4 commits

Author	SHA1	Message	Date
Pascal André	a9e624baf5	fix(opencode): qualify 2.0.22 and fence parent session creation (#830) ... ## Summary Qualify **OpenCode 2.0.22**, align server/UI client and plugin pins, and recommend this release. Keep the demonstrated **2.0.7** global minimum and **2.0.20** Codex Usage feature-local requirement. Block the new native `parentID` create variant in the workspace proxy: upstream ignores the supplied location and inherits the parent's directory. Require inspectable JSON objects to close opaque-body bypasses. Root creation and the existing authorized fork route remain available. Started at `dev@0983db3c` (#828 Windows test harness), then integrated `dev@97c361c3` (#789 Code Mode presentation). Conversation remains attached to `D:\CodeNomad`; all work and tests use explicit separate paths and synthetic data. ## Upstream audit: 2.0.21 → 2.0.22 - Authenticated native OpenAPI retains **116 paths**, with **11 schema differences**: session creation gains optional `parentID`, parent-not-found response/description; provider settings gain optional `headerTimeout` and `chunkTimeout=false`; configured model capability overrides become partial. No new proxy route or consumed mandatory API. - Published declarations: **4/30 client, 2/60 plugin, 3/36 protocol, 4/102 schema** files change. Plugin session domains expose `remove` and `compact`; CodeNomad does not add calls to them. Identifier namespace export is additive. - An isolated native fixture proves parent creation inherits the parent location despite a different supplied directory. Mock and production-proxy fixtures reject owned/foreign parents; malformed values and opaque content types are covered before any native request. Owned root creation stays available. - Runtime changes include HTTP header/chunk/whole-response timeout handling and bounded timeout retries, provider cache/error/tool-history fixes, model capability defaults, and legacy MCP shutdown cleanup. - Lock changes are limited to six `@opencode` packages and two workspace entries. Integrity/dependency metadata matches independently installed published packages; clean `npm ci --ignore-scripts` passes. Optional OpenTUI peers are not installed by CodeNomad. ## Isolated local qualification **Windows / Node 24.20.0**, isolated profiles, databases, services and synthetic providers/credentials. No shared-daemon or personal-history mutations. - Previous **2.0.21 dependencies + runtime 2.0.22**: native pruning/history/proxy acceptance passes. - New **2.0.22 dependencies + runtimes 2.0.7 and 2.0.22**: seven suites pass (automation, pruning/history/navigation, per-send environment, inclusive forks, idle/busy side questions, blank-session cleanup, Git-degraded recovery), plus explicit native proxy suites. - Native/UI pruning acceptance passes through the committed parent runner, with completion and actual child exit verified. This uses #828's early dependency-import workaround, not the old late-import order. No claim that underlying Windows heap corruption is repaired. - Current compaction-isolation acceptance passes: session B progresses while session A's provider response is held; bounded outline reads retain daemon heartbeats. Fixture runtime selection is extended to include 2.0.22; its assertions are unchanged. This supplemental fixture was not qualified on 2.0.7 (explicit runtime selector rejects it). - Native Codex Usage passes on 2.0.22 with synthetic OAuth/key credentials and mocked quota HTTP; not a live-account/WSL test. - Native migrations **2.0.3 → 2.0.22** and **beta-19271 → 2.0.22** preserve full history/forks/inbox/provider selection. - Packed standalone pruning plugin installed outside the repository passes native acceptance. - Native npm upgrade **2.0.15 → 2.0.22** passes; authenticated daemon remains **2.0.15 / PID 43876** before and after. - Full server run: **794 passed / 6 skipped / 0 failed**. Final guard revision separately passes **68 focused server tests** and native proxy suites on minimum/current. Aggregate runs use `--test-force-exit`. - Targeted client/store/reducer/usage UI: **63/63** with `--conditions=browser`, `--test-force-exit`, bounded timeout. Initial broad UI run used the wrong Node conditions and hung at `prioritized-read.test.ts`; only its owned processes were stopped. That incomplete run is **not green**. The same prioritized-read tests pass under the browser condition used by CI. No production fix is inferred from this launch correction. - **41 browser scenarios** pass: setup/install, auth recovery, tool images, rendered Codex Usage and compaction responsiveness. Browser tests do not use