Recover pending Forms and Permissions through a fixed presence-owned RPC in
the existing bundled plugin, without warming historical native Locations.
Validate established execution-host origin, complete coverage, directory/Git
ownership, WSL aliases and every placement before admitting capability.
Keep generic RPC forwarding closed and preserve non-authoritative failures.
Observe native compaction before event ownership routing and defer expensive
legacy discovery before inventory reads and at forwarding. Preserve concurrent
holds, bounded missed-end probes, exact settlement reconciliation grants,
per-kind mutation fences, global/idle Forms and settled-request tombstones.
Never replay ambiguous mutations. Share presence observations, not registrations
or execution authority.
Integrate current dev receipt and event-ownership changes. Reassert the native
connection after permission receipt preparation and before granting settlement
reconciliation or dispatching mutations. Reject overflowing raw JSON numbers,
including unknown metadata, without altering native numeric codec strings.
Use eight-directory UI batches with the unchanged request deadline and URL
budget rather than weakening ownership checks or extending timeouts.
Add scoped broker, reader, presence, proxy, compaction and UI lifecycle
regressions plus an opt-in isolated native reader fixture. Independent
Gatekeeper reviews are published on the PR; R1's numeric overflow finding is
fixed and rechecked on the final head before merge.
The private reader is qualified for native 2.0.22 / Effect rc.112 only. The
global minimum and already-recommended 2.0.22 remain unchanged. Unsupported
runtimes retain guarded legacy recovery. This mitigates CodeNomad's load
amplification, not the upstream Bus issue or previously retained Locations;
installed-application freeze resolution, deployment and daemon restart are
not claimed. Preserve bootstrap-warming and bounded-scan limitations.
## Summary
- Continue sparse history scans until a bounded result page is filled,
publishing matches progressively across sessions.
- Remove the automatic count traversal. Show page-local results and
messages scanned directly from search responses, with no scan when
opening an empty search.
- Project text-only content in SQLite, reduce bounded RPC round trips,
and share identical location checks only inside a request.
## Validation
- UI/server typechecks and targeted server/store tests passed.
- Chromium regression covers progressive results, pagination, workspace
scope, technical toggle, empty results and absence of statistics
requests.
- Isolated native OpenCode 2.0.22 fixture passed, including all 242
workspace matches across two sessions and pruning/ownership regressions.
- Synthetic benchmark: text search materializes 9.6 KB instead of 145
MB; CPU gain is modest because SQLite still parses stored JSON. See
dev-docs/SESSION_HISTORY_QUERIES.md.
## Review
Independent gatekeeper review and post-rebase validation in progress;
findings will be addressed before administrator merge.
## Summary
- Persist all permission decisions: allowed once, always allowed and
rejected, with request context and known reasons. Distinguish CodeNomad,
automatic Yolo and native settlements.
- Keep receipts visible alongside transcript messages even with hidden
tools; provide paginated source-less session receipts. Ownership-checked
bounded reads, atomic profile storage, deletion cleanup and stale-read
fencing.
- Enrich completed native question receipts with selected-option
descriptions, verbatim custom answers and a disclosure for other
choices. Translate labels in all ten locales.
## Validation
- Locked dependencies installed; server and UI TypeScript checks pass;
production UI build passes.
- 126 targeted server regressions during implementation, then 26
receipt/replier/service checks against the pinned client passed.
- 20 receipt/dock browser tests and 21 history navigation tests pass; 5
question decoding/copy tests pass.
- Rendered captures inspected at 393/1100px in light/dark, including
long text and pagination.
## Persistence boundaries
Native permission events are ephemeral: past lost decisions cannot be
reconstructed. Receipts are CodeNomad annotations outside native
search/copy/export. Storage namespaces follow execution host, native
root and authenticated channel; credential rotation starts a new
namespace. Bounded text excludes metadata/diffs.
## Review
Autonomous independent gatekeeper review will be published and repeated
until zero findings before the user-requested admin merge.
## Maintenance
Existing oversized files touched: server/http-server.ts (~2415),
server/api-types.ts (~717), server/index.ts (~707),
ui/message-section.tsx (~1566), ui/lib/api-client.ts (~650).
## Summary
Follow-up to merged #835: fix the demonstrated dependency behind real
`Instance event relay routing timed out` disconnects, not duplicate
connection notifications.
Existing diagnostics captured relay ownership blocked in `getWorktrees
-> WorktreeInventory -> POST /api/worktree/refresh`, including a refresh
pending beyond 150 seconds and a separate ~220-second completed call.
That exceeds the unchanged 60-second relay job deadline, so the shared
relay reconnects and Usage correctly clears for all projects.
Event authorization now uses a separate **registered-only** native
worktree inventory and never starts or joins native strategy discovery.
Native project/checkout checks, physical Git membership, clone
exclusion, configured roots, nested-folder and WSL projection remain in
the shared catalogue implementation. Native/local invalidation and
workspace disposal fence both inventories and their distinct
directory-cache namespaces. Ordinary request authorization and explicit
worktree discovery retain refresh and read-your-writes behavior.
Full-location checks receive the connection attempt's abort signal.
No timeout increase, swallowed reconnect, stale authorization fallback
or quota-specific workaround. FIFO lanes, ownership retries,
generation/workspace fences and retained-work budgets are unchanged.
## Validation
- Baseline-red production-manager + relay reproduction: hold discovery
unresolved and require the linked-worktree event to route before
releasing it.
- All **248 workspace tests pass**, including event order/reconnect,
ownership, no-Git, WSL, configured Git roots and inventory invalidation.
- Server TypeScript check passes.
- Isolated OpenCode **2.0.22** location/worktree/event fixture passes,
including real pre-refresh native registration and ordered real session
events during a held fixture-manager discovery request.
- Isolated no-Git native prompt/recovery fixture passes.
- `git diff --check` passes.
## Scope / limitations
The native refresh's internal delay is not claimed fixed; the relay no
longer depends on that unnecessary discovery operation. Actual transport
failures and other stuck native reads still trigger bounded
reconnect/reconciliation. Compaction and window-resize jank are not
established causes or fixed by this PR.
The installed application, shared daemon, user settings and independent
#824 worktree are untouched. This conversation remains attached to
`D:\CodeNomad`.
Existing oversized source touched:
`packages/server/src/workspaces/manager.ts`, approximately 1,260 lines.
No unrelated size-only refactor.
Independent Gatekeeper review will be published against the exact PR
head, with findings resolved and fresh passes until zero findings before
the requested administrator merge.
Expose the approved active-account dropdown with persistent credential-keyed drafts and always-visible add/rename/remove actions. Enrich only native fallback labels with a sanitized Codex login while keeping all credential values server-side. Persist opt-in automatic selection for supported OpenAI OAuth accounts and admit one fresh-quota-verified native activation before the next prompt/custom command, with local manual/policy fences, ownership and deletion admission, no model changes, and no prompt or mutation replay. Preserve dev's Missions revert and document service-wide selection and external-client compare-and-set limitations. Validated both package typechecks, the UI build, 812 server tests, 865 CI-selected UI unit tests, isolated native 2.0.22 synthetic-account/YAML fixtures, and focused Chromium/native bridge regressions. Final admin merge explicitly requested by the user; platform/runtime/native checks are green while the general tests job is still in progress.
