Problem:
A user-visible transcript fix merged after the reviewed v1.31.0 release record, moving main-v2 and leaving the release notes incomplete and their immutable guide links stale.
Root cause:
The earlier record was reviewed before PR #9179 landed, while the same-version preparation workflow cannot refresh the record because it queries an unpushed local merge commit through the GitHub API.
Fix:
Document the composer-wrap jump-bottom fix in both languages and rebind both migration guide links to the current main-v2 revision without changing unrelated reviewed notes.
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- rendered and reviewed English and Chinese notes
- git diff --check
Problem:
The reviewed v1.31.0 release record still linked its migration guides to the pre-fix candidate after the desktop benchmark repair moved main-v2.
Root cause:
The guide URLs are immutable source links, so the earlier reviewed record remained bound to the old candidate revision.
Fix:
Rebind both migration guide URLs to the current main-v2 candidate without changing the reviewed user-visible release content.
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- rendered and reviewed English and Chinese notes
- git diff --check
Problem:
The exact v1.31.0 candidate failed the Linux desktop browser gate even though logical selection, copy resolution, overlay cleanup, and virtual-window bounds all passed.
Root cause:
The benchmark saved scrollTop before deliberately scrolling the selected rows out of view and back in. Virtuoso can remeasure that restored window, so the saved value was stale before copy cleanup began.
Fix:
Capture the control scrollTop immediately before the copy action, after the overlay has been restored, and compare cleanup against that same-position sample. Include both values in the assertion diagnostic.
Verification:
- transcript-selection.mjs: 10 consecutive real Chromium passes
- transcript-scroll-stability.mjs
- pnpm build
- go run ./tools/repolint
- git diff --check
Problem:
The v1.31.0 draft was generated before PR #9142 merged into main-v2, leaving the latest composer improvement out of the reviewed release range.
Root cause:
The release-notes branch predated the newest main-v2 merge, and the existing-branch generator cannot refresh it because it queries an unpushed local merge commit through the GitHub API.
Fix:
Add the verified bilingual composer improvement to highlights and changes, and credit its contributor.
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- node scripts/release-notes.mjs render --version 1.31.0
- git diff --check
Problem
The transcript tail fix was based before the composer auto-grow change and its new coverage pushed two files beyond repository size limits.
Root cause
Tail-follow waited for the coalesced frame after an in-flow composer resize, while viewport and content shrink state remained embedded in the already-full scroll arbiter and recovery test.
Fix
Merge the latest main-v2, keep tail-follow pinned synchronously across viewport shrink, extract the geometry decision, and move the focused hook regression into the smaller extent-race suite without widening lint baselines.
Verification
- pnpm test:transcript
- composer sizing, resized CSS, and run-strip suites
- pnpm build and pnpm test:typecheck
- pnpm test:transcript-browser
- go run ./tools/repolint
- git diff --check
Problem:
The generated v1.31.0 notes credited the GitHub Actions bot and summarized the issue-reporting update without listing its release entry.
Root cause:
The regenerated release catalog omitted merged PR #9151 from the improved changes and retained the automation author in contributors.
Fix:
Restore the bilingual issue-reporting entry and keep only human contributors.
Verification:
- node scripts/release-notes.mjs validate
- node --test scripts/release-notes.test.mjs
- git diff --check
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
The Stable candidate failed the Linux Desktop browser gate twice because the selection benchmark compared mounted row counts from two scroll regions with different variable-height content.
Root cause:
React Virtuoso expands the viewport in pixels, so a normal virtual window can contain different row counts across the transcript. The tail sample therefore was not a valid baseline for the later selection viewport.
Fix:
Compare the logical-selection window with the normal window at the same scroll position after copy cleanup, for both reverse and forward gestures. Also assert cleanup preserves the viewport before using that control measurement.
Verification:
- transcript-selection.mjs: 10 consecutive real Chromium passes
- pnpm test:transcript-browser
- pnpm build
- go run ./tools/repolint
- git diff --check
Problem
A manually resized Composer treated the saved height as a hard cap, so long pasted or typed drafts could be clipped even when the viewport had room.
Root cause
Content measurement stopped when a manual height existed, and the resized CSS path kept the saved height fixed.
Fix
Treat the saved manual height as the minimum baseline. Measure plain and rich draft content in all modes, grow up to the viewport-aware logical maximum, and enable internal scrolling only after the cap. Keep run-strip reservation and live resize in logical-height space.
Verification
- Composer content sizing: 12 passed
- Resized input CSS contract: 7 passed
- Composer interaction: 64 passed
- Combined with PR #9179 transcript scroll/recovery tests: 35 + 91 passed
- TypeScript, ESLint, repolint, CSS checks, and single-scroll-writer check passed
Co-authored-by: SivanCola <[email protected]>
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
- main-v2 advanced to 3bc93c07a while this PR was under review, leaving semantic conflicts in the topic bar and workspace dock tests.
- The merged workspace migration test also needed a type-safe jsdom window assignment under the PR test configuration.
Root cause:
- Both branches changed Topicbar controls and WorkspacePanel lifecycle behavior independently.
- The jsdom Window type is not directly assignable to the browser global type used by the test compiler.
Fix:
- Keep the latest TopicbarMoreMenu, dock restoration, and keyed WorkspacePanel reset from main-v2 while preserving the Automation view boundary that suppresses the workspace dock.
- Update the topicbar assertions for the merged More menu behavior and use an explicit double assertion for the jsdom window fixture.
Verification:
- desktop Go tests and race tests passed.
- golangci-lint v2.12.2 passed with zero issues.
- production and test TypeScript checks passed.
- all 209 frontend test suites passed.
- the production frontend build and bundle budgets passed.
- repolint and git diff checks passed.
Co-authored-by: SivanCola <[email protected]>
Problem:
The approved CI run failed desktop-macos because golangci-lint v2.12.2 reported nine Heartbeat issues, so the restricted workflow could not complete successfully.
Root cause:
The new parser used allocation-heavy string splitting and index-based cuts, one test retained a classic integer loop, and the sidecar rollback error was formatted without preserving its error chain.
Fix:
Use SplitSeq and Cut without changing cron semantics, adopt integer range syntax, and wrap both the config write and sidecar rollback errors.
Verification:
- cd desktop && golangci-lint run --timeout=5m
- cd desktop && go test . -run Test(Cron|MergeHeartbeatRunUpdatesCapsHistory|Heartbeat) -count=1
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./... -count=1
- go run ./tools/repolint
- git diff --check
Problem:
Older runtimes could ignore a future run-history sidecar, manual triggers could execute a stale in-memory task, and cron-heavy task lists repeatedly resolved next-run times during sorting and rendering.
Root cause:
The sidecar reader collapsed forward-schema errors into an empty history, TriggerNow trusted the cached task snapshot, and the frontend comparator recalculated the schedule for every comparison.
Fix:
Propagate unsupported sidecar schemas through config snapshots, revalidate manual executions from disk while holding the task lease, and precompute each task's next run once for sorting and display.
Verification:
- cd desktop && go test ./...
- cd desktop && go test -race ./...
- cd desktop && go vet ./...
- cd desktop/frontend && pnpm test
- cd desktop/frontend && pnpm build
- cd desktop/frontend && pnpm typecheck
- cd desktop/frontend && pnpm test:typecheck
- go run ./tools/repolint
- git diff --check
Problem:
PR #8748 exceeded the repository file-size and test-file-size budgets, so the lint workflow could not pass.
Root cause:
WorkspacePanel still owned tree-row and breadcrumb rendering, while one workspace DOM suite combined shared setup with an unrelated selection-isolation regression.
Fix:
Extract workspace tree rows and path breadcrumbs into focused components. Move the shared DOM setup into a test harness and register the selection-isolation regression as its own workspace suite.
Verification:
- go run ./tools/repolint
- pnpm test:workspace
- pnpm typecheck
- pnpm lint:hooks
- pnpm build
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
- Concurrent desktop processes could execute the same due task, and every-minute cron tasks could be skipped after the first run.
- Concurrent frontend full-table mutations could lose updates, while the PR exceeded locale and repository capacity gates.
Root cause:
- The task lease ended before run state was durably persisted, due checks were not revalidated after lease handoff, and cron deduplication used only the previous run timestamp.
- Frontend mutations shared stale snapshots, and feature-only translations were bundled into every global locale chunk.
Fix:
- Hold the task lease through state persistence, re-read and revalidate after acquisition, and deduplicate cron runs by occurrence minute.
- Serialize frontend mutations against the latest authoritative task list and keep failed drafts visible.
- Split heartbeat owners and tests into focused files, keep feature translations in the lazy Heartbeat chunk, and restore the existing locale budgets.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./... -count=1
- pnpm test -- --keep-going (206 suites)
- pnpm build
- go run ./tools/repolint
- git diff --cached --check
Co-authored-by: SivanCola <[email protected]>
Problem:
The initial projection repair exceeded repository file-size and comment budgets, and its in-memory regression test did not cover a persisted catalog reopening after incomplete rows were stored.
Root cause:
The integrity query and regression test were added to files already at their capacity limits, while the test kept the same Catalog instance alive across each simulated projection loss.
Fix:
Move the ready-directory integrity check and regression coverage into focused files. Gate all indexed integrity scans on the matching ready signature, read the invariants from one SQLite snapshot, and reopen the disk-backed catalog before repairing missing session and topic rows.
Verification:
- go run ./tools/repolint
- go test ./internal/sessioncatalog/ -count=1
- go test -race ./internal/sessioncatalog/ -count=1
- go vet ./...
