## Summary
Prepare stable CodeNomad 0.20.1 on top of `dev@8ce70ec4`, the source of the latest requested prerelease, before publishing through `dev -> main`.
- Align root, server, UI, Electron and Tauri npm versions and workspace lock metadata to `0.20.1`.
- Align the native Tauri configuration, Cargo manifest and application lock entry.
- Require CodeNomad server `0.20.1` in the remote UI manifest, so the updated Files, provider settings and pending-request surfaces use the matching backend routes.
- Leave the dependency graph unchanged.
This preparation PR targets `dev`; only the subsequent push to `main` publishes the stable release.
## Validation
- Clean locked dependency installation in an isolated release worktree.
- Version consistency assertions across npm/lock metadata, Cargo and Tauri; dependency graph comparison against the parent commit.
- `npm run sync:version --workspace @codenomad/tauri-app` confirms all native versions are aligned.
- UI, server and Electron typechecks pass.
- Full server production build, including the UI and bundled plugins, passes.
- Remote UI selection and dev-release channel tests pass (3 tests).
- `git diff --check` passes.
Native installers and the cross-platform release matrix have not been rebuilt locally. Existing local work and suspended worktrees are untouched. CI is not being waited on or monitored as requested.
Recover pending Forms and Permissions through a fixed presence-owned RPC in
the existing bundled plugin, without warming historical native Locations.
Validate established execution-host origin, complete coverage, directory/Git
ownership, WSL aliases and every placement before admitting capability.
Keep generic RPC forwarding closed and preserve non-authoritative failures.
Observe native compaction before event ownership routing and defer expensive
legacy discovery before inventory reads and at forwarding. Preserve concurrent
holds, bounded missed-end probes, exact settlement reconciliation grants,
per-kind mutation fences, global/idle Forms and settled-request tombstones.
Never replay ambiguous mutations. Share presence observations, not registrations
or execution authority.
Integrate current dev receipt and event-ownership changes. Reassert the native
connection after permission receipt preparation and before granting settlement
reconciliation or dispatching mutations. Reject overflowing raw JSON numbers,
including unknown metadata, without altering native numeric codec strings.
Use eight-directory UI batches with the unchanged request deadline and URL
budget rather than weakening ownership checks or extending timeouts.
Add scoped broker, reader, presence, proxy, compaction and UI lifecycle
regressions plus an opt-in isolated native reader fixture. Independent
Gatekeeper reviews are published on the PR; R1's numeric overflow finding is
fixed and rechecked on the final head before merge.
The private reader is qualified for native 2.0.22 / Effect rc.112 only. The
global minimum and already-recommended 2.0.22 remain unchanged. Unsupported
runtimes retain guarded legacy recovery. This mitigates CodeNomad's load
amplification, not the upstream Bus issue or previously retained Locations;
installed-application freeze resolution, deployment and daemon restart are
not claimed. Preserve bootstrap-warming and bounded-scan limitations.
## Summary
- Continue sparse history scans until a bounded result page is filled,
publishing matches progressively across sessions.
- Remove the automatic count traversal. Show page-local results and
messages scanned directly from search responses, with no scan when
opening an empty search.
- Project text-only content in SQLite, reduce bounded RPC round trips,
and share identical location checks only inside a request.
## Validation
- UI/server typechecks and targeted server/store tests passed.
- Chromium regression covers progressive results, pagination, workspace
scope, technical toggle, empty results and absence of statistics
requests.
- Isolated native OpenCode 2.0.22 fixture passed, including all 242
workspace matches across two sessions and pruning/ownership regressions.
- Synthetic benchmark: text search materializes 9.6 KB instead of 145
MB; CPU gain is modest because SQLite still parses stored JSON. See
dev-docs/SESSION_HISTORY_QUERIES.md.
## Review
Independent gatekeeper review and post-rebase validation in progress;
findings will be addressed before administrator merge.
## Summary
- Persist all permission decisions: allowed once, always allowed and
rejected, with request context and known reasons. Distinguish CodeNomad,
automatic Yolo and native settlements.
- Keep receipts visible alongside transcript messages even with hidden
tools; provide paginated source-less session receipts. Ownership-checked
bounded reads, atomic profile storage, deletion cleanup and stale-read
fencing.
- Enrich completed native question receipts with selected-option
descriptions, verbatim custom answers and a disclosure for other
choices. Translate labels in all ten locales.
## Validation
- Locked dependencies installed; server and UI TypeScript checks pass;
production UI build passes.
- 126 targeted server regressions during implementation, then 26
receipt/replier/service checks against the pinned client passed.
- 20 receipt/dock browser tests and 21 history navigation tests pass; 5
question decoding/copy tests pass.
- Rendered captures inspected at 393/1100px in light/dark, including
long text and pagination.
## Persistence boundaries
Native permission events are ephemeral: past lost decisions cannot be
reconstructed. Receipts are CodeNomad annotations outside native
search/copy/export. Storage namespaces follow execution host, native
root and authenticated channel; credential rotation starts a new
namespace. Bounded text excludes metadata/diffs.
## Review
Autonomous independent gatekeeper review will be published and repeated
until zero findings before the user-requested admin merge.
## Maintenance
Existing oversized files touched: server/http-server.ts (~2415),
server/api-types.ts (~717), server/index.ts (~707),
ui/message-section.tsx (~1566), ui/lib/api-client.ts (~650).
## Summary
Follow-up to merged #835: fix the demonstrated dependency behind real
`Instance event relay routing timed out` disconnects, not duplicate
connection notifications.
Existing diagnostics captured relay ownership blocked in `getWorktrees
-> WorktreeInventory -> POST /api/worktree/refresh`, including a refresh
pending beyond 150 seconds and a separate ~220-second completed call.
That exceeds the unchanged 60-second relay job deadline, so the shared
relay reconnects and Usage correctly clears for all projects.
Event authorization now uses a separate **registered-only** native
worktree inventory and never starts or joins native strategy discovery.
Native project/checkout checks, physical Git membership, clone
exclusion, configured roots, nested-folder and WSL projection remain in
the shared catalogue implementation. Native/local invalidation and
workspace disposal fence both inventories and their distinct
directory-cache namespaces. Ordinary request authorization and explicit
worktree discovery retain refresh and read-your-writes behavior.
Full-location checks receive the connection attempt's abort signal.
No timeout increase, swallowed reconnect, stale authorization fallback
or quota-specific workaround. FIFO lanes, ownership retries,
generation/workspace fences and retained-work budgets are unchanged.
## Validation
- Baseline-red production-manager + relay reproduction: hold discovery
unresolved and require the linked-worktree event to route before
releasing it.
- All **248 workspace tests pass**, including event order/reconnect,
ownership, no-Git, WSL, configured Git roots and inventory invalidation.
- Server TypeScript check passes.
- Isolated OpenCode **2.0.22** location/worktree/event fixture passes,
including real pre-refresh native registration and ordered real session
events during a held fixture-manager discovery request.
- Isolated no-Git native prompt/recovery fixture passes.
- `git diff --check` passes.
## Scope / limitations
The native refresh's internal delay is not claimed fixed; the relay no
longer depends on that unnecessary discovery operation. Actual transport
failures and other stuck native reads still trigger bounded
reconnect/reconciliation. Compaction and window-resize jank are not
established causes or fixed by this PR.