Revert merge c118478805 relative to its first parent after the user confirmed the merge was requested in the wrong conversation. Remove the published Missions plugin, control routes, UI, playbooks and packaging references; do not rewrite dev history or touch durable-refactor work in the separate missions-v2 checkout.
Preserve subsequent PRs #792, #829 and #830. Remove only #829's now-invalid Mission reader import, dismissal hook and dedicated reader scenario, retaining the native questions/permissions dock, file-preview navigation and its other tests. Keep the 2.0.22 package pin and parent-session creation fence.
Validation: revert applied without conflicts; all 139 original merge paths reversed; later-only paths retained except the three minimal interruption-dock integration adaptations. Server and UI TypeScript checks and 18 automation/plugin lifecycle/desktop resource tests pass using existing local dependencies. Staged diff checks are clean. Full hosted CI, browser suites and native 2.0.22 qualification were not rerun for this immediate user-authorized admin revert.
## Summary
Qualify **OpenCode 2.0.22**, align server/UI client and plugin pins, and
recommend this release. Keep the demonstrated **2.0.7** global minimum
and **2.0.20** Codex Usage feature-local requirement.
Block the new native `parentID` create variant in the workspace proxy:
upstream ignores the supplied location and inherits the parent's
directory. Require inspectable JSON objects to close opaque-body
bypasses. Root creation and the existing authorized fork route remain
available.
Started at `dev@0983db3c` (#828 Windows test harness), then integrated
`dev@97c361c3` (#789 Code Mode presentation). Conversation remains
attached to `D:\CodeNomad`; all work and tests use explicit separate
paths and synthetic data.
## Upstream audit: 2.0.21 → 2.0.22
- Authenticated native OpenAPI retains **116 paths**, with **11 schema
differences**: session creation gains optional `parentID`,
parent-not-found response/description; provider settings gain optional
`headerTimeout` and `chunkTimeout=false`; configured model capability
overrides become partial. No new proxy route or consumed mandatory API.
- Published declarations: **4/30 client, 2/60 plugin, 3/36 protocol,
4/102 schema** files change. Plugin session domains expose `remove` and
`compact`; CodeNomad does not add calls to them. Identifier namespace
export is additive.
- An isolated native fixture proves parent creation inherits the parent
location despite a different supplied directory. Mock and
production-proxy fixtures reject owned/foreign parents; malformed values
and opaque content types are covered before any native request. Owned
root creation stays available.
- Runtime changes include HTTP header/chunk/whole-response timeout
handling and bounded timeout retries, provider cache/error/tool-history
fixes, model capability defaults, and legacy MCP shutdown cleanup.
- Lock changes are limited to six `@opencode` packages and two workspace
entries. Integrity/dependency metadata matches independently installed
published packages; clean `npm ci --ignore-scripts` passes. Optional
OpenTUI peers are not installed by CodeNomad.
## Isolated local qualification
**Windows / Node 24.20.0**, isolated profiles, databases, services and
synthetic providers/credentials. No shared-daemon or personal-history
mutations.
- Previous **2.0.21 dependencies + runtime 2.0.22**: native
pruning/history/proxy acceptance passes.
- New **2.0.22 dependencies + runtimes 2.0.7 and 2.0.22**: seven suites
pass (automation, pruning/history/navigation, per-send environment,
inclusive forks, idle/busy side questions, blank-session cleanup,
Git-degraded recovery), plus explicit native proxy suites.
- Native/UI pruning acceptance passes through the committed parent
runner, with completion and actual child exit verified. This uses #828's
early dependency-import workaround, not the old late-import order. No
claim that underlying Windows heap corruption is repaired.
- Current compaction-isolation acceptance passes: session B progresses
while session A's provider response is held; bounded outline reads
retain daemon heartbeats. Fixture runtime selection is extended to
include 2.0.22; its assertions are unchanged. This supplemental fixture
was not qualified on 2.0.7 (explicit runtime selector rejects it).
- Native Codex Usage passes on 2.0.22 with synthetic OAuth/key
credentials and mocked quota HTTP; not a live-account/WSL test.
- Native migrations **2.0.3 → 2.0.22** and **beta-19271 → 2.0.22**
preserve full history/forks/inbox/provider selection.
- Packed standalone pruning plugin installed outside the repository
passes native acceptance.
- Native npm upgrade **2.0.15 → 2.0.22** passes; authenticated daemon
remains **2.0.15 / PID 43876** before and after.
- Full server run: **794 passed / 6 skipped / 0 failed**. Final guard
revision separately passes **68 focused server tests** and native proxy
suites on minimum/current. Aggregate runs use `--test-force-exit`.
- Targeted client/store/reducer/usage UI: **63/63** with
`--conditions=browser`, `--test-force-exit`, bounded timeout. Initial
broad UI run used the wrong Node conditions and hung at
`prioritized-read.test.ts`; only its owned processes were stopped. That
incomplete run is **not green**. The same prioritized-read tests pass
under the browser condition used by CI. No production fix is inferred
from this launch correction.
- **41 browser scenarios** pass: setup/install, auth recovery, tool
images, rendered Codex Usage and compaction responsiveness. Browser
tests do not use forced exit.
- Server/UI/Electron typechecks and production server/UI/plugin builds
pass. Revalidation after #789 integration and independent gatekeeper are
reported separately below.
Local results do not certify all real providers, Linux/macOS/WSL, or
installed Electron/Tauri hosts. Historical Windows import and Git
cleanup failures remain limitations, not repaired by this upgrade.
Remote CI is not continuously monitored and no global CI-green claim is
made.
Size note: existing `packages/server/src/server/http-server.ts` is
~2,359 lines;
`packages/server/src/server/__tests__/instance-proxy.test.ts` is ~1,139
lines. Changes are narrowly scoped; no unrelated size-driven refactor.
## Independent gatekeeper
Review launched on exact head `0a7615476034eabbff54967aacc8a93ab0e6ab12`
against `dev@97c361c33f6fa7de30be5dde31c0e26e12bab574`; verdict will be
published before any admin merge. Findings will be corrected and
reviewed again until zero actionable findings.
## Behavior
Global/Project websearch choice, inherited/default, disabled and
automatic/provider selection. Display effective native configuration.
Optional global API keys use native integration/credential endpoints;
environment credentials remain read-only. Scoped failures reconcile
without mutation replay, and late results are fenced.
## Contract adjustment
OpenChamber's /api/config/websearch is its backend route. OpenCode
2.0.18 has no equivalent native config write API. Reuse CodeNomad's
authorized plugin-control configuration targets, JSONC conflict-safe
edits, WSL filesystem adapter and connection/deletion fences. Preserve
unrelated fields and comments; use native watching, never implicit
location.reload.