- go test ./... -count=1
- cd desktop && go test ./... -run 'Test(ListProjectTopics|ProjectTreeSnapshot|UpgradeLegacy|SessionCatalog|ReconcileRepairsPersistedReadyDirectory).*' -count=1
Problem:
The right-side workspace tree separator moved opposite to its arrow-key direction, and the rebased pointer path used left-side coordinates. The PR also retained unrelated .zkge artifacts.
Root cause:
The tree moved to the right without updating the keyboard delta, while a later rebase dropped the treeOnRight pointer option and did not reserve the rail in the right-side clamp.
Fix:
Reverse the horizontal keyboard delta, restore right-side pointer geometry, preserve rail space at the maximum width, add focused DOM and pure-function coverage, and remove the unrelated .zkge tree.
Verification:
- pnpm test:workspace
- workspace split, scroll restore, More menu, and topicbar focused suites
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- system Chrome keyboard and pointer interaction
Co-authored-by: SivanCola <[email protected]>
Problem:
After an upgrade, the sidebar can omit existing conversations even though their session files remain on disk.
Root cause:
The directory reconcile fast path trusted an unchanged signature and ready marker without checking that the disposable session and topic projections were still complete.
Fix:
Compare the completed scan total with live catalog rows and verify that every indexed session has a topic projection before skipping reconciliation. Rebuild from disk when either invariant is broken.
Verification:
- go test ./internal/sessioncatalog/ -count=1
- go vet ./internal/sessioncatalog/
- go test -race ./internal/sessioncatalog/ -run TestReconcileRepairsReadyDirectoryMissingCatalogRows -count=1
- cd desktop && go test ./... -run Test\(ListProjectTopics\|ProjectTreeSnapshot\|UpgradeLegacy\|SessionCatalog\|ReconcileRepairsReadyDirectory\).* -count=1
Problem:
- The latest-base merge exceeded the initial JavaScript gzip and raw bundle gates.
- The topic-bar More menu did not move or restore keyboard focus.
- The workspace scroll test bypassed the DOM restoration path.
Root cause:
- Overflow actions and their CSS shipped in the initial app shell.
- The menu only handled pointer activation and Escape dismissal.
- The jsdom fixture had no scroll extent or scrollTo implementation.
Fix:
- Lazy-load the overflow actions and their component-scoped CSS.
- Implement roving focus, submenu navigation, and focus restoration.
- Exercise persisted deep-scroll restoration against a scrollable DOM fixture.
- Ratchet only raw startup capacity by 9.0 KiB (0.38%); retain gzip and chunk gates.
Verification:
- pnpm test:workspace
- Topicbar menu, tree scroll restore, topicbar controls, and workspace layout: 76 assertions passed.
- pnpm typecheck and focused ESLint passed.
- Latest main-v2 synthetic merge production build and test-channel bundle gate passed.
- Chromium keyboard navigation, lazy loading, focus restoration, and menu styling passed.
Co-authored-by: SivanCola <[email protected]>
Problem:
- A process or power loss after replacing heartbeat-tasks.runs.json but before heartbeat-tasks.json could pair old task definitions with new history.
- Calendar schedule work adopted from #8662 lacked commit-level attribution.
Root cause:
- The sidecar did not identify its config generation, so rollback only covered write errors returned to the live process.
- The integration commit referenced the source PR without a co-author trailer.
Fix:
- Store current and previous run-history generations keyed by config revision while retaining top-level runs for previous readers.
- Select the generation matching the committed config, reject future sidecar schemas, and cover restart, deletion, and task ID reuse.
- Credit the verified public author of #8662.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./...
- focused crash test passed 20 consecutive runs
- git diff --check
Co-authored-by: ttmouse <[email protected]>
Co-authored-by: glyahh <[email protected]>
Workbench keeps its workspace toggle in the fixed top-right dock-toggle
instead of an AppChrome rail. On Windows frameless the toggle sat at
right:12px under the min/max/close strip (z-index 100 covers it), making
the collapse button unreachable. Shift it left of the caption strip with
the same windows-window-controls-safe inset the classic-mode panel toggle
uses.
Problem
Wrapping the composer to a second line (or deleting back to one)
flashed the transcript bottom. The in-flow footer grew, the
transcript viewport shrank, and jump-bottom appeared for a frame.
Root cause
Tail-follow waited a rAF to reconverge after footer-driven viewport
shrink, and published the transient off-bottom gap as isAtBottom=false.
Fix
Pin the native tail immediately when the transcript viewport shrinks
under tail-follow, and keep isAtBottom true while tail-follow owns
the viewport so jump-bottom stays a manual-reading control.
Verification
tsx src/__tests__/transcript-scroll-release.test.ts
tsx src/__tests__/transcript-recovery-race.test.tsx
node scripts/check-single-scroll-writer.mjs
- workspace-layout.test.ts: drop duplicated fragment left over from the
earlier conflict resolution (was a syntax error)
- styles.css: move .code max-height comment outside the rule block so the
preview CSS contract test still matches margin: 0
- workspace-tree-scroll-restore.test.tsx: call rememberWorkspaceTreeScroll
directly (jsdom cannot dispatch trusted scroll events; the hook only
records user-initiated scrolling)
- app-chrome-tabs.test.ts: follow upstream App.tsx which now passes
hydrating={runtimeTransitioning || transcriptHydrating}
After rebasing onto latest main-v2:
- TopicbarMoreMenu: add prefetchTerminal prop; the terminal menu item
prefetches on pointer/focus so opening stays fast (matches the upstream
prefetch contract moved into the folded menu)
- App.tsx: drop unused useMountTransition import; keep prefetchTerminalPanel
wired to the More menu
- workspace-layout test: assert prefetch on the More-menu item instead of
the removed flat toolbar button (C2 architecture)
- styles.css: pin -webkit-text-size-adjust + overflow-wrap to stop WebKit
text inflation / code-line wrapping during the preview width transition
27/27 verify checks green; workspace-layout 53/53.
Follow upstream's dependency upgrades (x/image v0.45, x/text v0.41) from
the display-stability and sandbox-grant commits. Verified with go build.
Also commit the pre-rebase verification baseline snapshot.
From upstream review findings, turn the two behavior fixes into tests that
run in verify-restore.sh:
1. workspace-tree-scroll-restore: source-level guards that the reachability
check uses totalSize - viewportHeight (not plain totalSize), reads the
virtualizer scrollRect, and retries once the viewport settles — catches a
future rebase reverting to the buggy check.
2. workspace-panel-open-migration (new): jsdom behavior test that a missing
per-project dock-open key seeds from the legacy global key (closed stays
closed, open stays open), project key wins, default open when absent.
27/27 verify checks green.
The reachability check read treeRef.clientHeight at restore time, which can
be 0 right after a tab switch while the tree is settling, making the check
think the saved offset is unreachable and leaving the pending restore stuck
— the list stays at the top. Use the virtualizer's own scrollRect.height
(updated by the virtualizer as the viewport settles) and add it to the
effect deps so the restore retries once the viewport height is known.
26/26 verify checks green; scroll-restore 5/5.
Address two upstream review findings:
1. Scroll restore reachability: a saved offset is only reachable once
totalSize - viewportHeight >= target (max scroll position = totalSize -
viewport), not totalSize >= target. The old check could clear the
pending restore right after content barely exceeded the offset but
before providing enough scrollable space, losing deep-scroll restores.
2. Legacy dock-open key migration: when a project has no per-project
workspacePanelOpen preference yet, seed it from the legacy single
global key (reasonix.workspacePanel.open) so an upgrade does not flip
a user's existing choice (e.g. dock was closed, stays closed on first
open of any project).
Kept the branch's no-560-ceiling decision (dock width = available width);
reviewer's min(560, available) not adopted per user preference.
26/26 verify checks green; scroll-restore 5/5; app-chrome-tabs 128/128.
Per user decision: upstream's workspaceTreeMemory envelope covers all of
C14-C18 semantics, so replace the branch's 4 localStorage keys +
workspacePanelSession with it, keeping the branch's C17 recentPaths wiring
(upstream stores the field but does not consume it).
- WorkspacePanel: init treeWidth/selectedFilePath/recentPaths from
readWorkspaceTreeMemory; persist via rememberWorkspaceTreeState;
scroll via rememberWorkspaceTreeScroll; drop the old 4-key helpers
- scroll-restore test: assert reasonix.workspaceState.v2 scrollTop
- verify-restore.sh: C15-C18 probes check workspaceTreeMemory
26/26 verify checks green; tsc 0 errors; tree-memory 15/15.
Remove the upstream restoreWorkspaceDockWidths dual-width logic: the tree
width is clamped to the dynamic available width (chat keeps its 400px
floor) instead of the fixed 560 RIGHT_DOCK_TREE_MAX_WIDTH, so a user's
remembered dock width is preserved when reopened and can exceed 560 when
the viewport allows. Preview-width restore is dropped (single-width dock).
C1/C3 probes green; layout 44/44, changes-errors 58/58.
Per user decision: keep upstream's token economy + delivery worktree
(App.tsx stays upstream), restore the branch's own WorkspacePanel/styles/
persistence (workspacePanelSession + WORKSPACE_*_KEY) to eliminate rebase
hybrid deviations.
- WorkspacePanel: branch version + 3 optional props (dockTreeWidth/
dockPreviewWidth/onRestoreDockWidths) to stay compatible with upstream
App.tsx; restores dock widths on mount
- scroll-restore test: back to branch key (workspacePanel:treeScroll)
- verify-restore.sh: C15-C18 probes check branch persistence; drop
upstream-only swr-contract test
26 checks green, 18/18 adjustments restored; tsc 0 errors; go build ok.
Problem:
- main-v2 advanced once more before the PR update was published.