The installed application, shared daemon, user settings and independent
#824 worktree are untouched. This conversation remains attached to
`D:\CodeNomad`.
Existing oversized source touched:
`packages/server/src/workspaces/manager.ts`, approximately 1,260 lines.
No unrelated size-only refactor.
Independent Gatekeeper review will be published against the exact PR
head, with findings resolved and fresh passes until zero findings before
the requested administrator merge.
Generate positive, nonzero and canonical DER certificate serial numbers for both the local CA and server. node-forge encodes the supplied hex bytes as a signed ASN.1 INTEGER, so a random high bit previously produced a negative serial rejected by Go/Caddy. Normalize leading zero octets, add sign padding only where needed and handle the all-zero draw while keeping random 128-bit serial draws within the RFC 5280 size bound.
Renew existing negative/zero generated server certificates at HTTPS initialization while preserving a valid CA and existing client trust. If the generated CA itself must be replaced, also reissue the leaf and warn that clients must import the replacement CA. Keep valid generated credentials unchanged and leave explicitly supplied certificates untouched. Document startup repair and reverse-proxy trust implications.
Seventeen TLS tests pass on Node 24.20.0, including deterministic edge draws, actual DER encoding, signature/SAN checks, invalid serial migration, verified loopback HTTPS requests, CA replacement, reuse and provided/disabled behavior. The full server suite passes with 825 passed, six existing skips and zero failures; server typecheck and diff checks pass. No installed app, shared daemon or user certificates are changed. The reporter's physical macOS/Caddy setup was not directly tested.
Fixes#832.
Expose the approved active-account dropdown with persistent credential-keyed drafts and always-visible add/rename/remove actions. Enrich only native fallback labels with a sanitized Codex login while keeping all credential values server-side. Persist opt-in automatic selection for supported OpenAI OAuth accounts and admit one fresh-quota-verified native activation before the next prompt/custom command, with local manual/policy fences, ownership and deletion admission, no model changes, and no prompt or mutation replay. Preserve dev's Missions revert and document service-wide selection and external-client compare-and-set limitations. Validated both package typechecks, the UI build, 812 server tests, 865 CI-selected UI unit tests, isolated native 2.0.22 synthetic-account/YAML fixtures, and focused Chromium/native bridge regressions. Final admin merge explicitly requested by the user; platform/runtime/native checks are green while the general tests job is still in progress.
Revert merge c118478805 relative to its first parent after the user confirmed the merge was requested in the wrong conversation. Remove the published Missions plugin, control routes, UI, playbooks and packaging references; do not rewrite dev history or touch durable-refactor work in the separate missions-v2 checkout.
Preserve subsequent PRs #792, #829 and #830. Remove only #829's now-invalid Mission reader import, dismissal hook and dedicated reader scenario, retaining the native questions/permissions dock, file-preview navigation and its other tests. Keep the 2.0.22 package pin and parent-session creation fence.
Validation: revert applied without conflicts; all 139 original merge paths reversed; later-only paths retained except the three minimal interruption-dock integration adaptations. Server and UI TypeScript checks and 18 automation/plugin lifecycle/desktop resource tests pass using existing local dependencies. Staged diff checks are clean. Full hosted CI, browser suites and native 2.0.22 qualification were not rerun for this immediate user-authorized admin revert.
## Summary
Qualify **OpenCode 2.0.22**, align server/UI client and plugin pins, and
recommend this release. Keep the demonstrated **2.0.7** global minimum
and **2.0.20** Codex Usage feature-local requirement.
Block the new native `parentID` create variant in the workspace proxy:
upstream ignores the supplied location and inherits the parent's
directory. Require inspectable JSON objects to close opaque-body
bypasses. Root creation and the existing authorized fork route remain
available.
Started at `dev@0983db3c` (#828 Windows test harness), then integrated
`dev@97c361c3` (#789 Code Mode presentation). Conversation remains
attached to `D:\CodeNomad`; all work and tests use explicit separate
paths and synthetic data.
## Upstream audit: 2.0.21 → 2.0.22
- Authenticated native OpenAPI retains **116 paths**, with **11 schema
differences**: session creation gains optional `parentID`,
parent-not-found response/description; provider settings gain optional
`headerTimeout` and `chunkTimeout=false`; configured model capability
overrides become partial. No new proxy route or consumed mandatory API.
- Published declarations: **4/30 client, 2/60 plugin, 3/36 protocol,
4/102 schema** files change. Plugin session domains expose `remove` and
`compact`; CodeNomad does not add calls to them. Identifier namespace
export is additive.
- An isolated native fixture proves parent creation inherits the parent
location despite a different supplied directory. Mock and
production-proxy fixtures reject owned/foreign parents; malformed values
and opaque content types are covered before any native request. Owned
root creation stays available.
- Runtime changes include HTTP header/chunk/whole-response timeout
handling and bounded timeout retries, provider cache/error/tool-history
fixes, model capability defaults, and legacy MCP shutdown cleanup.
- Lock changes are limited to six `@opencode` packages and two workspace
entries. Integrity/dependency metadata matches independently installed
published packages; clean `npm ci --ignore-scripts` passes. Optional
OpenTUI peers are not installed by CodeNomad.
## Isolated local qualification
**Windows / Node 24.20.0**, isolated profiles, databases, services and
synthetic providers/credentials. No shared-daemon or personal-history
mutations.
- Previous **2.0.21 dependencies + runtime 2.0.22**: native
pruning/history/proxy acceptance passes.
- New **2.0.22 dependencies + runtimes 2.0.7 and 2.0.22**: seven suites
pass (automation, pruning/history/navigation, per-send environment,
inclusive forks, idle/busy side questions, blank-session cleanup,
Git-degraded recovery), plus explicit native proxy suites.
- Native/UI pruning acceptance passes through the committed parent
runner, with completion and actual child exit verified. This uses #828's
early dependency-import workaround, not the old late-import order. No
claim that underlying Windows heap corruption is repaired.
- Current compaction-isolation acceptance passes: session B progresses
while session A's provider response is held; bounded outline reads
retain daemon heartbeats. Fixture runtime selection is extended to
include 2.0.22; its assertions are unchanged. This supplemental fixture
was not qualified on 2.0.7 (explicit runtime selector rejects it).
- Native Codex Usage passes on 2.0.22 with synthetic OAuth/key
credentials and mocked quota HTTP; not a live-account/WSL test.
- Native migrations **2.0.3 → 2.0.22** and **beta-19271 → 2.0.22**
preserve full history/forks/inbox/provider selection.
- Packed standalone pruning plugin installed outside the repository
passes native acceptance.
- Native npm upgrade **2.0.15 → 2.0.22** passes; authenticated daemon
remains **2.0.15 / PID 43876** before and after.
- Full server run: **794 passed / 6 skipped / 0 failed**. Final guard
revision separately passes **68 focused server tests** and native proxy
suites on minimum/current. Aggregate runs use `--test-force-exit`.
- Targeted client/store/reducer/usage UI: **63/63** with
`--conditions=browser`, `--test-force-exit`, bounded timeout. Initial
broad UI run used the wrong Node conditions and hung at
`prioritized-read.test.ts`; only its owned processes were stopped. That
incomplete run is **not green**. The same prioritized-read tests pass
under the browser condition used by CI. No production fix is inferred
from this launch correction.