## Validation
Server/UI typechecks pass. 51 focused server/config regression tests
pass; four real-WSL cases skipped. Real Chromium fixture passes scoped
writes, failure reconciliation, API-key clearing and late mutation
fencing; narrow capture inspected. Isolated native fixtures pass on
2.0.7 and 2.0.18 (global watching, project document persistence/reset,
foreign-directory rejection). Project discovery is disabled in native
fixtures to exclude user ancestor config; deterministic server tests
cover precedence. No shared daemon or personal data used.
## Stack/review
Depends on #791, zero findings at ea3b4ef6. Independent gatekeeper
pending; fix/re-review until zero. User requires all PRs remain
unmerged.
Size notes: existing http-server.ts (~2300), api-types.ts (~1200),
plugin-controls.ts (~810), api-client.ts (~1000) and locale settings
files exceed guidance; focused changes only.
## User-feedback correction
Clarify which search provider agents use, automatic saves, the default
across projects and the current-project override. Move API keys into a
separate collapsed section explaining that credentials are shared
service-wide and saving a key does not change the selected provider.
Environment credentials are explicitly read-only. Updated in all ten
locales; narrow Chromium lifecycle/failure test and UI typecheck pass.
Alpha in fixture captures is synthetic test data.
## Summary
- add a durable, project-local Missions control plane on top of native
OpenCode V2 root sessions
- expose live Mission Control navigation, task state, actor state,
reports, and evidence in the right panel
- provide bounded Pocock bug-fixing and Wayfinder exploration playbooks
without introducing a generic workflow DSL
- keep Developer Mode automation separate from mission orchestration
## Architecture
Missions uses native OpenCode V2 primitives rather than a parallel
runtime:
- root sessions are mission actors
- `queue` and `steer` are the durable actor inbox
- session metadata carries mission, task, role, and coordinator
correlation
- plugin hooks inject role context
- project-local plugin storage persists an append-only mission journal
and materialized map
- topology mutations are coordinator-only and remain scoped to one
project
The agent surface is deliberately limited to `mission.inspect`,
`mission.delegate`, and `mission.report`. The CodeNomad broker exposes
only the typed `codenomad.missions.snapshot` RPC; change events are
invalidations that trigger authoritative reconciliation.
## User-visible behavior
Mission Control shows the active mission's status, frontier, tasks, root
actors, correlated reports, and expandable evidence. It updates live,
survives reconnects, preserves the last durable map through transient
failures, and can navigate to an actor session without becoming a second
workflow executor.
All new UI strings are available in the existing 10 locales. The panel
uses the shared token, utility, and square-corner window conventions.
## Playbooks and safety bounds
- Pocock remains evidence-driven and dynamically sequences
implementation, independent reviews, resolution, and fresh validation.
- Wayfinder preserves destination, map, frontier, claims, and fog-of-war
while allowing bounded parallel research.
- Admission and resume paths are idempotent.
- Limits: 8 actors, 96 tasks, 2,000 events, and 20 missions per project.
- A green completion requires every task to be completed.
## Validation
- [x] Rebased directly on `dev` after #647
- [x] OpenCode plugin contract typecheck
- [x] Server typecheck
- [x] UI typecheck
- [x] Mission server tests: 18 passing
- [x] Mission UI/i18n tests: 4 passing
- [x] Full server, UI, Electron, and Tauri suites/builds completed
during implementation
- [x] Private runtime spike verified activation, typed RPC, restart
persistence, root-session delegation, queue/resume, correlation,
idempotence, invalidations, broker allowlisting, and checkout/worktree
storage sharing
- [x] Pocock and Wayfinder runtime demonstrations completed
- [x] Windows Tauri Mission Control validated live from active mission
through completed status, including actor navigation and expandable
evidence
## Known runtime note
A daemon that was already running before the project-local plugin
existed may fail to hot-add that plugin on Windows. Fresh daemon
activation is verified and works correctly; CodeNomad does not restart
or take ownership of a foreign/shared daemon.
## Tester feedback phase
This PR intentionally remains in draft while the session mesh receives
broader real-world use. Please exercise:
- custom missions with both idle and busy actor sessions
- Pocock implementation, independent review, resolution, and fresh
validation loops
- Wayfinder exploration with parallel frontier tasks and unresolved fog
- restart/reconnect recovery before and after delegation and reporting
- actor navigation and evidence expansion from Mission Control
- project, checkout, and worktree boundaries, including expected
authorization failures
Useful reports include the desktop host, workflow/template, exact point
of friction, expected versus observed behavior, and whether the durable
map recovered after reopening. Do not include secrets or private prompt
contents.
The unrelated automation-registry CI fix is tracked separately in #675
and is not part of this branch. After that fix lands on `dev`, this
branch can be rebased and its validation rerun before any decision to
mark it ready.
## Behavior
Attach/remove skills in the composer using the current session
directory's native catalog. IDs are sent through prompt.skills; OpenCode
expands the instructions. Historical and optimistic messages show skill
labels. Queued edits restore removable skill attachments without
resurrecting removals.
## Lifecycle
Visible demand only, skill/config native updates, reconnect refresh,
coalesced trailing reads and view/session response fencing. Ten locales.
Native startup registers plugins progressively, covered by fixture and
catalog updates.
## Validation
UI typecheck passed; 53 session-action regressions passed; three focused
skill tests passed; Chromium
selection/deduplication/location/stale/coalesced/inactive scenario
passed and narrow capture inspected. Isolated native fixture passed on
2.0.7 and 2.0.18 (synthetic provider, private home/database/process; no
shared daemon). No runtime-minimum change.
## Stack and gatekeeper
Depends on #790, whose independent gatekeeper has zero findings.
Independent review of this PR pending; corrections/re-reviews continue
until zero. User requested no merges.
Size notes: prompt-input.tsx (~1120), session-actions.ts (~1000),
session-view.tsx (~720), session-actions.test.ts (~1040), and locale
messaging files exceed guidance; focused additions only.
Stabilize the Windows pruning/UI CI harness by loading its unchanged UI dependencies before the long native/SQLite preamble. The late-import baseline reproduced locally under CI's Node 24.20.0 with native status 0xC0000374. This is a qualified import-order workaround, not attribution or repair of the underlying heap corruption; no assertions, dependencies, test skips or retries change.
Retain actual child exit status/signal, stdout/stderr, durable stages and synthetic fixture logs through a parent runner. Require explicit completion as well as exit zero, and upload parent/fixture diagnostics on failure. Preserve the original UI scenario exception if diagnostic capture fails.
Trigger artifact announcements from validation completion rather than bounded polling. Failed validation stays red in its own workflow. Run only trusted default-branch helper code, verify the originating workflow and current authorized PR head, use GitHub commit association when needed and update only bot-owned marker comments. Artifact names remain escaped display text, never executed contents.
Fifteen focused tests pass under Node 24.20.0. Two coordinator-run and one independent full Windows native/UI scenarios complete naturally with all original assertions, restart persistence and presence cleanup. YAML and diff checks pass. The published independent gatekeeper review of this exact head has zero findings.
Admin merge is explicitly requested without waiting for CI. GitHub workflow_run delivery needs post-merge confirmation; no universal CI reliability, underlying heap repair, Linux/macOS native rerun, installed app replacement or shared daemon restart is claimed.