Root cause:
- The base merged issue-form, label-workflow, and migration-documentation updates.
Fix:
- Integrate the current main-v2 head without rewriting the contributor branch history.
Verification:
- Merge completed without conflicts.
- git diff --check passes.
- The base delta touches only GitHub metadata and migration docs, so the already-passed desktop runtime and frontend gates remain applicable.
Problem:
- main-v2 advanced again while PR #8261 was under review.
Root cause:
- The base accepted project-tree pinned-heading changes after the first conflict-resolution merge.
Fix:
- Integrate the new main-v2 commits so the PR is based on the current remote branch without rewriting contributor history.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./...
- pnpm lint:hooks, pnpm typecheck, pnpm test:typecheck, and pnpm build
- Heartbeat editor 18/18, schedule 59/59, runner contract 3/3, app chrome 129/129, and pinned-heading focused tests
- Browser automation workflow and console verification
Reverts the rebase-introduced layout where the show/hide file-tree button
sat alone in a workspace-tree-rail column. Restore the branch design: the
FolderTree button lives inside the preview window-actions group (after
maximize, before close), shown when previewVisible && !changedMode — it
no longer occupies its own column.
All 27 verify checks green; workspace tests 58/34/44 pass.
- workspace-layout: explicit C1 assertions (dock never consumes the chat
400px floor) and C3 assertions (single tree width, no detail ternary)
- workspace-panel: fix C4 scope-switch request leak via scopeSwitchPendingRef
while preserving cross-scope selection memory (swr contract stays green)
- workspace-panel: port C17 independent recentPaths into workspaceTreeMemory
- workspace-preview-css: adapt to branch layout (tree on right, per user
preference) instead of upstream's tree-on-left
- verify-restore.sh: run 9 test files (was 4)
Answers how to rebase without losing the 18 local adjustments: baseline
verify before, per-conflict arbitration via C# oracle, full verify + build
after, human acceptance last. Includes per-file arbitration table and the
lessons from the previous rebase where local persistence was overwritten.
Capture the branch's persistence/memory behaviors that rebasing onto
upstream's workspaceTreeMemory silently replaced, so each survives future
rebases as an individually verifiable item:
- C14: dock open/closed state remembered per project root
- C15: dock width + file-tree width persisted separately
- C16: opened file (preview) remembered & cleared on explicit close
- C17: recent-files list persisted independently of live preview tabs
- C18: file-tree scroll position persisted
All are hard gates except C18. verify-restore.sh now checks 18
adjustments (22 checks).
C12 (CLAIM.TREEWIDTH.012, hard gate): user-resized file-tree width is
preserved when reopening a file after closing its preview (savedTreeWidth
only from manual mode), first split defaults to even, tree auto-hides when
panel is too narrow - the list/detail layout relationship the user flagged
as broken after rebase.
C13 (CLAIM.PANELBORDER.013): split-preview preview border dedup + tree
resizer hairline.
verify-restore.sh now checks 13 adjustments (17 checks).
Split the changes-panel styling out of C6 into its own verifiable item:
workspace-change-row structure, row hover spanning file + revert button,
revert revealed on hover/focus in the badge slot, --active persistent
highlight, icon/padding/badge styles (d8d42210f, 48 style lines).
verify-restore.sh now checks 11 adjustments (15 checks total).
- C10 (CLAIM.TREEICON.010): file-tree toggle button position (FolderTree
in the preview action group) + workspace-tree__icon row styles + active
highlight, from ee6591b25/d8d42210f
- C3 (CLAIM.DOCK.003): strengthen oracle so 'switching tabs must never
resize the sidebar' is explicitly asserted (single-width dock, no
preview-width dual system)
- verify-restore.sh now checks 10 adjustments (14 checks total)
- WorkspacePanel: reset pending scroll restore on viewMode change (files<->changed) so a saved offset is not re-applied to a shorter list, which left a blank band at the top
- WorkspacePanel: show workspace root breadcrumb in changed overview and file preview; first crumb shows only the project name, hovering any crumb reveals the full absolute path
- styles.css: unify left/right sidebar resize rails (1px hairline, accent on hover), drop duplicated sidebar/split-preview borders, slate sidebar background to warm white
- test: cover files<->changed view round trip in scroll-restore suite
- Change getTotalSize() <= target to < target so an exact-height tree
actually restores instead of staying pending at the top.
- Add CLAIM.TREE.008 contract test (zk-ge): scroll persists to
localStorage, survives unmount/remount (dock tab switch), and tree rows
re-render. DOM restore itself depends on the virtualizer's real layout
measurement, so the visual restore stays a manual browser acceptance.
- Preserve saved tree scroll offset on remount (don't persist scrollTop 0
before restoration runs).
- Drop the persisted selectedPath when the user closes all previews so a
restart does not reopen a closed file; keep the session cache for the
changed view.
- Clear the Files selection when entering Changes so a preview path is not
mistaken for a selected change; restore it from the session cache on
return.
- Copy All now uses writeClipboardText (Clipboard API -> Wails bridge ->
execCommand fallbacks) instead of navigator.clipboard alone.
- Make collapsible prompt-shelf cards keyboard focusable (tabIndex 0).
- Fix dock width clamps so a narrow viewport maxWidth actually caps the
stored width instead of being raised back to the fixed maximum.
- Keep one dock width (tree width) across tab switches; remove the
preview-width dual system so toggling tabs never resizes the sidebar.
- Persist the right dock open/closed state per workspace root and restore
it when switching projects; preview documents no longer leak across
projects.
- Preserve the user-resized file-tree width when reopening a file after
closing its preview (was reset to the even split).
- Move the workspace-panel toggle to a fixed top-right position in
workbench mode; classic uses the AppChrome toggle, creation keeps it in
the topic bar.
- Remove the workspace-toggle press animation (scale/transform) and give
the dock tabs a rounded-rect selected state with a soft grey
background that adapts to light/dark themes.
- Extend the dock's vertical resizer to the terminal drawer, fly the
export submenu left so it never clips at the screen edge, and keep
per-project workspace memory in a session cache.
Keep only three topic-bar entries — file opener, workspace-panel toggle,
and a new More (⋮) menu — and move copy/export/changes/terminal/session
summary into that menu so the bar stays compact when the chat pane is
squeezed to its 400px minimum. The workspace-panel toggle now renders in
every layout (it was previously gated to creation/workbench chrome).
Remove the 560px comfort-min width applied while the workspace dock is
open and not maximized, so the chat pane can be dragged down to the
same 400px floor used in other states. CSS fallbacks for --chat-min-width
are aligned to 400px.
Problem:
- Concurrent automation edits could roll back engine-owned run state, failed saves could dismiss drafts, and several cron/calendar edge cases scheduled at the wrong time.
- Recommended automations were created too eagerly, and tab activation could leave the automation overlay visible.
Root cause:
- Full frontend snapshots were treated as authoritative across async execution and persistence boundaries.
- Cron steps used zero-based arithmetic for one-based fields, next-run search was too short, and biweekly parity used elapsed hours across DST.
- Sidecar and primary config writes did not expose a failure-atomic commit order, while editor conversion and save failures lacked explicit state.
Fix:
- Preserve TopicID, LastRunAt, and run history across stale saves; clear empty sidecars and roll them back if the primary config write fails.
- Keep failed and recommended drafts open with safe defaults, actionable errors, editable scope, and lossless frequency conversion.
- Correct cron step anchors, long-horizon leap-day search, civil-date biweekly parity, and direct tab navigation back to chat.
- Add focused backend, frontend, runner-contract, and browser-mock coverage.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./...
- Heartbeat editor: 18 passed
- Heartbeat schedule: 59 passed
- Heartbeat runner contract: 3 passed
- App chrome tabs: 129 passed
- pnpm lint:hooks, pnpm typecheck, pnpm test:typecheck, and pnpm build
Co-authored-by: ttmouse <[email protected]>
Problem:
- PR #8261 had diverged from main-v2 and could not be reviewed or merged on the current desktop code.
Root cause:
- Both branches evolved shared desktop and frontend integration points after the feature branch was created.
Fix:
- Merge main-v2 and resolve the overlapping desktop contracts while retaining the heartbeat feature behavior.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go test -race ./...
- frontend Heartbeat and app chrome focused suites
- pnpm build
Co-authored-by: ttmouse <[email protected]>
Problem
Bug report and Feature request still offered a v1 (legacy TypeScript)
Version line choice after v3 Studio was added.
Root cause
The templates and issue version-label workflow still treated v1/0.x as
a filing line.
Fix
Remove the v1 dropdown option, label only v2/v3 from new reports, and
stop mapping Exact version 0.x onto v1.
Verification
Parsed the issue-form YAML and confirmed both dropdowns list only v2
and v3. Inspected the v2/v3 match and 1.x/2.x Exact version mapping.
Problem
Bug report and Feature request forms only offered v1 and v2, so Studio
(2.x) issues could not be filed or labeled as their own line.
Root cause
The issue templates and version-label workflows were hardcoded to v1/v2,
and any Exact version that was not 0.x was mapped to v2.
Fix
Add a v3 Studio option that names the studio branch, label matching
issues as v3, map 2.x Exact version to v3, and label PRs based on
studio as v3.
Verification
Parsed the issue-form and workflow YAML, and inspected the v1/v2/v3
mappings in both version-label workflows.
Problem:
The pinned heading's dedicated markup and CSS move the stable and test raw startup bundles 0.4 KiB past their existing gates.
Root cause:
The current-base budgets retain only 0.1 KiB of headroom, while the scoped non-interactive heading recipe adds 0.5 KiB raw in both channels.