- **41 browser scenarios** pass: setup/install, auth recovery, tool
images, rendered Codex Usage and compaction responsiveness. Browser
tests do not use forced exit.
- Server/UI/Electron typechecks and production server/UI/plugin builds
pass. Revalidation after #789 integration and independent gatekeeper are
reported separately below.
Local results do not certify all real providers, Linux/macOS/WSL, or
installed Electron/Tauri hosts. Historical Windows import and Git
cleanup failures remain limitations, not repaired by this upgrade.
Remote CI is not continuously monitored and no global CI-green claim is
made.
Size note: existing `packages/server/src/server/http-server.ts` is
~2,359 lines;
`packages/server/src/server/__tests__/instance-proxy.test.ts` is ~1,139
lines. Changes are narrowly scoped; no unrelated size-driven refactor.
## Independent gatekeeper
Review launched on exact head `0a7615476034eabbff54967aacc8a93ab0e6ab12`
against `dev@97c361c33f6fa7de30be5dde31c0e26e12bab574`; verdict will be
published before any admin merge. Findings will be corrected and
reviewed again until zero actionable findings.
## Behavior
Global/Project websearch choice, inherited/default, disabled and
automatic/provider selection. Display effective native configuration.
Optional global API keys use native integration/credential endpoints;
environment credentials remain read-only. Scoped failures reconcile
without mutation replay, and late results are fenced.
## Contract adjustment
OpenChamber's /api/config/websearch is its backend route. OpenCode
2.0.18 has no equivalent native config write API. Reuse CodeNomad's
authorized plugin-control configuration targets, JSONC conflict-safe
edits, WSL filesystem adapter and connection/deletion fences. Preserve
unrelated fields and comments; use native watching, never implicit
location.reload.
## Validation
Server/UI typechecks pass. 51 focused server/config regression tests
pass; four real-WSL cases skipped. Real Chromium fixture passes scoped
writes, failure reconciliation, API-key clearing and late mutation
fencing; narrow capture inspected. Isolated native fixtures pass on
2.0.7 and 2.0.18 (global watching, project document persistence/reset,
foreign-directory rejection). Project discovery is disabled in native
fixtures to exclude user ancestor config; deterministic server tests
cover precedence. No shared daemon or personal data used.
## Stack/review
Depends on #791, zero findings at ea3b4ef6. Independent gatekeeper
pending; fix/re-review until zero. User requires all PRs remain
unmerged.
Size notes: existing http-server.ts (~2300), api-types.ts (~1200),
plugin-controls.ts (~810), api-client.ts (~1000) and locale settings
files exceed guidance; focused changes only.
## User-feedback correction
Clarify which search provider agents use, automatic saves, the default
across projects and the current-project override. Move API keys into a
separate collapsed section explaining that credentials are shared
service-wide and saving a key does not change the selected provider.
Environment credentials are explicitly read-only. Updated in all ten
locales; narrow Chromium lifecycle/failure test and UI typecheck pass.
Alpha in fixture captures is synthetic test data.
Aggregate compaction fragments before reactive SDK reduction while advancing
revision fences immediately and preserving native terminal and snapshot
authority. Keep task-tool shells keyed across payload updates and rescan bounded
membership so removals and replacements cannot leave phantom tools.
Isolate SSE callbacks and decode/dispatch diagnostics. Subscriber-local teardown
no longer destroys the healthy shared native client. Install HTTP cancellation
before preflight and fence late continuations without replaying or interrupting
already-admitted mutations. Preserve ownership and environment admission checks.
Move HTTP password derivation to async scrypt with serialized password changes
and login-authority fencing. Yield cooperatively in both structural-index phases
without changing snapshot/digest protocols; an individual SQLite step stays sync.
Add isolated red/green regressions, bounded browser/native qualification scripts,
independent reviews, source fingerprints and performance evidence for issue #824.
Synchronize the Git focus assertion with its async contract and make the opt-in
trace self-contained instead of serializing a tsx helper into the browser.
Validation includes 793 passing server tests and 6 skips after replay, UI/server/
Electron typechecks, UI/server/plugin builds, and private Windows native 2.0.21
fixtures. Renderer fixture median main-thread cost is 324.57 to 16.94 ms.
The latest full browser run remains 358 pass, 1 fail, 1 skip: its trace failure
was subsequently reproduced and corrected with a minimal Chromium check, but
the full suite has not been rerun. Store assertions use force-exit; natural
cleanup and Linux Electron to Windows LAN/HTTP with 2.0.19 remain unqualified.
Publish as a draft for review, not a universal resolution or issue-closing fix.
Refs #824.
Integrate current dev while preserving the mission routes, durable execution controls and specialist cleanup. Retain native usage route dependencies and align local plugin dependencies and architecture guidance with OpenCode 2.0.21.
Combine the workspace file reader with the mission reader in the central session surface. Explicit reader selection dismisses the competing preview without losing stored editor drafts or the composer. Extend the real-session browser regression to cover switching between both readers.
Validate server and UI typechecks and all ten mission browser/i18n tests. Preserve the upstream Tao patch unchanged, including its original whitespace and provenance.
## Summary
I separated the connected CodeNomad server's environment from the client
information shown in Settings and diagnostic exports.
- The existing metadata endpoint now reports the backend process OS and
Node runtime architecture, independently of the browser's user agent or
OpenCode host.
- Server OS and architecture appear in the server information card.
Client runtime, platform and OS are explicitly labeled as client
information in all ten locales.
- Copied and downloaded diagnostics contain both environments. Older or
unreachable servers never fall back to the client's OS.
## Validation
- 761 server tests passed, with six platform skips.
- 14 targeted UI tests passed, including four real-component browser
scenarios for web, Tauri and Electron runtime fixtures, copy/download
exports, metadata refresh and older/unreachable servers.
- Both typechecks, all ten locale index checks, the server/UI build and
diff checks passed.
- I have not validated a physical remote Debian host or a native macOS
desktop build.
Existing oversized files touched: `packages/server/src/api-types.ts`
(~680 lines) and `packages/ui/src/lib/i18n/messages/*/settings.ts`
(~660–680 lines).
Flatten Mission Control into compact top-level rows with two-line objectives, semantic state colors, direct readers and coordinator navigation. Put Work first, collapse secondary sections by default, and retain per-window reader and disclosure state.
Create UI missions in a prepared state and use one Play button for start/resume alongside Pause and terminal Stop. Persist explicit control intents and per-target receipts, serialize them with mission admissions, and use the authenticated desktop bridge for native root-session interruption and environment-fenced resumption. Park report notifications while paused, cancel mission-owned queued inputs on Stop, and prevent stale retries from reopening terminal missions. Native descendant suspension remains outside these root-actor controls.
Add opt-in deletion of mission-created specialist conversations. Persist cleanup targets and receipts, reserve journal capacity, and validate ownership through a narrow cleanup authority RPC before native HTTP removal. Preserve coordinators, reused/shared/moved sessions and roots with children; partial failures keep stable explicit retry identities.
Validate with 88 focused server tests, 10 browser/i18n tests, server and UI typechecks, the full build and an isolated OpenCode 2.0.21 fixture covering Play/Pause/Resume/terminal Stop, cleanup and transcript preservation. Inspect rendered controls and document the lifecycle, cleanup and styling conventions.
Keep the Usage panel mounted when streaming session metadata replaces the active session object. Deduplicate equal request identities without suppressing revalidation of actual instance, session, native directory, provider or model changes. This removes the repeated loading/unavailable flashes and quota reads while retaining native account, reconnect and late-response fences.