Aggregate compaction fragments before reactive SDK reduction while advancing
revision fences immediately and preserving native terminal and snapshot
authority. Keep task-tool shells keyed across payload updates and rescan bounded
membership so removals and replacements cannot leave phantom tools.
Isolate SSE callbacks and decode/dispatch diagnostics. Subscriber-local teardown
no longer destroys the healthy shared native client. Install HTTP cancellation
before preflight and fence late continuations without replaying or interrupting
already-admitted mutations. Preserve ownership and environment admission checks.
Move HTTP password derivation to async scrypt with serialized password changes
and login-authority fencing. Yield cooperatively in both structural-index phases
without changing snapshot/digest protocols; an individual SQLite step stays sync.
Add isolated red/green regressions, bounded browser/native qualification scripts,
independent reviews, source fingerprints and performance evidence for issue #824.
Synchronize the Git focus assertion with its async contract and make the opt-in
trace self-contained instead of serializing a tsx helper into the browser.
Validation includes 793 passing server tests and 6 skips after replay, UI/server/
Electron typechecks, UI/server/plugin builds, and private Windows native 2.0.21
fixtures. Renderer fixture median main-thread cost is 324.57 to 16.94 ms.
The latest full browser run remains 358 pass, 1 fail, 1 skip: its trace failure
was subsequently reproduced and corrected with a minimal Chromium check, but
the full suite has not been rerun. Store assertions use force-exit; natural
cleanup and Linux Electron to Windows LAN/HTTP with 2.0.19 remain unqualified.
Publish as a draft for review, not a universal resolution or issue-closing fix.
Refs #824.
Integrate current dev while preserving the mission routes, durable execution controls and specialist cleanup. Retain native usage route dependencies and align local plugin dependencies and architecture guidance with OpenCode 2.0.21.
Combine the workspace file reader with the mission reader in the central session surface. Explicit reader selection dismisses the competing preview without losing stored editor drafts or the composer. Extend the real-session browser regression to cover switching between both readers.
Validate server and UI typechecks and all ten mission browser/i18n tests. Preserve the upstream Tao patch unchanged, including its original whitespace and provenance.
Backport the exact read-only macOS maximize getter from Tao #1182 into the existing 0.34.6 vendor override, preserving the Windows input backport. The original borderless getter changed AppKit style masks and generated geometry events whose persistence capture called the getter again, starving startup independently of OpenCode readiness. Window chrome, persistence policy and shared OpenCode lifecycle remain unchanged.
Add a bounded native AppKit regression with isolated original-crate negative-control artifacts, repeated warm-cache runs, getter-phase capture evidence, maximize/restore and fixed-size/decorated cases. Reject unrelated watchdog timeouts and validate runner results with platform-independent tests. Run the native regression in macOS ARM64 CI.
Validation includes the macOS Intel VM reproduction and rebuilt Tauri startup, second-window quit/relaunch with isolated OpenCode 2.0.21, 181 macOS and 188 Windows Tauri tests, Windows input negative controls, 44 targeted Electron regressions, successful ARM64 CI tests and a published ARM64 test artifact. Both independent gatekeeper findings were fixed and re-reviewed to zero findings. All test jobs passed; remaining platform builds were still running at the explicitly requested admin merge.
Fixes#819.
Flatten Mission Control into compact top-level rows with two-line objectives, semantic state colors, direct readers and coordinator navigation. Put Work first, collapse secondary sections by default, and retain per-window reader and disclosure state.
Create UI missions in a prepared state and use one Play button for start/resume alongside Pause and terminal Stop. Persist explicit control intents and per-target receipts, serialize them with mission admissions, and use the authenticated desktop bridge for native root-session interruption and environment-fenced resumption. Park report notifications while paused, cancel mission-owned queued inputs on Stop, and prevent stale retries from reopening terminal missions. Native descendant suspension remains outside these root-actor controls.
Add opt-in deletion of mission-created specialist conversations. Persist cleanup targets and receipts, reserve journal capacity, and validate ownership through a narrow cleanup authority RPC before native HTTP removal. Preserve coordinators, reused/shared/moved sessions and roots with children; partial failures keep stable explicit retry identities.
Validate with 88 focused server tests, 10 browser/i18n tests, server and UI typechecks, the full build and an isolated OpenCode 2.0.21 fixture covering Play/Pause/Resume/terminal Stop, cleanup and transcript preservation. Inspect rendered controls and document the lifecycle, cleanup and styling conventions.
## Summary
Unify the right-panel Git and file surfaces as **Files**, with a compact
**Workspace / Changes / Commits** switch and a shared central preview
above the
conversation composer.
- Workspace: lazy, keyboard-accessible directory tree; read-only source,
Markdown and image previews; bounded binary-file fallback.
- Changes: indexed/working-tree files and central diffs, with existing
Git
mutations kept in a collapsed actions section.
- Commits: paginated history of the browsed worktree, commit
details/files and
first-parent diffs, including root commits, renames, deletions and
gitlinks.
- Preserve drafts and mode navigation; fence late responses across
session and
worktree changes. Migrate previous tab customization and retain
diff/wrap
preferences. Bundle Monaco tokenizers locally for offline highlighting.
- Worktree browsing does not move a conversation or check out a branch.
## Implementation
The common Solid UI is used by Electron and Tauri. New file previews
reuse the
directory ownership boundary and bounded filesystem reader. Historical
reads use
worker Git commands with full-hash validation, authoritative file
membership,
bounded command output/time and snapshot-based paging. The old sidebar
editor
and split viewer are retired. See `dev-docs/FILES_PANEL.md`.
## Validation
Before rebasing onto current dev:
- Server, UI and Electron typechecks passed.
- Server/UI and Electron builds passed.
- 20 focused unit/route tests passed, including real isolated root and
linked
repositories, preview bounds and directory ownership.
- 12 distinct browser scenarios passed: 5 Files flows (including real
SessionView/composer, Markdown/images/source and RTL keyboard
navigation) and
7 existing Git lifecycle regressions.
Post-rebase validation, independent gatekeeper reviews and the Windows
Tauri
test build will be recorded below as they complete. This PR is intended
for
interactive validation before merge.
## Summary
I replaced Codex Usage's legacy auth-file reads with the connected
OpenCode V2 daemon's selected ChatGPT OAuth credential. This addresses
the stale-file mismatch described in #808 without guessing WSL
credential paths or substituting another account.
- Resolve the provider integration in the owned session's native
location; use only its selected active credential and native accountID.
- Keep credentials server-only, OAuth refresh native-owned, and
credential export/generic RPC blocked through the browser proxy.
- Fence warm and pending quota results on account changes, reconnects
and session movement; scope the visible panel to its instance/session.
- Bound quota HTTP, reject redirects and sanitize errors. No SQLite
access or legacy/Codex CLI fallback.
The credential-list API requires OpenCode 2.0.20 for this feature only.
Older runtimes, expired native tokens and non-ChatGPT connections fail
closed; the global application minimum is unchanged. Other providers'
credential integrations are outside this focused fix.
## Validation
- Server/UI typechecks; 85 server tests; five UI unit tests; three
rendered browser scenarios; UI build and diff checks passed.