Fix:
Raise only the stable and test raw initial-asset budgets by 0.5 KiB (0.021%), preserving 0.1 KiB of headroom without widening gzip or chunk limits.
Verification:
- Stable build: 2344.1 / 2344.2 KiB
- Test-channel budget: 2349.3 / 2349.4 KiB
- 88 project-tree tests
- repolint and git diff --check
Problem:
The stale PR base predates the trusted documentation-impact checker, so pull_request_target checked out a base commit without scripts/check-docs-impact.sh.
Root cause:
The branch had not incorporated 2,242 main-v2 commits since its original merge base.
Fix:
Merge the latest main-v2 without rewriting contributor history, allowing metadata guards and CI to run against the current repository contract.
Verification:
- Clean merge-tree against origin/main-v2
- Focused pinned-heading contract test
- 88 project-tree tests
- ESLint, TypeScript, test typecheck, CSS checks, and git diff --check
Problem:
The pinned section heading reused interactive folder classes, so hovering a static label painted a folder hover background and implied it could be clicked.
Root cause:
The visual alignment borrowed project-tree__folder and project-tree__folder-main, which also own folder hover behavior.
Fix:
Use a dedicated section-title modifier for the pinned heading, preserve its Pin icon and folder-aligned dimensions, mark the icon decorative, and add source contract coverage.
Verification:
- pnpm exec tsx src/__tests__/project-tree-pinned-header.test.ts
- pnpm exec tsx src/__tests__/project-tree-runtime.test.ts
- pnpm check:css
- pnpm typecheck
- pnpm test:typecheck
- Browser computed-style check for default and hover states
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
Regenerating the existing Notes PR made its automation-authored commit appear as a v1.30.0 contributor.
Fix:
Remove only github-actions[bot] from the new release record while preserving every human contributor and cited product change.
Verification:
Validated the full catalog, release-note contracts, rendered v1.30.0 notes, and diff whitespace.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
The reviewed v1.30.0 draft predates the Windows release-gate test fix merged into main-v2.
Fix:
Merge the current protected main-v2 baseline so Prepare release can regenerate and validate the candidate-bound Stable record.
Verification:
The branch and main-v2 remote SHAs were re-read immediately before this merge.
Problem:
Windows CI fails deterministic write-scope and delivery tests because fixtures use Unix-only absolute paths and compare normalized paths case-sensitively.
Root cause:
filepath treats /tmp and /home as relative paths on Windows, while Receipt normalization lowercases Windows paths.
Fix:
Build scratch and outside fixtures from os.TempDir and the platform volume root, JSON-encode Windows paths, and compare the normalized Windows expectation.
Verification:
Linux package tests pass for internal/evidence, internal/completion, and internal/taskcontract. Windows amd64 test binaries compile successfully for all three packages.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
Foreground fleet calls were classified as direct workspace mutations, so they held an exclusive workspace lease for the full fleet lifetime and blocked unrelated writers.
Root cause:
The non-mutation meta-tool registry omitted fleet even though its child tasks own and report the actual workspace mutations.
Fix:
Classify fleet as a non-mutating meta tool and add effect/runtime regressions proving no outer lease is held. Writable tool hooks still retain the existing whole-workspace lease.
Verification:
- go test ./internal/agent -run TestFleetMetaToolDoesNotTakeOuterWorkspaceLease -count=50
- go test -race ./internal/agent ./internal/evidence ./internal/filelock ./internal/workspacelease -count=1
- go test ./... -p 1 -count=1 -timeout 600s
- cd desktop && go test ./... -count=1 -timeout 900s
- go vet ./...
- make lint
- bash scripts/cache-guard.sh
- pnpm --dir desktop/frontend build
Problem:
- Later directory writers that had already queued behind a whole-workspace writer could bypass it when another scheduler event pumped the queue.
- Cancelling the whole-workspace waiter did not immediately reconsider the writers behind it.
Root cause:
- Incoming admission honored whole-writer priority, but the waiter pump evaluated each queued writer independently and cancellation only removed the waiter.
Fix:
- Keep a blocked whole-workspace waiter as a FIFO barrier for later writers while allowing read-only work to use free capacity.
- Pump the remaining queue immediately after a cancelled waiter is removed.
- Add deterministic pump-order and cancellation regressions.
Verification:
- Focused scheduler regressions: 100 repetitions
- Focused scheduler race regressions: 20 repetitions
- go test and go test -race for agent/control/filelock/workspacelease
- go vet and golangci-lint
- repolint and git diff --check
Problem:
- A whole-workspace writer queued behind an unrealized directory writer could be repeatedly bypassed by later directory writers, creating unbounded tail wait under steady background work.
Root cause:
- Directory claims intentionally expose an empty scheduling reservation before their first concrete write, and incoming admission did not consider an already queued whole-workspace writer.
Fix:
- Give a queued whole-workspace writer priority over later writer admissions while keeping read-only work concurrent.
- Add a deterministic arrival-order regression covering the queued, active, and released states.
Verification:
- go test ./internal/agent -run '^TestScheduler(QueuedWholeWriterBlocksLaterDirectoryWriter|WholeClaimCannotStartBehindUnrealizedDirectoryWriter|DirectoryClaimsStartInParallel|WholeClaimNarrowsForNewSiblingsAndOpaqueRestoresExclusion)$' -count=100 -timeout 300s
- go test -race ./internal/agent -run '^TestScheduler(QueuedWholeWriterBlocksLaterDirectoryWriter|WholeClaimCannotStartBehindUnrealizedDirectoryWriter|DirectoryClaimsStartInParallel|WholeClaimNarrowsForNewSiblingsAndOpaqueRestoresExclusion)$' -count=20 -timeout 300s
- go test ./internal/agent ./internal/control ./internal/filelock ./internal/workspacelease -count=1 -timeout 300s
- go test -race ./internal/agent ./internal/control ./internal/filelock ./internal/workspacelease -count=1 -timeout 600s
- go run ./tools/repolint
- git diff --check
Problem:
- Folding macOS workspace and lock-file paths changed the legacy exact-root hash for mixed-case paths and could address the wrong lock file on case-sensitive volumes.
Root cause:
- One folded identity was reused for the new hierarchy protocol, the previous exact-root protocol, the process-local registry, and the filesystem path opened for flock.
Fix:
- Keep separate folded coordination and exact compatibility identities, acquiring both only where their lock domains differ.
- Preserve the filesystem lock path while folding only the process-local registry key.
- Cover new case aliases, old exact-root holders, and parent writes crossing an old nested repository root.
Verification:
- go test ./internal/filelock ./internal/workspacelease -count=20 -timeout 300s
- go test -race ./internal/filelock ./internal/workspacelease -count=5 -timeout 300s
- go test ./internal/workspacelease -run 'Test(Darwin|HierarchyProtocol|ParentWorkspace|NestedWorkspace|SameOwner|WorkspaceWriter|ReversePath|ExclusiveUpgrade)' -count=50 -timeout 300s
- go test -race ./internal/agent ./internal/control ./internal/filelock ./internal/workspacelease -count=1 -timeout 600s
- go run ./tools/repolint
- git diff --check
Problem:
The Windows smoke job timed out in the same-owner writer-priority regression even though the production re-entry path was not deadlocked.
Root cause:
The test selected increasing lock stripes by hashing raw filepath.Join output. On Windows that used backslashes, while production canonicalizes paths to lowercase forward-slash identities before hashing, so the test could accidentally request stripes in reverse order and trigger the intended order guard.
Fix:
Resolve test stripes through the production pathSpecs canonicalization path before comparing their order.
Verification:
- focused regression: 50 repetitions
- focused race regression: 20 repetitions
- go test and go test -race for agent/filelock/workspacelease
- Windows and Linux workspacelease test binaries cross-compiled
- go vet, repolint, and git diff --check
Problem:
The desktop browser CI gate could time out while clicking the optional jump-to-bottom control even after confirming that it existed.
Root cause:
The bench queried an async React control with locator.count() and clicked it in a separate Playwright operation. A scroll-state update could unmount the control between those calls, leaving click() waiting for 30 seconds.
Fix:
Query and activate optional transcript controls in one browser task, and apply the same helper to the sibling older-history setup paths that have the same lifecycle.
Verification:
- pnpm test:transcript-browser
- PLAYWRIGHT_BROWSERS_PATH=.pw-browsers node bench/transcript-selection.mjs (2 additional runs)
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
The latest-base merge tree exceeded the production initial-JavaScript gzip budget by 26.8 bytes.
Root cause:
File and multi-file conflicts used separate translation keys with identical copy and a three-way runtime branch.
Fix:
Use the existing non-empty conflict label to select one shared path-scoped translation while preserving the workspace fallback and all user-visible wording.
Verification:
cd desktop/frontend && pnpm build
go run ./tools/repolint
git diff --check
Problem:
main-v2 advanced with complete-history question navigation, leaving this PR conflicting in the shared bundle budgets while both branches also touched locales, styles, and the repolint baseline.
Root cause:
The navigation and DingTalk changes independently extended the same startup bundle and capacity guards, so neither branch budget represented their combined merge tree.
Fix:
Merge main-v2 at 0d80a69dc, preserve both the long-history navigation contracts and DingTalk settings/runtime wiring, and set channel-specific bundle ceilings from measured current-base and combined artifacts. The largest ratchet is about 0.117%, with roughly 0.1 KiB of build-SHA headroom.
Verification:
- pnpm test:transcript
- focused DingTalk settings, settings snapshot, responsive layout, deferred history, and tab hydration tests
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- go test ./...
- cd desktop && go test ./...