Expose only a sanitized feature-local reason for a missing native credential-list endpoint and translate the actionable service-version message in all locales. The global OpenCode minimum stays at 2.0.7; Codex Usage alone requires 2.0.20. Authentication/other errors remain generic, no legacy credentials are substituted, and service restart remains explicit.
Validation includes generated-client and HTTP route status regressions, real Solid panel lifecycles for available/unavailable usage, session identity transitions, 760 passing server tests with six platform skips, neighboring UI and desktop-resource checks, server/UI typechecks and build, and an isolated native OpenCode 2.0.20 fixture using synthetic credentials and mocked quota HTTP.
An independent published gatekeeper review of the exact head found zero actionable findings. The reviewer independently passed 71 targeted tests, exercised extra scope/lifecycle browser probes and checked all ten locales. No native desktop or live account/quota validation is claimed.
## Summary
Unify the right-panel Git and file surfaces as **Files**, with a compact
**Workspace / Changes / Commits** switch and a shared central preview
above the
conversation composer.
- Workspace: lazy, keyboard-accessible directory tree; read-only source,
Markdown and image previews; bounded binary-file fallback.
- Changes: indexed/working-tree files and central diffs, with existing
Git
mutations kept in a collapsed actions section.
- Commits: paginated history of the browsed worktree, commit
details/files and
first-parent diffs, including root commits, renames, deletions and
gitlinks.
- Preserve drafts and mode navigation; fence late responses across
session and
worktree changes. Migrate previous tab customization and retain
diff/wrap
preferences. Bundle Monaco tokenizers locally for offline highlighting.
- Worktree browsing does not move a conversation or check out a branch.
## Implementation
The common Solid UI is used by Electron and Tauri. New file previews
reuse the
directory ownership boundary and bounded filesystem reader. Historical
reads use
worker Git commands with full-hash validation, authoritative file
membership,
bounded command output/time and snapshot-based paging. The old sidebar
editor
and split viewer are retired. See `dev-docs/FILES_PANEL.md`.
## Validation
Before rebasing onto current dev:
- Server, UI and Electron typechecks passed.
- Server/UI and Electron builds passed.
- 20 focused unit/route tests passed, including real isolated root and
linked
repositories, preview bounds and directory ownership.
- 12 distinct browser scenarios passed: 5 Files flows (including real
SessionView/composer, Markdown/images/source and RTL keyboard
navigation) and
7 existing Git lifecycle regressions.
Post-rebase validation, independent gatekeeper reviews and the Windows
Tauri
test build will be recorded below as they complete. This PR is intended
for
interactive validation before merge.
## Summary
I confirmed #812: the proxy removes the native missing-session tag
during ownership preflight, so the existing frontend cannot skip an
unavailable parent.
I preserved the sanitized `SessionNotFoundError` response (`_tag`,
requested `sessionID`, `message`) and HTTP 404. No UI behavior change,
parent rewrite, session deletion, ownership bypass or raw upstream error
forwarding is needed.
## Validation
- The proxy regression fails on the original generic response and passes
with the fix; it covers direct/nested reads, deletion admission,
generated-client decoding and unrelated errors.
- The real UI session-list store reproduces failure with the old
response, recovers valid families beside an orphan on repeated
refreshes, and still surfaces authorization failures.
- Full server suite: 754 passed, six platform skips, no failures.
Focused UI tests: 27 passed. Both typechecks and diff checks passed.
- These are isolated synthetic fixtures, not a reproduction on the
reporter's Linux/Tauri installation. No shared daemon or user history
was accessed.
Closes#812.
Maintenance note: existing `packages/server/src/server/http-server.ts`
(~2,319 lines) and
`packages/server/src/server/__tests__/instance-proxy.test.ts` (~1,117
lines) exceed the repository size guidelines; no unrelated refactor is
included.
Align server/UI client and bundled-plugin pins with OpenCode 2.0.21 while keeping the demonstrated 2.0.7 application minimum and the separate 2.0.20 Codex Usage requirement. The native contract changes only by optional form-cancellation text, so existing callers need no production adapter or proxy expansion.
Extend recommendation/status coverage and update maintained architecture and compatibility references. Scope the lockfile to published OpenCode packages, including optional OpenTUI peer metadata, without refreshing unrelated dependencies.
Qualify minimum/current native suites, generated cancellation with and without a message, selected native Codex credentials, ordinary pruning/UI acceptance, standalone plugin, historical migrations and isolated upgrade retaining daemon version/PID. Typechecks, builds, 71 UI tests and 32 browser cases pass. Preserve the full server suite cleanup EPERM and its successful focused rerun as separate evidence rather than claiming a fix.
## Summary
I replaced Codex Usage's legacy auth-file reads with the connected
OpenCode V2 daemon's selected ChatGPT OAuth credential. This addresses
the stale-file mismatch described in #808 without guessing WSL
credential paths or substituting another account.
- Resolve the provider integration in the owned session's native
location; use only its selected active credential and native accountID.
- Keep credentials server-only, OAuth refresh native-owned, and
credential export/generic RPC blocked through the browser proxy.
- Fence warm and pending quota results on account changes, reconnects
and session movement; scope the visible panel to its instance/session.
- Bound quota HTTP, reject redirects and sanitize errors. No SQLite
access or legacy/Codex CLI fallback.
The credential-list API requires OpenCode 2.0.20 for this feature only.
Older runtimes, expired native tokens and non-ChatGPT connections fail
closed; the global application minimum is unchanged. Other providers'
credential integrations are outside this focused fix.
## Validation
- Server/UI typechecks; 85 server tests; five UI unit tests; three
rendered browser scenarios; UI build and diff checks passed.
- A fresh native 2.0.20 Windows daemon with synthetic credentials
exercises the production adapter: selected OAuth/accountID, key-account
switch invalidating a warm snapshot, and recovery despite stale
auth.json. Quota HTTP is mocked; no shared daemon or real credentials
are used.
- This fixes the confirmed integration mismatch, but I have not
reproduced the author's real WSL/live account failure.
Closes#808.
Maintenance: existing `packages/server/src/server/http-server.ts`
(~2,317 lines) and `packages/ui/src/lib/api-client.ts` (~613 lines)
exceed the source-size guideline; their wiring changes remain small.
Synchronize server/UI client and plugin pins with OpenCode 2.0.20 while retaining the demonstrated 2.0.7 step-timestamp minimum. Review the authenticated runtime contract: existing routes remain stable, while credential operations and optional connection/error metadata are added without requiring production adapters.
Protect the workspace proxy boundary with credential export/create rejection coverage and verify optional provider response bodies survive UI normalization. Update the maintained compatibility and architecture references, including explicit native service startup with the new disabled setting and the unresolved historical Windows import failure.
Validate minimum/current native runtimes, ordinary pruning/UI acceptance, standalone plugin installation, historical migrations and native npm upgrade with daemon version/PID preservation. Clean-install the scoped lockfile and revalidate typechecks, production builds, 745 server tests and 66 UI tests; browser qualification covers 30 scenarios.
Align server/UI client and bundled plugin pins with OpenCode 2.0.19 while retaining the demonstrated 2.0.7 timestamp minimum. The authenticated native schema and published declarations preserve the consumed API contract; runtime improvements concern compaction, context limits, provider cache affinity and Shell conventions.