- A fresh native 2.0.20 Windows daemon with synthetic credentials
exercises the production adapter: selected OAuth/accountID, key-account
switch invalidating a warm snapshot, and recovery despite stale
auth.json. Quota HTTP is mocked; no shared daemon or real credentials
are used.
- This fixes the confirmed integration mismatch, but I have not
reproduced the author's real WSL/live account failure.
Closes#808.
Maintenance: existing `packages/server/src/server/http-server.ts`
(~2,317 lines) and `packages/ui/src/lib/api-client.ts` (~613 lines)
exceed the source-size guideline; their wiring changes remain small.
Keep connected MCP status dots green without a permanent pulse. Pending connect/disconnect operations retain their warning pulse and spinner; the shared reduced-motion and metadata refresh policies are unchanged.
Add real StatusTab/SUID browser regressions at 150% scale, a bounded historical/current Chromium profiler, and measurement-limit documentation. Five browser scenarios, UI typecheck/build and repeatable profiler assertions passed. Fix the gatekeeper P2 by creating the temporary evidence parent on clean machines; the second independent review reported zero findings.
The change addresses the idle-animation source in #804, not its unconfirmed generation GPU symptom or #805. Remote CI was pending at the explicitly requested admin merge.
Align server/UI client and bundled plugin pins with OpenCode 2.0.19 while retaining the demonstrated 2.0.7 timestamp minimum. The authenticated native schema and published declarations preserve the consumed API contract; runtime improvements concern compaction, context limits, provider cache affinity and Shell conventions.
Extend setup version coverage and update the maintained compatibility and architecture references. Add per-import native/UI fixture diagnostics after late Vite loading stopped on both the new runtime and the 2.0.18 control; do not claim that eager-import diagnostic acceptance fixes that failure.
Qualify both minimum/current native runtimes, historical migrations, isolated npm upgrade without daemon restart, standalone plugin installation, UI/browser behavior and production bundles. Retain the original Windows fixture failures and their bounded diagnostic results in the PR evidence.
## Summary
Fix the main-process `TypeError: Object has been destroyed` dialog
observed when
closing the Windows Electron 0.20.0 build.
The local window's `closed` handler accessed `window.webContents` after
the native
BrowserWindow was destroyed. The exception surfaced while
`MultiwindowLifecycle.exit()` called `app.exit(0)`.
BrowserController now captures the owner WebContents while the window is
alive
and observes `closed` using that retained identity. Browser target
registrations
and pending-open claims are cleaned up after the registry's existing
removal
handler, without invoking getters on the destroyed BrowserWindow.
This is an Electron native-object lifetime correction; shared shutdown
semantics
and Tauri behavior remain equivalent.
## Validation
- Electron TypeScript check passed.
- 15 browser-controller regressions passed, including a
native-getter-throwing
window fixture that verifies registration cleanup still occurs.
- 16 multiwindow lifecycle regressions passed.
- `node scripts/test-electron-owner-close.mjs` passed on Windows with
real
Electron 39.0.0 windows: forced destroy, ordinary close and final
lifecycle
exit. It also asserts that the former getter really throws after
`closed`.
- Native fixture uses its own temporary profile and no
CodeNomad/OpenCode backend.
Separate from the installation-progress UI PR. This fix is not yet
included in
the already-published 0.20.0 replacement archives.
File-size note: the existing Electron `main.ts` entry point is
approximately
625 lines; the change replaces one cleanup call with owner observation.
Integrate dev into the Missions PR without rewriting its reviewed history. Retain mission CRUD routes, authenticated report admission and the 512 KiB bridge limit alongside inspected-window automation and plugin controls. Keep dev's canonical transport, clean builds and 2.0.18 client/plugin dependencies; align the local plugin contract check with the same SDK.
Combine architecture guidance and preserve the technical runtime minimum of 2.0.7. Keep the isolated Missions fixture in the latest-runtime CI lane because its test-only ctx.tool.list driver is absent at that minimum; do not reintroduce legacy compatibility paths.
Validation: server, UI and plugin-contract typechecks; full server/UI/plugin build; 84 backend/compatibility/packaging tests; 59 UI/persistence/browser tests; isolated OpenCode 2.0.18 Missions fixture and workflow YAML parsing. Merge resolutions have no conflict markers or diff-check errors relative to dev.
Declare expected mutation rejections in the native RPC contract and return them through the invocation error API. Map structured business codes to conflict, missing and ownership responses so stale editors can request a reload instead of reporting an unavailable plugin. Unexpected exceptions remain opaque 503 failures.
Extend the isolated OpenCode fixture through the real WorkspaceManager and HTTP routes to verify stale update/delete, create/update/delete request-ID conflicts and unknown missions. Observed native 503 before the fix and 409/404 after it; targeted route/plugin/reload tests and server typecheck pass.
Recover durable report notifications that were saved before a bridge outage prevented coordinator admission. Reuse native message identities, honor journal acknowledgements and lifecycle fences, and retry only notifications through the authenticated environment-aware bridge. Nonblocking single-flight retries use bounded backoff and rotating batches without dispatching tasks.
Show pending coordinator notification separately from task completion in Mission Control, with all locales aligned. Derive managed actors from immutable task identities, resolve Pocock implementers through live task ancestry, and normalize dependencies for both new and historical idempotent requests.
Validated 53 backend regressions, server and UI typechecks, UI and plugin builds, six real-component browser scenarios, locale parity, and an isolated OpenCode 2.0.18 fixture proving idle/busy resumption and automatic outage recovery with and without restart. Native replay retains one correlated report without another coordinator wakeup.
Share project mutation and append queues across content-addressed plugin incarnations so disposal cannot let competing revision checks overwrite history. Keep in-flight operations exclusive until settlement.
Raise assembled bridge text bounds to accommodate maximum XML-escaped objective and task fields within the existing HTTP body bound. Exercise real authenticated HTTP admission with XML, JSON-control and multibyte expansion.
Observe both regressions failing before their fixes, then passing with the focused bridge suite and server typecheck. The isolated OpenCode 2.0.18 fixture now proves reports reach an actual provider request for idle and busy coordinators instead of treating session idle as proof of consumption.
Make Mission Control actionable with create/edit/delete, persistent disclosures and selection, task dependencies, native attention requests, execution comparisons and a long-content reader above the mounted transcript. Preserve drafts and native per-window layout, and arbitrate browser/reader gestures without losing the preview target.
Add coordinator-only mission.revise with revision CAS, idempotent replay, linked replacements and explicit dependency changes. Retain withdrawn task contracts and late reports, require terminal settlement for outstanding native admissions, and attribute human metadata edits in the bounded history. Mission deletion tombstones the map without deleting conversations.
Cover lifecycle and revision semantics with backend regressions and the isolated OpenCode 2.0.18 fixture, including the repaired authenticated late-report notification. Validate real Solid UI restoration, editor retry identity, native background Forms, transcript/draft preservation, layout cleanup and ten-locale parity. Record Kandev research, scope decisions and separate follow-up opportunities.