forced exit. - Server/UI/Electron typechecks and production server/UI/plugin builds pass. Revalidation after #789 integration and independent gatekeeper are reported separately below. Local results do not certify all real providers, Linux/macOS/WSL, or installed Electron/Tauri hosts. Historical Windows import and Git cleanup failures remain limitations, not repaired by this upgrade. Remote CI is not continuously monitored and no global CI-green claim is made. Size note: existing `packages/server/src/server/http-server.ts` is ~2,359 lines; `packages/server/src/server/__tests__/instance-proxy.test.ts` is ~1,139 lines. Changes are narrowly scoped; no unrelated size-driven refactor. ## Independent gatekeeper Review launched on exact head `0a7615476034eabbff54967aacc8a93ab0e6ab12` against `dev@97c361c33f6fa7de30be5dde31c0e26e12bab574`; verdict will be published before any admin merge. Findings will be corrected and reviewed again until zero actionable findings.	2026-10-02 15:47:14 +02:00
Pascal André	9ebc6534d6	feat(composer): unify native device attachments and project references (#729) ... Use one Attach file action for native device selection and retain project-scoped @ references in the active session worktree. Remove the duplicate upload entry and composer server browser, document the outside-project scope change, and translate attachment origins and feedback across all locales. Share serialized, bounded byte ingestion across picker, drop and clipboard. Fence open pickers and late reads across session/worktree/lifecycle changes, preserve edits and newer selections without stealing focus, release rejected-read budgets, and restore failed custom-command drafts by attachment identity. Validate project directories through existing workspace ownership before filesystem listing/search. Cover the behavior with 20 attachment and 11 session-aside browser scenarios, attachment/submission/persistence units, server budget/proxy/ownership regressions, and isolated native Windows picker fixtures. Three independent review passes corrected five P2 findings and ended at zero; the final merged-head review confirmed that result. UI checks/build, Tauri release build and native picker smoke passed. Remote CI was still in progress at the explicitly requested admin merge.	2026-09-24 23:12:44 +02:00
Pascal André	bdac05bb25	fix(environment): refresh profile variables before each prompt (#714) ... ## Summary Apply the existing CodeNomad profile environment **before every prompt, custom command and session-shell send**, then forward the request only after OpenCode acknowledges it. This makes profile changes available to local commands even when the shared daemon is already running. No per-conversation settings UI, polling, session-opening writes or daemon restart. The implementation lives in the shared server for Electron/Tauri/web parity. close #711; awaiting reporter validation rather than automatically closing the issue. ## Implementation - Build a complete execution-host snapshot; preserve PATH and other inherited values, normalize Windows key collisions, and exclude internal authentication/storage variables. WSL reads its selected distro's environment instead of sending Windows PATH/HOME. - Apply after ownership checks and worktree mutation admission, using the pinned native connection. Fail the send on environment errors, stale connection or disconnect; never log the native environment request body. - Update help and failure messages in every locale. Changes and removals take effect on each conversation's next send. ## Validation - Server suite: **586 passed, 2 platform skips**. - Focused UI send/SDK/authority tests: **112 passed**. - Server, UI and Electron typechecks; production UI build passed. - **OpenCode 2.0.9 / Windows native fixture:** real WorkspaceManager + guarded proxy + native shells, two conversations, changes/removal, no mutation on read, Git Bash, unchanged daemon PID. Independent configuration/database/port; only the fixture service was stopped. - Reproduction: `node scripts/test-session-environment-native.mjs <absolute-opencode-executable>`. ## Scope This changes local session command environments, not provider/MCP/LSP configuration or daemon-internal temporary files. The native environment belongs to a session: another client or a new send during existing work can replace it. Queued prompts do not get individual snapshots, and native-created subagents are not automatically intercepted. Details: `dev-docs/SESSION_ENVIRONMENT.md`. Existing oversized files touched narrowly: `packages/server/src/server/http-server.ts` (~2,300 lines), `packages/server/src/workspaces/manager.ts` (~1,200 lines), and `packages/ui/src/lib/i18n/messages/*/settings.ts` (~600 lines each).	2026-09-19 18:18:56 +02:00