Extend setup version coverage and update the maintained compatibility and architecture references. Add per-import native/UI fixture diagnostics after late Vite loading stopped on both the new runtime and the 2.0.18 control; do not claim that eager-import diagnostic acceptance fixes that failure.
Qualify both minimum/current native runtimes, historical migrations, isolated npm upgrade without daemon restart, standalone plugin installation, UI/browser behavior and production bundles. Retain the original Windows fixture failures and their bounded diagnostic results in the PR evidence.
Carry dev's backend Git availability advisory into mission assignment and report admission. Refresh only the owned native instruction under the existing worktree fence, after profile environment synchronization, and clear stale context after Git recovery. Advisory failures remain non-blocking while cancellation and connection retirement still prevent native input.
Cover missing Git for actors and coordinator reports, recovery cleanup, advisory failure and cancellation/retirement fence release. Targeted route tests and server typecheck pass; the complete isolated OpenCode 2.0.18 mission fixture passes and independent merge re-review reports zero remaining findings.
Integrate dev into the Missions PR without rewriting its reviewed history. Retain mission CRUD routes, authenticated report admission and the 512 KiB bridge limit alongside inspected-window automation and plugin controls. Keep dev's canonical transport, clean builds and 2.0.18 client/plugin dependencies; align the local plugin contract check with the same SDK.
Combine architecture guidance and preserve the technical runtime minimum of 2.0.7. Keep the isolated Missions fixture in the latest-runtime CI lane because its test-only ctx.tool.list driver is absent at that minimum; do not reintroduce legacy compatibility paths.
Validation: server, UI and plugin-contract typechecks; full server/UI/plugin build; 84 backend/compatibility/packaging tests; 59 UI/persistence/browser tests; isolated OpenCode 2.0.18 Missions fixture and workflow YAML parsing. Merge resolutions have no conflict markers or diff-check errors relative to dev.
Keep live task ancestry and replacement filtering while deduplicating candidate implementers by native session identity. Several completed implementation steps in one root can now receive their resolver without weakening ambiguity rejection between distinct actors.
Add helper coverage and a full Pocock artifact-driven regression exercising delegation, resolver replacement and revision through the shared implementer. Validated 46 combined backend tests, server typecheck and the rebuilt Missions plugin.
Declare expected mutation rejections in the native RPC contract and return them through the invocation error API. Map structured business codes to conflict, missing and ownership responses so stale editors can request a reload instead of reporting an unavailable plugin. Unexpected exceptions remain opaque 503 failures.
Extend the isolated OpenCode fixture through the real WorkspaceManager and HTTP routes to verify stale update/delete, create/update/delete request-ID conflicts and unknown missions. Observed native 503 before the fix and 409/404 after it; targeted route/plugin/reload tests and server typecheck pass.
Recover durable report notifications that were saved before a bridge outage prevented coordinator admission. Reuse native message identities, honor journal acknowledgements and lifecycle fences, and retry only notifications through the authenticated environment-aware bridge. Nonblocking single-flight retries use bounded backoff and rotating batches without dispatching tasks.
Show pending coordinator notification separately from task completion in Mission Control, with all locales aligned. Derive managed actors from immutable task identities, resolve Pocock implementers through live task ancestry, and normalize dependencies for both new and historical idempotent requests.
Validated 53 backend regressions, server and UI typechecks, UI and plugin builds, six real-component browser scenarios, locale parity, and an isolated OpenCode 2.0.18 fixture proving idle/busy resumption and automatic outage recovery with and without restart. Native replay retains one correlated report without another coordinator wakeup.
Share project mutation and append queues across content-addressed plugin incarnations so disposal cannot let competing revision checks overwrite history. Keep in-flight operations exclusive until settlement.
Raise assembled bridge text bounds to accommodate maximum XML-escaped objective and task fields within the existing HTTP body bound. Exercise real authenticated HTTP admission with XML, JSON-control and multibyte expansion.
Observe both regressions failing before their fixes, then passing with the focused bridge suite and server typecheck. The isolated OpenCode 2.0.18 fixture now proves reports reach an actual provider request for idle and busy coordinators instead of treating session idle as proof of consumption.
Make Mission Control actionable with create/edit/delete, persistent disclosures and selection, task dependencies, native attention requests, execution comparisons and a long-content reader above the mounted transcript. Preserve drafts and native per-window layout, and arbitrate browser/reader gestures without losing the preview target.
Add coordinator-only mission.revise with revision CAS, idempotent replay, linked replacements and explicit dependency changes. Retain withdrawn task contracts and late reports, require terminal settlement for outstanding native admissions, and attribute human metadata edits in the bounded history. Mission deletion tombstones the map without deleting conversations.
Cover lifecycle and revision semantics with backend regressions and the isolated OpenCode 2.0.18 fixture, including the repaired authenticated late-report notification. Validate real Solid UI restoration, editor retry identity, native background Forms, transcript/draft preservation, layout cleanup and ten-locale parity. Record Kandev research, scope decisions and separate follow-up opportunities.
Live multi-agent research exposed a second timeout after unrelated workspace waits were removed: the actual owner's validated linked-worktree inventory can take about 18 seconds when cold. Give mission discovery a bounded 30-second probe deadline instead of the five-second interactive browser deadline.
Keep browser discovery unchanged and continue probing for competing backend owners before admitting any mission input. Add a regression with ownership validation exceeding five seconds and verify a second owning backend prevents another admission.
Validated ten automation tests, server typecheck, bundled Missions build and the isolated OpenCode 2.0.18 native fixture. Loaded the updated bundle through the installed desktop lifecycle and successfully resumed the same previously blocked UX assignment without a duplicate actor or task.
Resolve desktop bridge ownership as soon as one workspace validates the session instead of waiting for every inventory. Probe mission admission candidates concurrently so an unrelated stalled connection cannot delay a verified owner.
Keep authenticated bridge discovery, cross-backend ambiguity rejection, durable contract checks, execution selection, worktree fences and per-send environment admission intact. Duplicate logical tabs still share their backend profile.
Add regressions for stalled unrelated ownership and connection checks. All eight route tests and server TypeScript compilation pass. Verified the installed Windows Tauri backend reconnects and accepts the original durable assignment after the fix; ownership probing dropped from roughly 13 seconds to 0.46 seconds.
Provision codenomad.missions through connected-daemon discovery and independent backend presence instead of requiring a source plugin in every project. Bundle the integration for Electron and Tauri, retain project-scoped mission journals across shutdown, and use the same secondary surface as Status.
Complete the existing native actor execution work: persist explicit agent/model/variant choices, validate catalog selections and avoid switching busy actors. Admit assignment and report writes through the authenticated desktop bridge with durable-contract verification, session ownership, connection and worktree fences, and per-send profile environment synchronization.
Advance the older source branch client/plugin pin to 2.0.11 and retain its bounded runtime metadata adaptation. The isolated 2.0.16 mission fixture passes native catalog, selection, busy queues, conflict, environment, reports, reconnect and idempotence checks. Server, UI and plugin typechecks, 31 mission tests, 10 lifecycle/transport tests and six resource-layout tests pass.
Align server/UI client and bundled plugin pins with the latest stable runtime while preserving the demonstrated 2.0.7 timestamp minimum. Review the published declarations and authenticated native schema: pairing and Shell signal additions require no CodeNomad API adaptation.