Provision codenomad.missions through connected-daemon discovery and independent backend presence instead of requiring a source plugin in every project. Bundle the integration for Electron and Tauri, retain project-scoped mission journals across shutdown, and use the same secondary surface as Status.
Complete the existing native actor execution work: persist explicit agent/model/variant choices, validate catalog selections and avoid switching busy actors. Admit assignment and report writes through the authenticated desktop bridge with durable-contract verification, session ownership, connection and worktree fences, and per-send profile environment synchronization.
Advance the older source branch client/plugin pin to 2.0.11 and retain its bounded runtime metadata adaptation. The isolated 2.0.16 mission fixture passes native catalog, selection, busy queues, conflict, environment, reports, reconnect and idempotence checks. Server, UI and plugin typechecks, 31 mission tests, 10 lifecycle/transport tests and six resource-layout tests pass.
Align server/UI client and bundled plugin pins with the latest stable runtime while preserving the demonstrated 2.0.7 timestamp minimum. Review the published declarations and authenticated native schema: pairing and Shell signal additions require no CodeNomad API adaptation.
Make the isolated native upgrade fixture follow the recommendation while retaining its 2.0.15 source boundary and live-daemon PID assertion. Extend setup version coverage and update the current compatibility and architecture references.
Validate both minimum/current native runtimes, historical migrations, server/UI tests, setup and tool-image browser scenarios, typechecks and production bundles. Record the intermittent Windows Node pruning/UI heap exit and successful diagnostic rerun without claiming its cause is fixed.
Display HTML and JSX tags literally in user messages, pasted-text disclosures and user timeline previews while keeping existing assistant HTML rendering. Preserve stored prompt text, Markdown formatting and code entity spellings, and isolate literal render requests and caches from older sanitized HTML entries.
Escape both HTML tokens and Marked raw-region text tokens so malformed source remains visible text. The first independent gatekeeper pass identified the raw-region bypass; it was corrected and covered by unit/browser regressions. The second independent pass found zero findings after additional raw-region variant checks.
Fifteen Markdown tests, two focused browser scenarios, the existing held-tool-scroller regression, UI typecheck/build and an isolated historical-source renderer comparison passed. The tested assistant HTML DOM matches v0.19.0; user rendering intentionally differs because v0.19.0 also interpreted user tags. Remote CI was still in progress at the explicitly requested admin merge.
Use one Attach file action for native device selection and retain project-scoped @ references in the active session worktree. Remove the duplicate upload entry and composer server browser, document the outside-project scope change, and translate attachment origins and feedback across all locales.
Share serialized, bounded byte ingestion across picker, drop and clipboard. Fence open pickers and late reads across session/worktree/lifecycle changes, preserve edits and newer selections without stealing focus, release rejected-read budgets, and restore failed custom-command drafts by attachment identity. Validate project directories through existing workspace ownership before filesystem listing/search.
Cover the behavior with 20 attachment and 11 session-aside browser scenarios, attachment/submission/persistence units, server budget/proxy/ownership regressions, and isolated native Windows picker fixtures. Three independent review passes corrected five P2 findings and ended at zero; the final merged-head review confirmed that result. UI checks/build, Tauri release build and native picker smoke passed. Remote CI was still in progress at the explicitly requested admin merge.
Match OpenCode's TUI by interrupting only the selected session with resume:true. The previous Stop/double-Escape action interrupted active descendants in parallel; a background child's completion notification could wake the parent after its interruption had already settled, producing new model activity after Stop.
Keep background children independently owned and directly interruptible when selected. Native control/steering input retains TUI resume semantics rather than introducing a separate CodeNomad cancellation policy.
Cover selected parent/child scope in store tests and both gestures through real Chromium composer and keyboard handlers using the generated native client. Include an isolated native fixture with a temporary HOME/database, private server and loopback provider that reproduces the cascade restart and verifies selected-session interruption. UI typecheck, production build and both browser regressions passed on the reviewed branch; full-CI failure triage is documented in the PR.
Backport upstream tao#1215 unchanged onto Tao 0.34.6 to correct the same-thread native input mutex deadlock identified in a symbolized Windows hang dump. Preserve the existing Tauri dependency/API line, all non-Windows sources, licensing and exact published-crate/patch provenance through a workspace Cargo override.
Add real isolated Win32 reentry regressions for keydown, keyup, character, system-character and IME input. Original-crate controls reproduce bounded deadlocks; the backport passes all five cases. Independently cover the IME lock boundary with temporary-source instrumentation and require an IME-only lock-order mutation to fail, preventing keyboard pre-peeking from masking an IME regression.
Independent gatekeeper pass 1 identified the IME coverage gap; pass 2 on 462f9eac reports zero actionable findings and independently reran all controls. Full local Tauri tests passed 181/181. Administrator squash merge requested by the user; remaining CI jobs were still running at merge.
Delegate verified shared npm updates from OpenCode 2.0.15 onward to the native CLI with bundled Node/npm, a scoped prefix and registry, and Windows running-image retention. Preserve first-install and older-migration preflight, version/launcher verification and explicit daemon activation.
Retain installation ownership and the temporary adapter if an outer timeout, signal or output limit leaves descendant exit uncertain. Allow native timeout cleanup to finish and preserve original failures.
Validated with 37 targeted updater/route regressions, server typecheck, isolated live Windows 2.0.15-to-2.0.16 qualification, and a successful NSIS build/install of the initial implementation. Independent gatekeeper review found one timeout issue; the second pass after correction reported zero findings. Administrator merge explicitly requested by the user; final-head remote CI is still running.
## Summary
Retire the prerelease private OpenCode installation completely as an
executable source. Automatic selection now uses PATH and the
conventional shared user npm installation. Existing private files are
neither migrated nor deleted.
- Remove the private installer, receipt reader and fallback
introduced/retained by #756.
- Ignore saved private selections and reject validation/launch from
`~/.local/share/codenomad/opencode`, including private PATH entries.
Prevent installation into that retired prefix.
- Remove private-copy descriptions from all ten locales and update the
runtime policy documentation.
- Keep supported custom installations, native shared-service
ownership/authentication and explicit restart behavior.
## Reproduction and scope
The initial genuinely empty-profile test passed, but it did not match
the affected machine: that machine had no Git and retained a private
prerelease OpenCode copy.
On the exact installed `v0.20.0-dev-20260923-baf674fc` Tauri artifact,
seeding a valid private copy plus its `selected` receipt and `current`
marker makes setup report `state: ready`, `installationSource: legacy`,
and suppresses the missing-installation screen. The new desktop
regression fails against that release with `ready !== missing`.
With rebuilt server/UI resources in an isolated copy of the same Tauri
host, the identical private-copy scenario reports missing, offers
installation, installs the shared npm package, authenticates OpenCode
2.0.15 and resumes the requested folder without Git. This demonstrates
the missing-setup cause; it does not claim to explain every initially
reported startup slowdown.
## Validation
- 59 targeted server tests passed: discovery/install/update, retired
paths, binary selection, Windows/WSL spawn and binary validation routes.
- 13 real-component setup browser tests passed.
- 23 focused retirement/launch tests passed after the final network-path
preflight adjustment.
- UI TypeScript check passed; production server/UI/automation/pruning
build passed.