Pascal André	aa51cbb9ff	fix(opencode): support earlier and modern V2 runtime contracts (#695) ... Closes #694 ## Status This PR contains the stable 2.0.4 client migration, authenticated V2 discovery fallback and shared cross-runtime compatibility implementation. The validation results below are local execution evidence; the newly added CI matrix must also run on the updated PR head. ## Published changes - Pin UI/server to official `@opencode/client@2.0.4` and the bundled pruning plugin to `@opencode/plugin@2.0.4`, with the corresponding lockfile migration. - Probe authenticated `/api/status` first. Fall back to earlier V2 `/api/health` **only on HTTP 404**, retaining the endpoint, credentials, 64 KiB response bound and absolute deadline. Authentication, transport, server and malformed-status failures do not trigger fallback. - Migrate the canonical UI/server contract to stable Forms, permission decisions, command names, interrupts, renaming, forks, message lookup and inbox delivery. - Update the guarded proxy for stable methods/paths, native active-session envelopes, native `cursor.next`, global Form directory headers and current resource/plugin events. - Follow the renamed upstream platform binary `bin/opencode(.exe)` while retaining public CLI aliases. Discovery success alone does not establish compatibility with an earlier runtime's conversation APIs. ## Shared cross-runtime compatibility ### Shared cross-runtime integration - Introduce one connection-scoped adapter under `packages/server/src/opencode/compatibility/`, used by both the guarded UI proxy and direct server callers, including Yolo. - Select the contract using authenticated daemon identity rather than the CLI executable's version. Recognize unknown publications through authenticated, bounded OpenAPI negotiation instead of an exact runtime-version gate. - Bind authorization, client, transport and profile to one connection generation. Fence actual mutation dispatch after asynchronous body preparation; prevent late old streams from publishing or invalidating their replacement. - Translate earlier V2 routes, methods and payloads before sending. Never retry a mutation speculatively after 400, 404, authentication or transport failures. - Normalize legacy HTTP inbox timestamps, including compaction admission, before the pinned Solid reducer. Preserve the distinct native SSE inbox schema and durable event metadata. - Restore legacy catalog/content invalidation and permission-event convergence. Preserve meaningful method/path/status/profile diagnostics and native 401 error envelopes. ### Location authority and pruning - Preserve legacy workspace identity internally through request serialization, catalog/cache keys, Forms, imports, cursors, events and exact move rollback. Modern public APIs continue to reject obsolete workspace selectors. - Authorize complete locations before translating directories or synthesizing upstream Form/location headers. Keep native cursor tokens unchanged. - Preserve session/path ownership, worktree mutation fences and the restricted proxy allowlist. Generic RPC, plugin management and destructive revert commit remain blocked. - Carry verified legacy identity through pruning membership checks, preview and the existing transactional storage/claim fence; do not relax deletion checks. - Treat native idle records as control records, retaining identity/outcome without fabricated assistant text. - Add a common multi-runtime CI matrix and the audit/evidence register in `dev-docs/OPENCODE_V2_COMPATIBILITY.md`, including preserved historical architecture findings. ## Local validation All native tests use isolated synthetic daemons, configuration and databases, never the shared daemon or user storage. | Check | Result | | --- | --- | | Same native suite on beta-19271, 2.0.3, 2.0.4 and 2.0.5 with pinned client/plugin 2.0.4 | Passed | | Full native pruning suite with non-null legacy workspace identity on beta-19271 and 2.0.3 | Passed | | Rendered UI on modern 2.0.5 and beta-19271 with non-null identity | Passed | | Native 2.0.5 suite inside Ubuntu/WSL, using a temporary Linux filesystem root | Passed | | Server tests (after CI follow-up) | 500 passed, 2 skipped | | UI store tests | 441 passed | | Electron native tests | 194 passed, 4 skipped | | UI/server/Electron typechecks | Passed | | UI/server and Electron production builds | Passed | | Windows Tauri release executable (`--no-bundle`) | Passed | | Electron/Tauri packaged-resource smoke checks | Passed | | Desktop packaging