- go run ./tools/repolint
- git diff --cached --check
Co-authored-by: SivanCola <[email protected]>
Problem:
- A whole-workspace writer could start behind a directory-declared writer when the directory writer had not realized a file yet, making admission depend on arrival order.
Root cause:
- Live directory claims intentionally expose an empty scheduling reservation before their first write, and canStartLocked compared the incoming whole claim only with that narrowed reservation.
Fix:
- Keep incoming whole-workspace claims exclusive against every active writer, including unrealized directory claims.
- Add a reverse-order regression that also proves admission resumes after the directory writer releases.
Verification:
- go test ./internal/agent -run '^TestScheduler(WholeClaimCannotStartBehindUnrealizedDirectoryWriter|DirectoryClaimsStartInParallel|WholeClaimNarrowsForNewSiblingsAndOpaqueRestoresExclusion|ParentFileWriteAfterChildRealize)$' -count=50 -timeout 180s
- go test -race ./internal/agent -run '^TestScheduler(WholeClaimCannotStartBehindUnrealizedDirectoryWriter|DirectoryClaimsStartInParallel|WholeClaimNarrowsForNewSiblingsAndOpaqueRestoresExclusion|ParentFileWriteAfterChildRealize)$' -count=10 -timeout 180s
- go test ./internal/agent -count=1 -timeout 180s
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease -count=1 -timeout 300s
- go run ./tools/repolint
- git diff --check
Problem:
Jumping across a 10,000-turn transcript needed many small history requests because the backend also caps entries per page.
Root cause:
The frontend increased only the turn budget for targeted jumps and kept the production default entry limit of 120.
Fix:
Use a bounded 500-turn and 1,000-entry budget only for targeted jumps, while preserving ordinary paging and the backend byte cap. Model the production entry bound in the stress fixture.
Verification:
- go run ./tools/repolint
- pnpm exec tsx src/__tests__/use-controller-meta.test.ts
- pnpm exec tsx src/__tests__/transcript-store.test.ts
- pnpm test:typecheck
- transcript scroll stability browser gate
- git diff --check
Problem:
- main-v2 advanced with the transcript reader extent fix, leaving this PR conflicting because both branches updated the frontend bundle budgets.
Root cause:
- The independent reader-stability and DingTalk startup changes share the same initial bundle, so neither branch budget covered their combined merge tree.
Fix:
- Preserve the reader extent stabilization and the DingTalk session/runtime wiring.
- Set production and test bundle ceilings from measured latest-base and merged artifacts, with only narrowly rounded channel-specific headroom.
Verification:
- pnpm test:transcript
- focused DingTalk settings, settings snapshot, and responsive layout tests
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/bot/... ./internal/botruntime
- cd desktop && go test -race ./...
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- go run ./tools/repolint
- git diff --cached --check
Co-authored-by: SivanCola <[email protected]>
Problem:
- Parallel read-only calls in one provider round could contend for the whole-workspace parent claim when tool hooks may write, causing a sibling call to be blocked and dropped.
Root cause:
- Batch partitioning considered only the tools' ReadOnly flags, while executeOne correctly promoted every hook-capable call to a whole-workspace writer.
Fix:
- Run provider-round batches in order only when configured tool hooks may mutate the workspace.
- Preserve ordinary read-only fan-out and add regression coverage for both paths and complete hook execution.
Verification:
- go test ./internal/agent -run 'TestWritableHooks(SerializeReadOnlyToolBatch|UseWorkspaceLease|ReserveWholeParentWorkspace)$' -count=50 -timeout 180s
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease -count=1 -timeout 300s
- go test ./... -count=1 -timeout 300s
- go vet ./...
- cd desktop && go test ./... -count=1 -timeout 180s
- cd desktop/frontend && pnpm build
- golangci-lint run --timeout=5m ./...
- go run ./tools/repolint
- git diff --check
Problem: PR #9117 was based before merged PR #9140, and both branches update the transcript browser gate, transcript suite, and bundle budgets.
Root cause: the complete-history navigation work and the Windows extent-rebound guard were developed from the same #9130 baseline, so the final merge tree needed an explicit semantic integration.
Fix: merge main-v2 at 89c983a9, retain both focused test groups and browser replays, and set channel-specific bundle budgets from the combined measured output.
Verification: transcript suite, Chromium selection and scroll-stability gates, 10,000-turn performance benchmark, stable/test builds and budgets, test typecheck, repolint, and diff checks pass.
Problem:
- The required golangci-lint job rejected the hierarchy path loop under the modernize rules.
Root cause:
- The loop ranged over an allocated strings.Split result instead of the Go iterator API required by the pinned linter.
Fix:
- Range over strings.SplitSeq while preserving the same normalized path components and lock order.
Verification:
- golangci-lint run --timeout=5m ./...
- go test -race ./internal/workspacelease -count=1
- go test ./internal/agent -run SchedulerWholeClaim -count=1
- go run ./tools/repolint
- git diff --check
Problem:
- Parent workspaces and directly opened nested roots could take disjoint path and whole-workspace locks while mutating the same file.
- Realized whole-workspace claims still blocked new disjoint siblings, and Desktop could not identify a holder across canonical roots.
- A queued workspace writer could deadlock a re-entrant path hold from the same lease owner.
Root cause:
- Path holds shared only their opener's exact workspace lock, scheduler admission kept consulting the immutable declaration, and Desktop rejected unequal roots before comparing canonical file keys.
- Writer-priority shared-lock acquisition did not distinguish re-entry by the owner whose active shared hold blocked the writer.
Fix:
- Add bounded hierarchy stripes plus ancestor and nested-repository compatibility locks in stable order, preserving previous exact-root locks for mixed-version coexistence.
- Reuse shared domains within one owner while retaining writer priority for other owners, and normalize lock identities consistently on case-insensitive platforms.
- Admit new siblings against the live reservation and match Desktop conflicts by concrete keys and workspace containment.
- Document the hierarchy protocol and add deterministic interleaving, compatibility, platform, matching, and latency coverage.
Verification:
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease -count=1
- go test ./... -count=1 -timeout 300s
- go vet ./...
- cd desktop && go test ./... -count=1 -timeout 180s
- cd desktop/frontend && pnpm build
- go run ./tools/repolint
- Windows and Linux workspacelease test binaries cross-compiled
- git diff --check
Problem:
The CI lint job rejected the DingTalk adapter because wsPingInterval was declared but no longer used.
Root cause:
The connection startup refactor moved heartbeat handling to server-initiated ping frames but left the old client interval constant behind.
Fix:
Remove the obsolete constant and its comment.
Verification:
- golangci-lint run --timeout=5m ./internal/bot/dingtalk/...
- go test ./internal/bot/dingtalk ./internal/bot/... ./internal/botruntime
- go run ./tools/repolint
- gofmt -l internal/bot/dingtalk/dingtalk.go
- git diff --check
Problem:
The combined transcript browser suite could exhaust a 15-second geometry-stability precondition after the preceding selection stress run, even though the reduced-motion scenario passed in isolation.
Root cause:
The scenario allowed 30 seconds for content hydration but only the default 15 seconds for the subsequent eight-frame stable-tail precondition.
Fix:
Align that precondition with the existing 30-second hydration window without changing frame-gap, long-task, reversal, write-count, or bottom-distance assertions.
Verification:
The full pnpm test:transcript-browser sequence passed from selection through the reduced-motion idle and return-to-bottom checks.
Problem:
Windows WebView2 can briefly collapse and restore the transcript extent while rows remain mounted, reversing a downward reader gesture by multiple screens without triggering blank recovery.
Root cause:
The scroll arbiter treated the transient physical-bottom clamp as an authoritative delivery and had no bounded transaction tying the rebound to the active reader input.
Fix:
Track a 180 ms reader extent transaction, require a large collapse and rebound before one anchor-based correction, and cancel stale geometry on ownership, resize, recovery, and surface changes. Normalize wheel and touch input geometry while keeping the arbiter as the sole Virtuoso writer.
Verification:
Added deterministic geometry, ownership-race, cancellation, touch, keyboard, and Playwright replay coverage. Passed transcript tests, production/test builds and bundle budgets, scroll-writer checks, repolint, desktop Go tests/vet, and the isolated browser stability bench.
Problem:
The Linux desktop CI job timed out while the reduced-motion browser gate tried to return the transcript to the physical bottom after an upward wheel gesture.
Root cause:
The gate sent its downward wheel after a fixed 120ms delay without first proving Chromium had delivered the upward gesture, entered manual mode, and moved away from the tail. Wheel delivery and coalescing on the Linux runner made that setup nondeterministic.
Fix:
Wait for the upward gesture to establish manual reading away from the captured bottom position, then use a bounded sequence of real downward wheel gestures until tail-follow reaches the physical bottom. Keep the existing reversal, moving-frame, and physical-bottom assertions unchanged.
Verification:
- transcript-scroll-stability.mjs passed three consecutive runs
- pnpm --dir desktop/frontend test:transcript-browser
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend test:performance
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend test:typecheck
- pnpm --dir desktop/frontend lint:hooks
- pnpm --dir desktop/frontend build
- REASONIX_CHANNEL=test pnpm --dir desktop/frontend build
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
DingTalk runtime/profile commands could tear down the current bot controller before a replacement was viable. Webhook redirects and startup readiness were insufficiently guarded, while settings round trips could drop hidden legacy session mappings.
Root cause:
Runtime overrides were published and the old state was closed before controller boot and lease transfer completed. Webhook validation allowed HTTP through process-global test policy and did not validate every redirect. Settings rebuilt the DingTalk config without preserving non-UI fields.