Make the isolated native upgrade fixture follow the recommendation while retaining its 2.0.15 source boundary and live-daemon PID assertion. Extend setup version coverage and update the current compatibility and architecture references.
Validate both minimum/current native runtimes, historical migrations, server/UI tests, setup and tool-image browser scenarios, typechecks and production bundles. Record the intermittent Windows Node pruning/UI heap exit and successful diagnostic rerun without claiming its cause is fixed.
## Summary
- Update the main README for the shared OpenCode V2 service, current
features, managed desktop setup, minimum/recommended OpenCode versions,
and explicit service restart behavior.
- Correct release links, actual Electron/Tauri artifact formats and
architectures, Node guidance, remote authentication and SideCar
configuration fields.
- Align server and contributor documentation with the 0.20 baseline.
- Replace the old hero screenshot with a current 1600x900 workspace
rendered using real Solid components and synthetic demo data.
- Include a reproducible Chromium capture script and provenance notes;
external traffic is blocked and no user backend, daemon or provider is
used.
## Preview
## Validation
- UI typecheck passes.
- Chromium capture passes transcript, connected-state, agent, timeline
and MCP readiness checks, with no uncaught renderer errors.
- Resulting image inspected visually.
- 20 local Markdown/image targets verified.
- Staged git diff --check passes.
Regenerate with: node packages/ui/scripts/capture-readme.mjs
Documentation and capture tooling only; CI is not being monitored.
## Summary
Fix the first-install recovery dead end observed in CodeNomad 0.20.0 on
Windows 11. npm failed to install the optional Windows binary packages,
then removed the CLI package while leaving terminal shims behind. These
shims disabled installation admission and hid the install button; later
status refreshes also erased the action error.
Recognize only the exact npm-generated orphan shim in the selected user
prefix with a missing canonical executable. Preserve custom-wrapper,
foreign-prefix and existing-binary authority checks. Keep action
failures visible across refresh and reopening.
## Validation
- 34 targeted updater/installer regressions passed.
- 21 browser setup regressions passed.
- Server TypeScript check passed with locked dependencies.
- On the affected machine, isolated package download and executable
validation succeeded without Git. Explicitly authorized repair using
bundled npm succeeded; the user confirmed CodeNomad now opens folders.
## Distribution
The maintainer explicitly requested replacing the existing 0.20.0
desktop release assets rather than creating 0.20.1. This branch is based
on v0.20.0 and preserves its version; the PR build artifacts will be
used for that revision after validation. The release notes will record
the source commit, and WinGet will receive a separate same-version
installer hash correction. No npm version republication is intended.
Co-authored-by: Shantur Rathore <i@shantur.com>
## Summary
Prepare the stable 0.20.0 version on top of `dev@25e07c74` before the
release PR from `dev` to `main`.
- Align the root, server, UI, Electron and Tauri npm versions and
workspace lock metadata to `0.20.0`.
- Align the Tauri Cargo manifest, Cargo lock entry and native config
version.
- Require CodeNomad server `0.20.0` in the remote UI manifest: the new
V2 frontend cannot use the old 0.19.x V1 backend contract.
- Leave the dependency graph unchanged.
The stable publication workflow reads the root version on a push to
`main`; this preparation PR targets `dev` and does not publish the
stable release.
## Validation
- Clean locked dependency installation in an isolated release worktree.
- Version consistency assertions across npm manifests, lock metadata,
Cargo and Tauri config; dependency graph comparison against the parent
commit.
- `npm run sync:version --workspace @codenomad/tauri-app` confirms all
native versions are already aligned.
- UI, server and Electron typechecks pass.
- UI production build passes.
- Remote UI selection and dev-release channel tests pass (3 tests).
- `git diff --check` passes.
Native installers and the cross-platform release matrix have not been
rebuilt locally in this preparation pass. No CI monitoring is started.
## Summary
- Add narrow CodeNomad routes for native OpenCode V2 plugin inventory
and activation-rule mutations.
- Present one row per user/configured plugin with exactly two compact
**Global** and **Project** switches, sharing Yolo/MCP switch geometry.
Builtins are hidden; exact configured disabled IDs remain available.
- Keep complete names, source paths, failures and configuration targets
readable on narrow keyboard/touch layouts. Retain focused rows across
refreshes and guard repeated pending activation without removing
keyboard focus.
- Provide translated feedback in all ten locales and suppress stale
feedback after the owning surface is disposed.
## Authority and refresh behavior
- Discover roots through the authenticated daemon's `config.get`, after
native-location ownership and connection-generation checks.
- Append only exact activation rules while preserving JSONC comments,
source options, unknown keys, formatting, BOM and native permissions.
Bound reads, check optimistic conflicts, serialize by write target and
use atomic replacement with nonce-owned locks.
- Require proven raw/normalized alignment before acknowledging a no-op.
Watcher lag cannot report success for a rule that is no longer saved on
disk.
- Account for inherited `.opencode` precedence by choosing a
higher-precedence target in the active project location; preserve
ancestor files and reject an escaping fallback target.
- Use native WSL filesystem operations. Retain canonical invalidation
and one trailing reconciliation when host/native cache records converge.
- Cache display snapshots by instance/worktree, share them across
sessions in that worktree, and refresh only on visible demand. Global
writes invalidate sibling snapshots without background reads.
## Compatibility
The current server/UI/bundled-plugin dependency pin and recommended
runtime are **2.0.16**, aligned with `dev`. The demonstrated technical
minimum remains **2.0.7**. Activation writes use the narrow local JSONC
operation rather than a runtime-specific write endpoint.
## Validation status and provenance
Final reviewed head: **`5204d97694ca8ced954bddc9cc94ea464e46119d`**,
aligned with `dev@9d7ea5d6`. Both independent resumed review loops
reached **ZERO actionable findings**: UX R6 and quality/optimization R5.
Local validation on the final head: **100 plugin/server/cache/WSL tests
passed**, **eight real-component browser regressions passed**, **14
restoration/metadata integration tests passed**, server/UI typechecks
and UI production build passed. Translation keys/placeholders match
across all ten locales. The current-dev baseline and PR browser
comparison passed the same 34 shared cases with one optional native
Electron skip; detailed revision provenance is in the final review
comment.
**CI qualification is excluded at the user's explicit request.** No
final CI success is claimed, and CI completion is not being awaited.
The earlier head `38845060` failed typechecking because `noticeId` was
undeclared; the earlier historical UX R4 zero-finding claim was also
incorrect and has been [explicitly
corrected](https://github.com/NeuralNomadsAI/CodeNomad/pull/726#issuecomment-5816956417).
Historical test results and the installer built from `bd31dcd0` are not
validation or artifacts of the final corrected head. See the final
review comment for completed counts, review evidence and revision
boundaries. The PR remains open.
## Scope note
Implemented independently; no code was copied from PR #593.
This separate V2 implementation supersedes PR #593.
Use one Attach file action for native device selection and retain project-scoped @ references in the active session worktree. Remove the duplicate upload entry and composer server browser, document the outside-project scope change, and translate attachment origins and feedback across all locales.
Share serialized, bounded byte ingestion across picker, drop and clipboard. Fence open pickers and late reads across session/worktree/lifecycle changes, preserve edits and newer selections without stealing focus, release rejected-read budgets, and restore failed custom-command drafts by attachment identity. Validate project directories through existing workspace ownership before filesystem listing/search.