invariants | 4 passed | | `git diff --check` | Passed | The native matrix exercises the actual shared connection, generated client, UI fetch adapter and guarded proxy: voice-off/on instructions, prompts, commands, session Shell, background Shell output cursors/removal, UI/Yolo permission acceptance and rejection, busy inbox delivery/cancellation, interrupt/wait, staged revert clearing, session/global/worktree Forms, native pagination, export/import, same-directory legacy identities, scoped events, foreign authority refusal and exact rollback. Pruning coverage includes actual storage identity and execution claims, busy refusal, idempotency, competing admission, next-model payload, fork isolation, pre-compaction history, restart, backend presence disposal/reopening and crash expiry. Rendered tests cover individual/group/response/session cleanup, confirmation counts, persistence and reload. ## Autonomous gatekeeper review Review/fix/retest loops concluded with no remaining actionable findings in the reviewed transport/lifecycle/proxy, identity/UI/events/pruning/rollback, scripts/CI and rendered-fixture scopes. Corrections included dispatch-generation races, compaction admission normalization, independent negotiation cancellation, first-request profile resolution, preservation of streamed 401 envelopes and direct Shell/PTY identity propagation. A final rendered failure was traced to the fixture awaiting only the first RPC of a cross-message deletion; the fixture and regression now await every affected message. Production deletion guards were not relaxed. This scoped approval does not close the separately preserved historical architecture findings. ## Validation boundaries ### CI follow-up The first run on `a0c1c943` ([35142559235](https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/35142559235)) failed in five native jobs. The local bundle tests had missed the standalone npm archive's missing sibling import, and Windows legacy jobs exposed a short-path versus canonical-path project comparison. The dependent artifact-comment job reported that same build failure. The follow-up makes the plugin's identity primitives self-contained, adds an isolated npm-file-list regression for all exported entrypoints, and corrects project identity selection with alias and nested-repository regressions. The packed-plugin failure was reproduced before correction; the corrected installed package passes the native suite on Windows 2.0.4 and Linux/WSL 2.0.4/2.0.5. The corrected 2.0.4 shipped bundle also passes rendered/native pruning. Fresh full beta-19271 and 2.0.3 `--legacy-pruning` suites pass under a reproducing Windows short-path TEMP root after the final exact-directory fix. Independent final reviews approve packaging/documentation and worktree identity with zero actionable findings. Remote checks on the new head remain the CI authority; these are local follow-up results. - Full interaction with the installed desktop application through Developer Mode was not verified because Developer Mode is inactive. The release executable and packaged-resource checks above are build/smoke evidence, not a fresh-install interactive certification. - Remote run [35146390688](https://github.com/NeuralNomadsAI/CodeNomad/actions/runs/35146390688) at `486e856d` passes all runtime-contract jobs, Windows/Linux native pruning, service compatibility, general tests and both Tauri checks. macOS passes packed-plugin loading/pruning, then times out on late bundle discovery. The fixture now canonicalizes its root before daemon startup to align `/var` configuration paths with `/private/var` FSEvents paths. Late installation remains mandatory and asserts the plugin was initially absent; failures now upload isolated diagnostic logs/inventory/captures. Actual macOS confirmation remains pending on the new head. - Interactive native TUI validation was not performed. - The passing WSL result is Linux-native execution inside WSL, not a complete Windows-host/WSL desktop traversal. With the fixture's configuration directory under `/mnt/c`, conversation/proxy checks passed but late plugin discovery timed out; the otherwise equivalent Linux-filesystem run passed. Mounted-configuration late discovery remains a documented environment limitation. - Other audited publications are declaration-reviewed, not individually native-certified. The four-runtime matrix does not imply universal V2 compatibility. - Earlier PR artifacts do not contain the completed cross-runtime implementation; use artifacts built from the updated head. Local passing results do not imply that the updated remote CI has completed.	2026-09-16 23:48:08 +02:00