Fix:
Build, bind, and lease replacement controllers before atomically swapping them, reusing the same-path lease keeper and preserving the old runtime on failure. Require HTTPS for production webhooks, revalidate redirect hops, complete the initial WebSocket handshake synchronously, preserve legacy mappings, handle disabled connections correctly, and keep the frontend connection label and dependency graph accurate.
Capacity:
DingTalk status wiring measures 425.9 KiB gzip against a narrowly raised 426.0 KiB initial-JS budget (+0.5 KiB, 0.118%). Complete DingTalk setup guidance measures 55.8/55.9 KiB for zh and 56.5/56.6 KiB for zh-TW; each locale ratchet rises only 0.2 KiB (about 0.36%).
Verification:
- go test ./...
- go test -race ./internal/bot/... ./internal/botruntime
- cd desktop && go test ./...
- cd desktop && go test -race ./...
- go vet ./internal/bot/... ./internal/botruntime
- cd desktop && go vet ./...
- pnpm build
- settings snapshot and responsive contract suites
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
The Linux desktop CI job timed out twice while waiting for a native scrollbar thumb drag to reach the physical transcript bottom, even though measurement freezing and the preceding navigation and performance assertions passed.
Root cause:
The browser gate stopped the held pointer five pixels inside the scrollbar track. Native Chromium scrollbar themes do not guarantee that this coordinate clamps the thumb to the track endpoint.
Fix:
Drag the held native thumb beyond the visible track while keeping the pointer inside the viewport, and retain the exact one-pixel physical-bottom assertion and existing timeout.
Verification:
- pnpm --dir desktop/frontend test:transcript-browser
- transcript-scroll-stability.mjs passed two additional consecutive runs
- pnpm --dir desktop/frontend test:transcript
- pnpm --dir desktop/frontend test:performance
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend test:typecheck
- pnpm --dir desktop/frontend lint:hooks
- env -u REASONIX_CHANNEL pnpm --dir desktop/frontend build
- REASONIX_CHANNEL=test pnpm --dir desktop/frontend build
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Context:
PR #9130 landed on main-v2 after the long-history navigation update was pushed. Its transcript geometry diagnostics overlapped the navigation owner, test script, and bundle budgets.
Conflict resolution:
Preserve both the bounded Windows geometry recovery and complete-history navigation contracts. Combine their transcript suites and callbacks, extract question navigation and pagination race helpers from oversized owner files, keep the stable/test channel budgets independently bounded, and normalize the merged diagnostic tests for the repository test compiler.
Verification:
pnpm --dir desktop/frontend test:transcript
pnpm --dir desktop/frontend typecheck
pnpm --dir desktop/frontend test:typecheck
pnpm --dir desktop/frontend lint:hooks
pnpm --dir desktop/frontend test:performance
env -u REASONIX_CHANNEL pnpm --dir desktop/frontend build
REASONIX_CHANNEL=test pnpm --dir desktop/frontend build
cd desktop && go test ./...
go run ./tools/repolint
git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
- The pull request lint job rejected two newly added loops under intrange and modernize.
Root cause:
- The bounded-stripe test used a three-clause integer loop, and release cleanup indexed a slice backwards manually.
Fix:
- Use an integer range for the stripe coverage loop.
- Use slices.Backward to preserve LIFO release ordering without manual indexing.
Verification:
- golangci-lint run ./...
- go test ./... -count=1 -timeout 300s
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease -count=1 -timeout 300s
- go vet ./...
- go run ./tools/repolint
- git diff --check
Problem:
- The latest-base merge tree exceeded the baselined App.tsx file-size budget by one line.
Root cause:
- The PR and the updated base each remained within the budget independently, but their non-conflicting App.tsx edits combined to one extra line.
Fix:
- Keep the workspace-conflict translation call on one line without changing behavior.
Verification:
- pnpm lint:hooks
- go run ./tools/repolint
- git diff --check
Problem:
- File-scoped lease batches could deadlock on reverse path order, lose active protection during workspace upgrades, and misidentify the local writer in Desktop.
- Writable tool hooks, case aliases, queued writers, and historical path-lock growth left adjacent correctness and resource gaps.
Root cause:
- Paths were acquired incrementally, held and waiting lease state shared one scope, and hook coordination followed only the concrete tool's declared write surface.
- Path locks used unbounded identities and local shared locking did not give waiting writers priority.
Fix:
- Acquire canonical path batches in stable order through a bounded global stripe set, retain active holds during upgrades, and prioritize queued workspace writers.
- Elevate hook-wrapped calls to workspace-wide coordination, fold case aliases, and match Desktop conflicts with exact held and waiting keys.
Verification:
- go test ./... -count=1 -timeout 300s
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease -count=1
- go vet ./...
- cd desktop && go test ./... -count=1 -timeout 180s
- cd desktop/frontend && pnpm build
- go run ./tools/repolint
- git diff --check
Problem:
The long-history question rail remained in the initial application bundle, and active-question tracking scanned every mounted anchor even after passing the viewport. The exact-navigation wiring exceeded the existing initial gzip budget by 25 bytes.
Root cause:
Transcript imported the rail eagerly, the scroll-sync helper did not use the ordered DOM-anchor invariant, and the bundle guard had no allowance for the small owner-level navigation addition.
Fix:
Lazy-load the question rail behind its existing visibility gate, stop the ordered anchor scan at the first position below the viewport, remove redundant loaded-state checks, and record the measured 25-byte (0.0057%) increase with the smallest 0.1 KiB budget increment.
Verification:
pnpm --dir desktop/frontend test:transcript
pnpm --dir desktop/frontend test:typecheck
pnpm --dir desktop/frontend test:performance
pnpm --dir desktop/frontend build
git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem
The macOS desktop CI job rejected the scroll diagnostics exporter under the current modernize rules.
Root cause
The exporter used a hand-written membership loop and converted fmt.Sprintf output to bytes instead of using the Go 1.26 standard-library helpers.
Fix
Use slices.Contains for enum membership and fmt.Appendf for the checksum line.
Verification
- cd desktop && golangci-lint run --timeout=5m
- cd desktop && go vet ./...
- cd desktop && go test . -run scroll diagnostic tests -count=1
- go run ./tools/repolint
- git diff --check
Problem:
Legacy history pages use zero-based cursors, which shifted absolute question navigation by one. An older-page request could also complete after its tab was closed and recreate released transcript state.
Root cause:
The fallback HistoryPage projection copied its cursor directly into the one-based frontend coordinate model, and tab cleanup removed state without invalidating the pagination request generation.
Fix:
Normalize legacy pages to absolute one-based question turns, retain a tombstone generation when transcript state is released, and discard success or error completions for removed tabs. Add deterministic close-race coverage and a 10,000-turn targeted-paging stress test.
Verification:
pnpm --dir desktop/frontend test:transcript
pnpm --dir desktop/frontend typecheck
pnpm --dir desktop/frontend test:typecheck
pnpm --dir desktop/frontend lint:hooks
pnpm --dir desktop/frontend check:css
pnpm --dir desktop/frontend test:performance
cd desktop && go test ./...
git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
A terminal paste arriving after the image probe could still duplicate the scheduled text fallback, while a second Ctrl+V during the probe was dropped.
Root cause:
The image-paste state tracked only one pending probe and checked the terminal paste sequence before the asynchronous text read, without carrying that guard to final application.
Fix:
Coalesce overlapping image probes, count every paste request, subtract terminal-owned pastes both before and after the text read, and replay only the remaining requests through the canonical composer paste path.
Verification:
- focused clipboard interleaving tests, including 50 repeated runs
- go test ./... with the cache guard
- go test -race ./internal/cli
- cd desktop && go test ./...
- go vet ./... and go build ./...
- golangci-lint for native, Darwin, and Windows targets
- repolint plus Windows and Linux cross-compilation
Problem:
- The bounded recovery probe relied on Virtuoso emitting another range or scroll event before it could leave enlarged overscan.
Root cause:
- Entering safe mode changed probe props but did not schedule the probe verdict from the integrity hook itself.
Fix:
- Schedule one post-render blank check whenever safe mode starts.
- Exit the probe after that single healthy or still-blank verdict without remounting.
- Cover a 10,000-row failed probe with no follow-up range or scroll event.
Verification:
- pnpm exec tsx src/__tests__/transcript-recovery-race.test.tsx (89 passed)
- pnpm test:transcript
- pnpm test:transcript-browser
- pnpm build (425.3 / 425.5 KiB)
Problem:
The test TypeScript build rejects an obsolete questions fixture after active-question selection was narrowed to mounted anchor positions.
Root cause:
The helper no longer consumes the full question array, but its old test data remained declared under noUnusedLocals.
Fix:
Remove the unused fixture while keeping the mounted-position regression cases unchanged.
Verification:
pnpm --dir desktop/frontend test:typecheck
pnpm --dir desktop/frontend exec tsx src/__tests__/transcript-question-nav.test.ts
Problem:
After the first write, a session kept the workspace exclusive until the run
ended. Read-only bash could still look like a writer at the edges, fleet
preflight failed omitted write_paths, wait copy said the whole workspace was
busy, and a finished conversation could keep the lock.
Root cause:
Owner released only on EndRun, path-bound locks were repo-wide in the same
git root, fleet preflight treated whole-workspace claims as fatal, and the
conflict card had no file/workspace distinction.
Fix:
- Hold/release write leases per mutating tool; EndRun drops leftovers.
- Path-bound writes take shared workspace + exclusive file locks so different
files (same repo included) may proceed; bash/MCP exclusive only for that command.
- Read-only bash (git status, Get-ChildItem, ls) does not take a write lease.
- Fleet omitted write_paths queue in the scheduler instead of failing preflight.
- Conflict cards name the file being written; no home paths.