- Installed-release private-copy reproduction failed as expected;
corrected isolated Tauri acceptance passed.
- `git diff --check` passed.
Desktop qualification uses isolated profiles, services and databases.
The sole simulated installation side effect is HKCU PATH registration,
captured by a fixture preload; bundled npm installation, package
verification, native-parent service start and authenticated API checks
are real. The shared user daemon and installed application were not
replaced by the fix. Remote CI is pending.
## Maintenance notes
Existing oversized files touched: `packages/server/src/api-types.ts`
(~583 lines) and `packages/ui/src/lib/i18n/messages/*/settings.ts`
(~625–639 lines). No size-only refactor is included.
Prefer terminal PATH and a common user npm installation, migrate historical private and official npm copies, and retain explicit authority for custom and WSL executables. Preserve running daemon ownership and defer locked Windows updates. Align recovery and settings presentation across locales.\n\nReviewed through an independent gatekeeper loop (final zero-finding review on e33a6a16). Validated 34 targeted server tests, 13 browser scenarios, typechecks, isolated Windows npm installation and real historical migrations. Full CI browser job has unrelated existing system-message search failures reproduced locally; merge requested with administrator authority without waiting for CI.
## Summary
Follow-up to #750: Git is a prerequisite for full CodeNomad
functionality, but its absence must not prevent users from consulting
their agent and asking it to help with installation.
- Keep workspace startup and ordinary conversations available without
host Git. Only the explicitly opened physical directory authorizes
sessions in this mode; do not infer sibling worktrees from native
project IDs.
- Preserve Git/worktree operation requirements and return an actionable
`git_required` failure for those operations.
- Inform the agent via the owned native `codenomad.git-availability`
instruction before prompts/custom commands. Include the backend platform
and distinguish the backend account from WSL/remote agent execution.
Remove the entry once Git is available, while preserving other
instruction keys. There is no Git setup UI or installation gate.
- Keep deletion admission safe across Git availability transitions by
draining/blocking overlapping ancestor and descendant directory
identities.
- Narrow initial project-wide session lists to the opened directory in
degraded mode; reject existing project-scoped cursors rather than
reinterpreting their native pagination scope.
- Teach the UI session inventory to request exact-directory pagination
for degraded roots while retaining unknown repository membership. Owned
children with inaccessible parents remain local display roots,
preserving their native parent metadata; worktree selection is
unavailable until Git recovers.
- Bound advisory context synchronization independently from fail-closed
profile-environment synchronization. An advisory timeout does not replay
or prevent the original send; disconnect and runtime-generation fencing
still apply.
## Validation
- Targeted server regressions cover real workspace-manager/proxy
admission without Git, foreign/child/alias directories, initial lists
and native cursor scope, worktree operations, deletion fencing,
environment admission and advisory timeout.
- Existing workspace lifecycle, inventory, native Git-worktree identity,
directory-authorization and worktree-deletion route suites pass.
- Real isolated OpenCode **2.0.7 and 2.0.15** fixtures: Git absent from
both backend and daemon PATH; project open, session creation,
instruction synchronization, prompt admission, model request containing
degraded context, assistant reply, and removal of stale instruction
after backend PATH recovery. Private databases and a local synthetic
provider only.
- Server/UI TypeScript checks and production server/UI/plugin builds
pass. Generated-client prefix regression also passes (bounded Node test
runner for its retained UI handles).
- Added no-Git unit/native qualification to the existing
Linux/Windows/macOS compatibility workflow. Local native runs were on
Windows; cross-platform CI outcomes are reported separately.
- Final UI coverage: 88 store/tree/startup/authority tests, 13
worktree-browser tests, and 43 transcript/session-rendering browser
tests pass.
The earlier #751 instruction-proxy correction remains necessary and is
covered by its existing regression tests. This change addresses the
separate missing-Git admission failure.
Validation includes isolated minimum/current native suites, historical migrations on Linux/Windows/macOS, targeted unit and browser tests, production builds and two independent gatekeeper reviews with zero actionable findings. Retain startup diagnostics for an unexplained intermittent Windows pruning/UI process exit; the complete instrumented Node 24.20.0 rerun passes locally. Known system-message search fixture timeouts remain documented. Admin merge explicitly requested; runtime activation and desktop installation remain separate actions.
Replace timestamp-based automatic deletion with fresh native content checks and local activity, draft, attachment and connection fences. Preserve sessions with queued input or children, fail closed on uncertain reads, and refresh the message proof before deletion. Keep explicit deep-clean semantics separate and count only successful deletions.
Run automatic cleanup in a coalesced background sweep so historical reads never block new-session activation or the first prompt. Add 40 cleanup regressions and an isolated native fixture wired into minimum/latest runtime CI.
The baseline fixture reproduces native conversation loss; fixed behavior passes on OpenCode 2.0.7 and 2.0.14. All 157 targeted tests and UI/Electron typechecks pass locally. Two independent gatekeeper rounds concluded with zero findings after correcting creation-path latency. Full GitHub Actions CI was still pending at the authorized administrator merge.
Follow up #737 with a shared focused-or-MRU menu snapshot, UI-thread refresh serialization, lock-free native calls, popup-tracking deferral and atomic admission before native getters. Preserve remote/Preferences isolation and trailing state publication after native tracking. Iterative independent gatekeeper review reached ZERO FINDINGS after fixes; isolated real Windows popup/focus/concurrent-request and mouse-selection acceptance passes, alongside Rust and Electron/UI regressions. Administrator merge requested by the user. CI is not fully green: final checks pending, baseline migration/system-search failures and an unexplained initial Windows pruning UI exit are documented in the PR gatekeeper report.
Reserve /btw in the composer and autocomplete, using session.generate to answer from the current native context in a non-modal Markdown window. Bare /btw opens the question form; answers can be copied or retried without adding transcript, inbox or child-session records.
Keep side-request cancellation independent of the main execution, fence late results on cancellation, replacement, session changes and disposal, and preserve unsent file/image attachments. Authorize only the reviewed session-scoped generation route through existing ownership and worktree-deletion checks. Add all ten locales and shared square window styling.
Cover routing, Markdown, attachments, concurrent main prompts, cancellation races and narrow layouts with ten browser scenarios, plus proxy regressions. Verify native idle and busy behavior with isolated local-provider fixtures on OpenCode 2.0.7, 2.0.11 and 2.0.12; include the fixture in minimum/latest CI. UI/server typechecks, twelve adjacent unit tests and diff checks pass.
Integrate dev at 306c2ba4, including full-history search, cached global timeline navigation and README updates. Preserve the new RPC/client methods alongside managed setup, explicit restart/reload and the technically justified OpenCode 2.0.7 minimum.
Correct the incoming standalone plugin manifest to include navigation-scope, outline-index and outline-preview. Both the existing packed-entrypoint regression and independent gatekeeper review identified the omitted dependencies; the corrected package resolves outside the source checkout.
Validate 643 server tests (2 skipped), 154 UI store/reducer tests, 29 browser scenarios and both typechecks. The rebuilt bundled plugin passes the complete isolated native 2.0.7 suite with rendered UI, including 241-message history cleanup and 1501-message global navigation/restore parity. Record pre-merge evidence in the compatibility register.