Cover the behavior with 20 attachment and 11 session-aside browser scenarios, attachment/submission/persistence units, server budget/proxy/ownership regressions, and isolated native Windows picker fixtures. Three independent review passes corrected five P2 findings and ended at zero; the final merged-head review confirmed that result. UI checks/build, Tauri release build and native picker smoke passed. Remote CI was still in progress at the explicitly requested admin merge.
Align the server/UI client, bundled plugin and recommended runtime at 2.0.16 while retaining the demonstrated 2.0.7 minimum. Verify the real generated-client detailed errors without duplicate proxy prefixes or failed mutation replay; retain explicit installation and daemon restart boundaries.
Independent gatekeeper audited all 63 upstream commits and the full comparison, published packages, native consumers and targeted regressions: zero actionable findings. Native pruning/UI and historical migrations pass across Windows, Linux and macOS; minimum/current runtime contracts and dedicated Tauri jobs pass. Generic browser failures were independently reproduced on the exact 2.0.15 base and documented in the published review. Admin squash merge explicitly requested by the user.
Delegate verified shared npm updates from OpenCode 2.0.15 onward to the native CLI with bundled Node/npm, a scoped prefix and registry, and Windows running-image retention. Preserve first-install and older-migration preflight, version/launcher verification and explicit daemon activation.
Retain installation ownership and the temporary adapter if an outer timeout, signal or output limit leaves descendant exit uncertain. Allow native timeout cleanup to finish and preserve original failures.
Validated with 37 targeted updater/route regressions, server typecheck, isolated live Windows 2.0.15-to-2.0.16 qualification, and a successful NSIS build/install of the initial implementation. Independent gatekeeper review found one timeout issue; the second pass after correction reported zero findings. Administrator merge explicitly requested by the user; final-head remote CI is still running.
## Summary
Retire the prerelease private OpenCode installation completely as an
executable source. Automatic selection now uses PATH and the
conventional shared user npm installation. Existing private files are
neither migrated nor deleted.
- Remove the private installer, receipt reader and fallback
introduced/retained by #756.
- Ignore saved private selections and reject validation/launch from
`~/.local/share/codenomad/opencode`, including private PATH entries.
Prevent installation into that retired prefix.
- Remove private-copy descriptions from all ten locales and update the
runtime policy documentation.
- Keep supported custom installations, native shared-service
ownership/authentication and explicit restart behavior.
## Reproduction and scope
The initial genuinely empty-profile test passed, but it did not match
the affected machine: that machine had no Git and retained a private
prerelease OpenCode copy.
On the exact installed `v0.20.0-dev-20260923-baf674fc` Tauri artifact,
seeding a valid private copy plus its `selected` receipt and `current`
marker makes setup report `state: ready`, `installationSource: legacy`,
and suppresses the missing-installation screen. The new desktop
regression fails against that release with `ready !== missing`.
With rebuilt server/UI resources in an isolated copy of the same Tauri
host, the identical private-copy scenario reports missing, offers
installation, installs the shared npm package, authenticates OpenCode
2.0.15 and resumes the requested folder without Git. This demonstrates
the missing-setup cause; it does not claim to explain every initially
reported startup slowdown.
## Validation
- 59 targeted server tests passed: discovery/install/update, retired
paths, binary selection, Windows/WSL spawn and binary validation routes.
- 13 real-component setup browser tests passed.
- 23 focused retirement/launch tests passed after the final network-path
preflight adjustment.
- UI TypeScript check passed; production server/UI/automation/pruning
build passed.
- Installed-release private-copy reproduction failed as expected;
corrected isolated Tauri acceptance passed.
- `git diff --check` passed.
Desktop qualification uses isolated profiles, services and databases.
The sole simulated installation side effect is HKCU PATH registration,
captured by a fixture preload; bundled npm installation, package
verification, native-parent service start and authenticated API checks
are real. The shared user daemon and installed application were not
replaced by the fix. Remote CI is pending.
## Maintenance notes
Existing oversized files touched: `packages/server/src/api-types.ts`
(~583 lines) and `packages/ui/src/lib/i18n/messages/*/settings.ts`
(~625–639 lines). No size-only refactor is included.
Prefer terminal PATH and a common user npm installation, migrate historical private and official npm copies, and retain explicit authority for custom and WSL executables. Preserve running daemon ownership and defer locked Windows updates. Align recovery and settings presentation across locales.\n\nReviewed through an independent gatekeeper loop (final zero-finding review on e33a6a16). Validated 34 targeted server tests, 13 browser scenarios, typechecks, isolated Windows npm installation and real historical migrations. Full CI browser job has unrelated existing system-message search failures reproduced locally; merge requested with administrator authority without waiting for CI.
## Summary
Follow-up to #750: Git is a prerequisite for full CodeNomad
functionality, but its absence must not prevent users from consulting
their agent and asking it to help with installation.
- Keep workspace startup and ordinary conversations available without
host Git. Only the explicitly opened physical directory authorizes
sessions in this mode; do not infer sibling worktrees from native
project IDs.
- Preserve Git/worktree operation requirements and return an actionable
`git_required` failure for those operations.
- Inform the agent via the owned native `codenomad.git-availability`
instruction before prompts/custom commands. Include the backend platform
and distinguish the backend account from WSL/remote agent execution.
Remove the entry once Git is available, while preserving other
instruction keys. There is no Git setup UI or installation gate.
- Keep deletion admission safe across Git availability transitions by
draining/blocking overlapping ancestor and descendant directory
identities.
- Narrow initial project-wide session lists to the opened directory in
degraded mode; reject existing project-scoped cursors rather than
reinterpreting their native pagination scope.
- Teach the UI session inventory to request exact-directory pagination
for degraded roots while retaining unknown repository membership. Owned
children with inaccessible parents remain local display roots,
preserving their native parent metadata; worktree selection is
unavailable until Git recovers.
- Bound advisory context synchronization independently from fail-closed
profile-environment synchronization. An advisory timeout does not replay
or prevent the original send; disconnect and runtime-generation fencing
still apply.
## Validation
- Targeted server regressions cover real workspace-manager/proxy
admission without Git, foreign/child/alias directories, initial lists
and native cursor scope, worktree operations, deletion fencing,
environment admission and advisory timeout.
- Existing workspace lifecycle, inventory, native Git-worktree identity,
directory-authorization and worktree-deletion route suites pass.
- Real isolated OpenCode **2.0.7 and 2.0.15** fixtures: Git absent from
both backend and daemon PATH; project open, session creation,
instruction synchronization, prompt admission, model request containing
degraded context, assistant reply, and removal of stale instruction
after backend PATH recovery. Private databases and a local synthetic
provider only.
- Server/UI TypeScript checks and production server/UI/plugin builds
pass. Generated-client prefix regression also passes (bounded Node test
runner for its retained UI handles).
- Added no-Git unit/native qualification to the existing
Linux/Windows/macOS compatibility workflow. Local native runs were on
Windows; cross-platform CI outcomes are reported separately.
- Final UI coverage: 88 store/tree/startup/authority tests, 13
worktree-browser tests, and 43 transcript/session-rendering browser
tests pass.
The earlier #751 instruction-proxy correction remains necessary and is
covered by its existing regression tests. This change addresses the
separate missing-Git admission failure.