Verification:
- go test ./internal/agent ./internal/workspacelease ./internal/filelock
- go test -race ./internal/workspacelease ./internal/filelock
- cd desktop && go test ./
Context:
Bring PR #9117 onto the current main-v2 merge tree before final validation. Preserve the contributor and maintainer commits while incorporating the latest workspace, provider, stream-batching, and repository test changes.
Problem:
Long desktop sessions hide earlier turns behind a manual fold control, and the question rail only represents the loaded suffix. Failed expansion can also leave navigation without a clear recovery path.
Root cause:
Transcript pagination is exposed as a user-controlled fold, absolute history turns are discarded during projection, and the rail renders and measures one DOM marker per loaded question. Older-page completions also need stronger invalidation across tab and session hydration changes.
Fix:
Auto-load ordinary older history, preserve absolute turns, and support bounded targeted paging for unloaded questions. Render at most 120 sampled markers with direct pointer mapping and keyboard slider semantics. Stop automatic retries after a failure, expose a safe retry action, and discard stale page completions by request generation and session identity.
Verification:
pnpm --dir desktop/frontend test:transcript
pnpm --dir desktop/frontend typecheck
pnpm --dir desktop/frontend test:typecheck
pnpm --dir desktop/frontend lint:hooks
pnpm --dir desktop/frontend check:css
pnpm --dir desktop/frontend test:performance
cd desktop && go test ./...
git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem
Repeated blank recovery could retain an all-row measurement fallback, exact row heights could survive immutable late-content patches, and native smoke cleanup hid persistent Windows deletion failures.
Root cause
Recovery tracked only the last hard reset, measured sizes were keyed by row and width without content identity, and the smoke script used SilentlyContinue for final cleanup.
Fix
Give each layout generation one hard reset and one bounded measurement probe, version measured rows by immutable item identity, invalidate stale exact and median samples, and retry native-smoke cleanup before surfacing persistent errors. Add long-history, late-patch, and locked-file regression coverage. The production bundle budget moves by 0.5 KiB for a measured 361-byte gzip increase.
Verification
- pnpm test:transcript
- pnpm test:transcript-browser
- pnpm build
- REASONIX_CHANNEL=test pnpm build
- cd desktop && go test . -count=1
- cd desktop && go vet ./...
- go run ./tools/repolint
- git diff --check
Problem:
Conflict detection treated the whole workspace (or a declared directory prefix)
as exclusive. Parallel writers blocked even when they touched different files
or different nested git repositories.
Root cause:
write_paths scheduling used capability Overlaps, so directory identity and
omitted claims serialized every writer. workspacelease used one exclusive flock
keyed by the opened workspace root.
Fix:
- Schedule directory claims in parallel; reserve realized files at write time.
- Shrink omitted write_paths to realized files until bash/MCP goes opaque.
- Add shared flock; nested-repo path-bound writes take shared parent + exclusive repo.
- Same-repo sessions still serialize. Desktop conflict cards match lock domains.
Verification:
- go test ./internal/agent ./internal/filelock ./internal/workspacelease
- go test -race ./internal/agent ./internal/filelock ./internal/workspacelease
- cd desktop && go test ./...
Problem:
Rapid Ctrl+V text fallbacks could be dropped, and clipboard image probes could classify operational failures as an empty image clipboard.
Root cause:
Internal text fallback reused terminal paste accounting, while Linux and macOS image readers inferred missing image data from broad command failures.
Fix:
Track only terminal-originated paste events, probe explicit clipboard image types before reading, and preserve probe, read, and save failures.
Verification:
- go test ./...
- go test -race ./internal/cli ./internal/control
- cd desktop && go test ./...
- go vet ./...
- go build ./...
- golangci-lint on Linux, macOS, and Windows targets
- repolint and Windows cross-compilation
Co-authored-by: SivanCola <[email protected]>
- dingtalk: drop access token from webhook replies; restrict webhook to dingtalk
hosts; reject non-dingtalk session webhooks at normalize/send; SSRF regression
tests; ReplyToMsgID never used as URL
- dingtalk: use isInAtList structured mention field with text fallback
- botruntime: count dingtalk allowlist fields and direct [bot.dingtalk].access in
startup gate; tests
- gateway: /model validates model via ModelResolver before swapping controller
(failure-atomic, old session stays usable); provider-only usage rejected
- botruntime/config: persist /new-rotated session path for legacy direct
[bot.dingtalk] via Dingtalk.SessionMappings; render + forget cleanup
- docs: remove work-note docs (dingtalk-support-scope, feishu analysis)
- repolint: baseline only for PR files, global limits kept at upstream
Resolve the workspace test command conflict by preserving both the base branch's turn verification suite and this branch's preview CSS regression coverage.
Verification:
- go run ./tools/repolint
- pnpm --dir desktop/frontend test:workspace
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend check:css
- pnpm --dir desktop/frontend build
- git diff --check --cached
Problem:
Large code previews remained capped by the shared scroll height, and the preview could switch layout while code was loading, leaving visible row gaps.
Root cause:
The workspace code selector did not explicitly override the shared max-height rule, while the code layout class depended on the loaded preview payload.
Fix:
Clear the shared height cap inside workspace previews, keep the code layout active throughout loading, and add deterministic CSS and component regression coverage to the workspace suite.
Verification:
- go run ./tools/repolint
- pnpm --dir desktop/frontend test:workspace
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend check:css
- pnpm --dir desktop/frontend build
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
The immutable provider name hint was visible but not exposed as the field description, and its faint text color did not meet normal-text contrast requirements.
Root cause:
The name label, input, and hint had no shared IDs, while the hint reused the generic low-emphasis memory style.
Fix:
Associate the label and conditional hint with the name input via useId and aria-describedby. Apply a scoped secondary text color and extend the regression suite to guard both contracts.
Verification:
- provider-name-readonly.test.tsx passed (23/23)
- provider-editor-model-picker.test.tsx passed (45/45)
- focused ESLint, CSS checks, test typecheck, and git diff --check passed
- Chromium accessibility and 12-theme contrast matrix passed
Co-authored-by: SivanCola <[email protected]>
Problem: Session-group titles grow to the intended hierarchy size, but entering rename mode still shrinks the editable title to the old 11px size.
Root cause: The rename input retained a fixed font-size instead of following the updated group header typography.
Fix: Inherit the group header font size in rename mode and add a source-level regression contract that rejects the old fixed size.
Verification: project-tree row stability test, CSS guards, ESLint, TypeScript, full frontend build, bundle budgets, repolint, and Chromium computed-style checks at 100% and 125% all passed.
Co-authored-by: SivanCola <[email protected]>
Problem:
The focused stream batching regressions were only discoverable through the general frontend test runner, which desktop CI does not invoke. The timer comments also described a requested delay as a hard latency guarantee and implied it could bypass a blocked main thread.
Root cause:
No CI-owned suite grouped the stream batching tests, and the documentation conflated a best-effort timer with a watchdog.
Fix:
Add a test:stream suite, mark its three tests as owned by that suite, and invoke it from desktop CI. Clarify that timer delivery can be delayed by browser throttling or long main-thread tasks.
Verification:
- pnpm test:stream
- pnpm exec tsc --noEmit
- pnpm exec eslint src/lib/rafBatch.ts src/__tests__/raf-batch.test.ts
- pnpm test:motion
- go run ./tools/repolint
- actionlint .github/workflows/ci.yml
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Problem:
PR #9097 identified an untested Agent path where todo_write creates the canonical todo while Plan mode is already active. Existing tests seeded state directly, so the safe end-to-end recovery contract remained implicit.
Root cause:
The current contract was split across separate tests for todo progress and Plan-mode sign-off blocking; neither exercised both decisions after real in-turn todo creation.
Fix:
Add an Agent-level regression that creates the todo through executeOne, proves an evidence-backed complete_step stays phase-blocked without changing canonical state, and completes the same step through todo_write.
Verification:
- go test ./internal/agent -run ^TestPlanModeTodoCreatedInTurnUsesTodoWriteRecovery$ -count=1
- go test -race ./internal/agent -count=1
- go vet ./internal/agent
- go test ./internal/tool -run ^TestBuiltinToolContractDocumentation$ -count=1
- go run ./tools/repolint
- git diff --check
Co-authored-by: poorpaper <[email protected]>
- /new: pin the rotated session path as the active override so the next
message cannot re-resolve the deterministic/mapped old path and silently
undo the rotation (P1)
- dingtalk: Start validates credentials and the initial connection
synchronously, surfacing start failures instead of a green "running"
status that never connects (P1)
- /model: report the fully resolved effective model (override → channel/
route → global) and reject provider-only switches that saved an
unresolvable "provider/" model (P2)
- config: Dingtalk RequireMention defaults to true, matching Feishu (P2)
- allowlist + self-user-ids: wire the Dingtalk entries into both the
desktop and CLI gateway configs (P2)
- CLI bot: apply direct [bot.dingtalk] runtime options via
MergeLegacyDingtalkChannel, same path as the desktop (P2)
- desktop: TestDingtalkBot resolves credentials from the selected
connection instead of the legacy block; SettingsPanel derives gateway
enabled state including dingtalk (P2)
- tests: regressions for rotation pinning, /model, dingtalk Start,
legacy channel merge and connection credential resolution
Problem
Repository lint rejected new complexity in the transcript arbiter, bridge contract, and diagnostic payload validators.
Root cause
Diagnostic event mapping and recovery types lived in the single scroll-writer module, while manifest, summary, event-index, and label validation were combined into two large Go functions.