Integrate the current dev baseline while retaining PR 723's server-backed full-history search and direct navigation. Resolve the sole message-section conflict by keeping the bounded history query flow instead of reinstating the superseded resident-page traversal and resident-result reconciliation.
Preserve dev's system-message visibility and untracked search locator changes. Validate UI and server typechecks against the updated locked dependencies, plus browser regressions for restored checkpoint reconciliation and current-session search navigation.
Replace the arbitrary 2.0.11 floor with the 2.0.7 native step-timestamp boundary, keeping 2.0.11 as the separately recommended qualification target. Unlisted, prerelease and custom runtimes negotiate authenticated API requirements; preserve complete CLI labels so unknown builds neither fail solely by name nor enable unintended automatic upgrades.
Finish retiring pre-2.0.4 location/worktree/credential/Form serialization and obsolete catalog events while preserving internal identity, import/cursor authorization, pruning claims and connection fences. Remove the unused global package-manager installer and clean generated server output before packaging so deleted modules cannot survive incremental builds.
Distinguish missing setup, technical incompatibility and optional updates in the shared UI, including minimum rationale and optional restart wording. Retain a usable daemon through older discovery CLIs, check reload capability independently, and suppress installation when bundled npm is unavailable.
Validated 622 server tests, 7 browser scenarios, real reducers and fixture guards, production native suites on 2.0.7 and 2.0.10, and synthetic 2.0.3-to-2.0.7 history migration. Independent gatekeeper re-review closed the production version-parser finding. CI now qualifies the source-defined minimum and latest; rebuilt desktop acceptance is recorded separately.
Restore provisional timeline geometry through optional content-addressed index chunks, bounded independently from drafts and attachments. Validate durable session/location/project/revert identity, preserve other restored state when an index chunk is missing, and reuse immutable normalized values and encoded leaves during scroll or draft captures. Fence older renderers with a graph extension and retain monolithic-host compatibility.
Revalidate native structural indexes using stable checkpoint ranges and return only changed structure. Grow the live tail before adding ranges, reserve a complete block within each RPC page budget, and schedule a trailing scan when messages arrive during a fixed-horizon read. Route bulk-cleanup completion and ambiguous failure through the shared coalesced refresh path so the final invalidation cannot strand an obsolete native transcript window.
Cover large partition round trips, corruption isolation, restoration clear/disable, offline edits/pruning/deletions/appends, manifest growth, deletion-hole pagination, active-window refresh races and Solid trailing scans. All 21 Chromium navigation cases, package typechecks, packaged-resource smoke, Electron state tests and isolated OpenCode 2.0.5 integration pass. The second independent whole-PR gatekeeper review reports zero actionable findings; installed-app restart verification remains pending and is documented explicitly.
Build rail geometry from a structural native index of IDs, sequence, types and technical-part counts. Project that metadata in SQLite without transporting or parsing full message bodies in JS. Bounded 16384-entry pages replace 256-entry excerpt scans, and indexing runs independently of transcript hydration. Remove the excerpt-loading countdown.
Retain up to sixteen structural snapshots with a 200000-entry LRU budget, allowing one larger active index. Unchanged session returns reuse the index without a read; message changes refresh only the last 32 indexed rows and arrivals. Preserve destructive-mutation, undo, connection-generation and route ownership fences.
Restore bounded Markdown hover and focus previews. Fetch visible-nearby excerpts in batches of twelve, prioritize the hovered marker and cancel obsolete demand. Keep a separate 512-excerpt cache with on-demand age revalidation. Unavailable excerpts show no empty popup, and arriving content cannot alter marker geometry or load a transcript window.
All nineteen browser navigation cases pass, including blocked transcript/excerpt hydration, exact scrollbar extent, native thumb gestures, rich historical/resident previews, six intervening session indexes and tail-only live refresh. Six SQL tests, three route race tests, UI/server typechecks, packaged-resource smoke and the full isolated OpenCode 2.0.5 native/UI fixture pass. Record installed desktop cold-index responses of 2.05s for 11210 messages and 0.58s for 4857 messages; the warm-switch run was interrupted by user selection and is not claimed as qualified.
Large-session desktop switching reproduced repeated restoration requests for the same absent anchor. Distinguish anchor_missing in the bounded native window RPC from ownership and revert conflicts. Automatic restoration recovers once through a fresh visible latest page and replaces the stale saved cursor only after success; explicit navigation and authority failures retain their error semantics.
Cancel view-owned initial reads when hidden, release their request authority before an immediate return, and prevent obsolete hydration callbacks from reviving after away-and-back navigation. Pause outline scans while transcript hydration is loading, preserving their accepted cursor and completed display. Add the user-approved lightweight timeline scrollbar separator, hidden when its measured content does not overflow.
Record the real Windows desktop baseline and remaining priorities in SESSION_HISTORY_STRESS_REVIEW.md: 62.62 MiB of transcript responses, repeated outline scans, transient heap growth and main-thread stalls. Separate observations from unproven leak or CPU attribution, and document the live-event merge, incremental metadata and byte-budget work still needed.
Validate 18 browser navigation cases (17 in the complete run and the corrected localized conflict assertion in a targeted rerun), four active-load lifecycle tests, seven navigation store/routes tests and both typechecks. The complete isolated native Windows OpenCode 2.0.5 UI fixture passes, including missing-anchor RPC semantics and native outline/window parity.
Do not treat a newer CLI's stopped status as proof that its older shared daemon is absent. Resolve native service metadata read-only through the selected execution host, match the channel's credential/configuration unambiguously, and authenticate historical metadata routes before admitting the registered endpoint. Repeat discovery inside ensure before starting.
Fail closed for malformed or oversized records, ambiguous identity, authentication failures, timeouts and existing WSL registrations with forwarding errors. Distinguish fresh configuration with no native registration, preserve the shared loopback policy including 127.0.0.2, and translate mounted/aliased WSL metadata through the selected distro.
Add lifecycle regressions and bounded, isolated packaged desktop acceptance. Both rebuilt Electron and Tauri retain an actual 2.0.3 daemon through installation until explicit restart, then activate 2.0.11 and resume the pending folder. Normal installation/reload and all three WSL modes pass. Final gatekeeper review reports no actionable findings; full server suite passes 621 tests with two skips.
Exercise the real Windows-to-WSL service lifecycle and plugin provisioning through native, mounted and aliased discovery roots. Use guarded fixture-owned registrations, unique service ports and fully isolated environments; record actual watcher behavior, measured lease heartbeats, explicit reload, restart and cleanup.
Characterize reload with a held synthetic provider stream and native pending Form, Shell and PTY. Verify one successful provider request without replay and record native resource teardown. Update all locale descriptions to explicitly include terminals and background commands.
Bound the whole fixture, native requests, predicates and cleanup independently. Handle detached event-consumer failures immediately while preserving awaited failure reporting. Seven guard regressions and final real aliased reload-safety acceptance pass; autonomous gatekeeper re-review reports no remaining fixture findings.