Validation includes isolated minimum/current native suites, historical migrations on Linux/Windows/macOS, targeted unit and browser tests, production builds and two independent gatekeeper reviews with zero actionable findings. Retain startup diagnostics for an unexplained intermittent Windows pruning/UI process exit; the complete instrumented Node 24.20.0 rerun passes locally. Known system-message search fixture timeouts remain documented. Admin merge explicitly requested; runtime activation and desktop installation remain separate actions.
Gatekeeper loop complete with zero findings after two rounds. Validated against an isolated OpenCode 2.0.14 daemon, 49 server and 53 UI targeted regressions, and full typechecks. CI retains documented pre-existing migration and search failures.
## Summary
Restore saved conversations promptly with the Git panel open. Preserve
Solid project-shell identity during metadata and sibling-project
restoration, defer inactive Git readers, and keep foreground message
requests independent of secondary HTTP fan-out.
Publish the visible project's recent worktree conversations from its
first verified page, before historical pagination completes. Promote
project/location and worktree membership dependencies on selection; keep
historical cursors and hidden projects within the secondary budget.
Partial rows join their request's reconciliation baseline so removed
worktrees cannot leave ghost conversations.
Run status/diff process creation in the existing Windows Git worker.
Bound untracked-file stat submission and prioritize worktree authority
commands over pending display work. Preserve UTF-8 content, final
newlines and large blobs.
## Lifecycle and refresh semantics
- Cancel queued and dispatched optional SDK reads with a dispatch-time
deadline.
- Fence passive and explicit refresh/mutation continuations on worktree
changes, deactivation and disposal.
- Preserve commit drafts and the last successful status snapshot on
failures.
- Keep native ownership validation and 200-message windows; no new
persistent transcript cache.
## Gatekeeper
Independent review round 1 reported three findings: dispatched SDK
cancellation, late explicit/mutation continuations, and worker admission
behind untracked-file batches. All corrected.
Round 2: **ZERO FINDINGS**, with nine independent isolated source-level
checks.
The visible-list extension received additional independent reviews. One
finding about partial rows being mistaken for concurrent creations
during worktree removal was fixed and regression-tested. Final review:
**ZERO FINDINGS**, including isolated checks for membership removal,
concurrent rename/local creation and deletion without resurrection.
## Validation
- 23 browser scenarios: restored selection and 200 messages with Git
open on Electron/Tauri adapters, stable shell/draft lifetime,
cancellation/deadlines and late commit handling. Both desktop adapters
additionally verify partial cross-worktree publication under a blocked
secondary budget, exclusion of foreign roots, selection promotion, and
final removal of a no-longer-owned partial row.
- Server Git status/content and common-directory/worker admission
regressions.
- 10 SDK/background/prioritized-read queue tests; 9 startup/reconnect
store tests.
- UI typecheck and production build; server TypeScript compilation.
- Installed native verification with the usual profile: the final
first-switch capture makes PR726 available in **2.04s** after renderer
navigation, then completes its first **200-message read 6.08s after
selection**, with no HTTP or renderer errors. Normal native restoration
of PR726 earlier measured **5.064s**, with variability up to **11.233s**
during concurrent activity. These are renderer timings, not
executable-launch timings.
- Restored the complete published e68ac524 server after a parallel
installation had left older inventory modules. Installed server
JavaScript artifacts match the compiled source; the shared daemon and
user profile were preserved.
## CI qualification
Compatibility migration CI fails on the unchanged historical credential
assertion at `scripts/test-opencode-history-migration.mjs:191`: the
latest upstream response adds `method: "key"`. Runtime-contract
qualification passes at minimum/latest; this failure is separate from
the changed session/Git behavior and is not represented as a green
check.
Existing large source files touched:
`packages/ui/src/components/instance/instance-shell2.tsx` (~1308 lines),
`packages/ui/src/lib/api-client.ts` (~597 lines), `useGitChanges.ts`
(~519 lines), `packages/ui/src/stores/instances.ts` (~2197 lines), and
`packages/ui/src/stores/session-api.ts` (~1898 lines).
## Summary
Remove the requirement that the invoking agent's conversation must
already be active before CodeNomad UI automation can inspect or navigate
the application. That restriction prevented agents from using the UI to
return to their own conversation after a session or project switch.
- Target the inspected native window/run independently of the selected
conversation or project, including views with no active session.
- Keep the actual selected context in inspection results as descriptive
metadata.
- Pin actions to the inspected native window/run. Keep accessibility
references document-scoped: page replacement, reload and native target
changes still require fresh inspection, while conversation selection
alone does not.
- Keep authenticated backend discovery and browser-preview session
attachments intact.
- Document the behavior and add CDP/route regressions for navigation,
empty views and native target changes.
## Validation
- 27 targeted CDP, automation route and plugin tests passed.
- `npx tsc -p packages/server/tsconfig.json` and `git diff --check`
passed.
- Compiled shared server modules installed in the usual Windows Tauri
installation.
- The actual native automation bridge navigated **CodeNomad → opencode →
gaffer → openchamber → CodeNomad** from the same invoking session,
successfully inspecting each different active conversation and returning
to the original conversation.
- Native restart/reconnection, final inspection and screenshot
succeeded.
The implementation is shared by Electron and Tauri; no host-specific
code changes are needed. Installed desktop validation was performed on
Windows Tauri.
Maintenance note: the touched `packages/server/src/developer-cdp.ts` is
approximately 564 lines; this PR does not refactor it solely for length.
## Summary
Restore the saved conversation promptly by moving worktree Git process
creation off the CodeNomad HTTP/SSE thread. On Windows, even
asynchronous `execFile` spends significant synchronous time starting a
process; concurrent ownership and worktree discovery amplified this into
multi-second startup stalls.
- Execute worktree Git commands through a lazy worker with two process
slots, preserving each request's environment, output and error details.
- Share in-flight common-directory preflight reads by directory. Remove
successful and failed reads immediately after completion; retain Git
configuration resolution and native worktree ownership validation.
- Keep the existing 200-message page and normal HTTP restoration. No
persistent message cache is introduced.
- Add real-Git regressions for concurrent-read coalescing, process
admission, changed identities and recovery from failed reads; document
the refresh semantics.
## Measured desktop result
The usual Windows Tauri installation restored the saved conversation in
**2.698 s and 3.011 s** on two complete application relaunches, versus
approximately **7.5 s** before the worker change. These timings run from
renderer navigation to rendered conversation content, rather than
measuring the entire native process-launch interval. Both successful
runs used one 200-message request and restored the correct saved
selection. The user also manually relaunched the installation and
confirmed the result.
## Validation
- 53 server regressions: common-directory preflight, configured Git
roots, worktree annotations and workspace manager lifecycle.
- 13 isolated browser worktree scenarios (keyboard, pointer/touch,
refresh, selection and pending-move behavior).
- `node scripts/test-opencode-location-native.mjs <absolute-cli-path>`
passed with isolated OpenCode **2.0.12**, including native ownership,
discovery/create/remove, family move/rollback, cache revalidation and
event relay.
- `npx tsc -p packages/server/tsconfig.json` and `git diff --check`
passed.
- Installed compiled server modules verified against build output; real
four-project navigation and the model menu checked. Temporary startup
instrumentation removed.
The native integration fixture used its own
configuration/database/process. The shared OpenCode daemon and the
user's profile were preserved.
