco/opencode#48043,
anomalyco/opencode#48090 and the maintainer's plugin/RPC direction. No
upstream API or distribution fork is introduced.
# OpenCode V2 Migration and Desktop Restructuring
## Summary
This branch replaces CodeNomad's OpenCode V1 SDK, custom plugin, and
per-workspace runtime architecture with the native OpenCode V2 client
and one shared OpenCode service. It intentionally ships no V1 runtime
fallback.
The scope includes native location ownership, Forms and Shell resources,
project-wide cursor pagination, bounded resident message windows,
streaming reconciliation, duplicate-folder instances, multi-window
Electron/Tauri behavior, content-addressed restore, worktree mutation
fencing, and reproducible desktop packaging.
The reviewed implementation head is `dea20996`. UI and server resolve
`@opencode-ai/client@beta` to `beta-18999`; the runtime CLI is managed
independently. The official comparison baseline remains `upstream/beta`
at `eb1ac54d73`.
Full details: [`MIGRATION_V2.md`](./MIGRATION_V2.md),
[`DESKTOP_V2_COMPARISON.md`](./DESKTOP_V2_COMPARISON.md), and
[`dev-docs/DEV_V2_CODE_REDUCTION.md`](./dev-docs/DEV_V2_CODE_REDUCTION.md).
## Stabilization Fixes
- Preserve manual scroll escape across pagination, remote updates,
capped-window shifts, tab changes, and desktop restore; only a local
prompt submission forces the bottom.
- Keep the timeline resident window capped at 200 messages. Ordered
window slides use Virtua shift, while reorder, pagination, and
non-aligned replacement remount with a fresh measurement epoch.
- Finalize the temporary `200 -> 201 -> 200` transition in a
generation-guarded microtask before paint and compensate followed
content growth from a `ResizeObserver` attached to the mounted Virtua
root.
- Keep all pending inbox prompts after delivered transcript messages in
native inbox admission order.
- Add a persisted `steer`/`queue` follow-up preference; the alternate
shortcut uses the inverse while idle sends remain `steer`.
- Edit a pending prompt only after authoritative inbox cancellation
succeeds, then restore its text, structured payload, files, and agent
references to the composer.
- Expose native `session.background` through the ownership-checked
proxy, a prompt action, and `Ctrl/Cmd+B`.
- Remove the duplicate model-selector "show all" action and make the
favorites toggle label reflect its current action.
- Restore permission/Form synchronization plus skill, reference,
MCP-resource, and websearch-provider reads in the reviewed proxy
allowlist.
- Validate and preserve native location workspace identities for
root/worktree requests, session moves/imports, cursors, and global
Forms.
## Capability Decisions
| Capability | Native V2 availability | CodeNomad `DEV-v2` decision |
Revisit or complete when |
| --- | --- | --- | --- |
| Assistant content mutation | `session.messageUpdate` authoritatively
replaces the text, reasoning, and tool content of a completed assistant
message. There is still no generic deletion of a complete delivered
message or mutation of user messages. | Restores individual
tool/reasoning deletion through the native update route. Arbitrary
whole-message deletion remains absent rather than locally simulated. |
Add broader deletion only if V2 exposes an authoritative operation for
the required message type. |
| Bulk tool and reasoning cleanup | No native bulk operation, but
`session.messageUpdate` can safely compose cleanup one assistant message
at a time. | Restores selected-group and full-session technical-part
cleanup through authoritative per-message updates. | A native bulk
operation is only needed if per-message updates become a measured
performance problem. |
| Delete-to-boundary / undo | `session.revert.stage` and
`session.revert.clear` use V2 staged-revert semantics instead of
arbitrary deletion. | Command-palette Undo uses `revert.stage`; Redo
clears the staged revert through `revert.clear`. | Revisit only if V2
adds broader authoritative transcript deletion. |
| Compaction | Native checkpoint compaction summarizes the older head
and retains a server-selected recent tail controlled by
`compaction.keep.tokens`. | Uses `session.compact`; there is no
message-level selective compaction. CodeNomad displays the partial
summary through the same reactive streaming path as text and reasoning,
then replaces it with the terminal summary. | Add scoped controls only
if V2 defines scoped compaction semantics. |
| Transcript pagination authority | Message pages expose only opaque
previous/next cursors. They provide no transcript revision, total,
absolute range, position, or random seek target. | Uses bounded cursor
traversal and a 200-message resident window, with defensive
reconciliation after destructive events. It cannot prove that pages
loaded across compaction or revert belong to one snapshot. | V2 adds
snapshot revision authority
([#43766](https://github.com/anomalyco/opencode/issues/43766)) and
navigable position metadata
([#44660](https://github.com/anomalyco/opencode/issues/44660)). |
| Full-session search | `session.list(search)` filters session titles
only. There is no server transcript-search endpoint returning message
identity, excerpt, navigable position, and transcript revision. |
Retained through exhaustive message-cursor traversal while keeping only
the 200-message resident window and collected matches. Large searches
still fetch every page. | V2 exposes transcript search
([#45801](https://github.com/anomalyco/opencode/issues/45801)) with a
target that composes with transcript revision and seek metadata. |
| Queued prompt management | Native inbox list, cancel, steer, and queue
operations cover authoritative follow-up delivery. The TUI's edit action
cancels a queued prompt before restoring it to the composer; it is not
an atomic inbox update. | Implements persisted primary `steer`/`queue`
delivery, inverse alternate shortcut, delivery switching, cancellation,
cancel-first composer restoration with structured payload retention, and
native-order timeline projection. | Revisit atomic editing or reordering
only if V2 adds an authoritative operation and a concrete product need
is established. |
| Background execution | Native `session.background` moves blocking
tools out of the foreground; Shell resources separately support listing,
bounded output, and removal. | Exposes `session.background` through the
proxy and UI with `Ctrl/Cmd+B`, and replaces the custom process manager
with native Shells. Unsupported controls such as rename remain removed.
| Add controls only when the native session or Shell APIs support them.
|
| Service lifecycle | V2 uses one shared externally owned service rather
than one runtime per workspace. | CodeNomad discovers or starts the
service. Stop Workspace evicts the native location after its final
logical owner is removed; application shutdown never stops the daemon. |
No parity work planned unless V2 changes service ownership semantics. |
## Validation
Migration gate (`878550ca`):
- UI and server TypeScript typechecks.
- 86 focused UI tests covering follow, pagination, queue ordering,
bottom pinning, shortcuts, delivery resolution, and model visibility.
- 64 focused server tests covering proxy ownership/location enforcement
and shared-service workspace identity.
- Production UI/server build.
- Tauri `cargo check` and all 121 Rust tests.
- `git diff --check`.
Timeline stabilization (`dea20996`):
- UI TypeScript typecheck and all 68 focused timeline, pagination,
request-authority, and restore tests.
- Tauri release build against the `beta-18999` lock.
- Native Developer Mode validation: no remount or empty frame during
capped shifts, same-cycle growth compensation, preserved manual escape,
and inactive-tab anchor restore within 0.3125 px.
## Remaining Gaps
- Active-session-location authority for MCP/plugin status.
- Optional interactive PTY, session export, and reference/MCP-resource
attachment UI.
- Desktop release signing/notarization hardening.
## Summary
- add a release-published workflow that prepares and submits Winget
manifest updates automatically
- poll the GitHub Release API for the stable Windows Tauri asset and
compute its SHA-256 before submission
- document the maintainer secret and repository variables needed for the
Winget automation flow
## Validation
- `node --check "scripts/winget/resolve-release-asset.cjs"`
- `node "scripts/winget/resolve-release-asset.cjs" --help`
- dry-run resolver against the published `v0.16.0` release asset
## Notes
- skips draft and prerelease GitHub releases
- uses the maintainer fork submission flow for `microsoft/winget-pkgs`
- live PR submission still depends on configuring `WINGET_GITHUB_TOKEN`
- Fixes#462
## Summary
- Trim Electron app packaging to only include runtime shell assets and
remove unused workspace runtime dependencies.
- Copy server resources explicitly, filtering stale build artifacts and
pruning known non-runtime dependency files.
- Bundle only the Node executable instead of the full Node distribution.
## Validation
- Built macOS Electron artifacts with `npm run build:mac --workspace
@neuralnomads/codenomad-electron-app`.
- Ran packaged server CLI smoke test: `dist/bin.js --version` returned
`0.16.0`.
- Ran packaged dependency import smoke test for pruned runtime
dependencies.
## Size Impact
- macOS x64 zip: 161M
- macOS arm64 zip: 161M
- macOS arm64 app bundle: 435M
- Packaged server node_modules: 25M