Fix
Extract pure diagnostic mapping, recovery types, and the additive Wails binding contract into focused modules. Split the Go validation boundary by payload responsibility without changing accepted fields or runtime behavior.
Verification
- go run ./tools/repolint
- pnpm test:transcript
- pnpm test:transcript-browser
- env -u REASONIX_CHANNEL pnpm build
- REASONIX_CHANNEL=test pnpm build
- cd desktop && go test ./...
- cd desktop && go vet ./...
Problem
Windows WebView2 users can still see multi-screen scroll jumps, blank transcript viewports, and bottom drift in long sessions after the reduced-motion write loop was fixed.
Root cause
Virtuoso's data-known-size can describe a stale size-tree slot rather than the current row. Feeding it back into the remount cache propagates cross-row height assignments, while overlapping tail-settle and blank-recovery work can amplify the resulting layout correction.
Fix
Cache real itemSize DOM measurements by row and content width, bound tail-settle transactions and recovery remounts, and fall back to temporary full-row measurement when a generation remains blank. Add test-only privacy-safe scroll diagnostics that compile out of stable builds.
Verification
- pnpm test:transcript
- pnpm test:transcript-browser
- env -u REASONIX_CHANNEL pnpm build
- REASONIX_CHANNEL=test pnpm build
- cd desktop && go test ./...
- cd desktop && go vet ./...
When a message has no persisted session_mappings or /attach binding, the
gateway fell back to a fresh timestamp-named session file, so the same
Feishu chat spawned a new conversation per message. Derive a stable
chat→file path (dsh-dingtalk-channel's `ding-<chatId>` analogue) so the
same chat reuses one session across restarts.
- sessionProfileForMessage: fall back to botStableSessionPath when no
mapping/attach resolves
- getOrCreateSession: pin new conversations to the stable path instead of
degrading to a timestamp file
- botStableSessionPath: DM/direct keyed on chat, groups keyed per sender,
mirroring BuildSessionKey scope
- update repolint baseline for local-run (file-size debt)
Problem:
PR #9102 conflicted with the latest completion-summary presentation changes on main-v2, and the combined test fixture no longer satisfied the required Meta shape.
Root cause:
Both branches changed completion notice routing and the workspace summary at the same ownership points. A side-only resolution would either lose historical summary navigation or regress standard/delivery notice semantics.
Fix:
Preserve per-notice summaries, monotonic stale-safe reveal requests, repeat scrolling, and Files-to-Changes navigation while retaining neutral standard notices, scratch suppression, delivery attention, and quality-floor styling. Update the merged test fixture to construct a valid Meta value.
Verification:
Focused completion, controller, and workspace tests; workspace and transcript suites; production and test typechecks; hooks and CSS checks; frontend build and bundle budgets; repolint; diff check; real Chromium interaction verification.
Problem
Historical completion notices could open no verification details or a later turn's summary, and repeated reveals in the Changed overview did not scroll.
Root cause
Completion notices shared a no-argument callback backed by the current summary, while the reveal effect returned after consuming requests even when navigation state was already settled.
Fix
Bind normalized summaries to completion notices, carry target and turn context through reveal requests, invalidate stale contexts, scroll same-view requests immediately, and extract the verification panel and tests to preserve lint budgets.
Verification
Ran focused completion and workspace verification tests, workspace and transcript suites, production build, TypeScript checks, CSS and hooks lint, repolint, diff checks, and a clean-console Chromium click/scroll check.
Summary:
Include #9101 in the bilingual Stable notes and correct title and contributor drift introduced by automated regeneration.
Verification:
Validate the release catalog, its rendering contract, source PR citations, and the final public notes body.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem:
A failed mutation check could be omitted from the completion attention decision, and the neutral change notice labeled mutation receipts as files.
Root cause:
Completion attention was evaluated before counting failed checks, while the frontend reused receipt-count mutations as a file count.
Fix:
Count contract check failures before computing attention, pass the count into the shared policy helper, and describe mutation receipts as changes in every locale. Add focused regressions for both contracts.
Verification:
- go test ./internal/agent ./internal/completion ./internal/taskcontract ./internal/checkpoint ./internal/cli -count=1
- go test -race ./internal/agent ./internal/completion ./internal/taskcontract ./internal/checkpoint ./internal/cli -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- cd desktop && go test ./... -count=1 && go vet ./...
- cd desktop/frontend && pnpm exec tsx src/__tests__/completion-summary-presentation.test.ts
- cd desktop/frontend && pnpm exec tsx src/__tests__/use-controller-stream-progress.test.ts && pnpm exec tsx src/__tests__/completion-summary-ui.test.tsx
- cd desktop/frontend && pnpm exec tsc --noEmit && pnpm build
* fix(desktop): hide Windows caption controls in image preview
Problem: The app-level image preview showed a second close-control cluster beside the Windows caption buttons, making the two actions easy to confuse.\n\nRoot cause: The custom Windows window controls stayed visible above the fullscreen image viewer overlay.\n\nFix: Hide the Windows caption-control group while the image viewer is mounted and restore it automatically when the viewer closes. Keep the viewer close button at the shared 16px inset and preserve Escape, backdrop, and native window shortcuts.\n\nVerification: CSS syntax and z-index checks passed; frontend typecheck passed; composer image capability tests passed (15/15).
* test(desktop): isolate image preview control contract
Problem: The Windows image-preview contract pushed app-chrome-tabs.test.ts beyond the repository's test-file size ceiling.\n\nRoot cause: The focused CSS contract was appended to an already baselined large suite.\n\nFix: Move the contract into a discovery-based standalone test without changing production behavior.\n\nVerification: focused contract 5/5, CSS checks, TypeScript, repolint, and git diff checks pass.
Problem: Users treated 本轮验证 as a second action on the quality notice.
Clicking it did nothing, so the orange card and 0/5 todos looked stuck.
Root cause: The notice only had View changes. The same words in the
workspace panel were a heading, not a control, and did not reveal the
summary when a file preview was selected.
Fix: Add a Turn verification button on completion notices that opens the
changed dock, returns to the overview, and scrolls to the summary. Keep
the in-panel title as a heading. Do not rerun checks or advance todos.
Verification: tsx src/__tests__/completion-summary-ui.test.tsx
tsx src/__tests__/workspace-changes-errors.test.tsx
tsc --noEmit
Problem:
SetDefaultModel read tab.model without App.mu while persisting the session sidecar. Concurrent model updates from Wails goroutines could race that read.
Root cause:
The persistence helper guards the later current-model check, but its tab.model argument was evaluated before either runtimeRebuildMu or App.mu was acquired.
Fix:
Carry the canonical resolved model in the SetDefaultModel call frame and pass that immutable value to persistTabModelIfCurrent. Add a race regression with a concurrent lock-respecting tab model writer.
Verification:
- go test -race . -count=10 -run '^TestSetDefaultModelConcurrentTabModelUpdateIsRaceFree$'
- go test -race . -count=1 -run 'TestSetDefaultModel|TestNewSession|TestSetModelForTab|TestMetaForTabConcurrentWithBuildSwap'
- go test ./... -count=1 -skip '^TestTabEventSinkForwardsImmediateWorkspaceMutation$'
- go test -race . -count=1 -skip '^TestTabEventSinkForwardsImmediateWorkspaceMutation$'
- make lint
- git diff --check
Problem:
Scratch-path inference could hide pathless Bash side effects, durable writes outside the workspace, and scratch symlink aliases into the workspace.
Root cause:
Delivery accounting treated script location as side-effect proof and equated non-workspace with non-delivery. Scratch classification used lexical paths only.
Fix:
Keep pathless Bash fail-closed, centralize delivery-mutation classification so only proven scratch is excluded, and resolve scratch aliases before assigning scope.
Verification:
- go test ./internal/evidence ./internal/completion ./internal/taskcontract ./internal/checkpoint ./internal/agent ./internal/cli -count=1
- go test -race ./internal/evidence ./internal/completion ./internal/taskcontract ./internal/checkpoint ./internal/agent ./internal/cli -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- GOOS=windows GOARCH=amd64 go test -exec=/usr/bin/true ./internal/evidence ./internal/checkpoint
Problem:
Changing the default model in Settings did not survive restart and did
not apply to New Session. Users saw the previous conversation's provider
after both actions (#9080).
Root cause:
SetDefaultModel wrote default_model and switched the live tab, but empty
sessions do not autosave a turn, so the session sidecar kept the old
provider. Startup prefers that sidecar over default_model. NewSession
also inherited the current tab model and no-op'd on a blank tab, so the
composer new-session action never consulted the configured default.
Fix:
Persist the selected default onto the current session sidecar, matching
SetModelForTab. After NewSession rotation (or a reused blank tab), apply
the same default as EnsureBlankTab. Existing conversations still keep
their saved model until the user starts a new one.
Verification:
- go test . -count=1 -run TestSetDefaultModelPersistsSessionSidecar
- go test . -count=1 -run TestNewSessionForTabUsesConfiguredDefaultModel
- go test . -count=1 -run TestNewSessionForTabAlignsBlankTabToDefault
- go test . -count=1 -run 'TestNewSession|TestSetDefaultModel|TestEnsureBlankTab|TestDesktopNewSession'
- go test -race . -count=1 -run 'TestSetDefaultModelPersistsSessionSidecar|TestNewSessionForTabUsesConfiguredDefaultModel|TestNewSessionForTabAlignsBlankTabToDefault'
- make lint
Problem: Windows WebView2 sessions with OS animation effects disabled could enter a persistent transcript flicker loop after returning to the tail, making long sessions unable to rest on the newest content.
Root cause: reduced-motion layout churn made the tail-follow writer repeatedly target the estimated LAST index from Virtuoso. No-op writes re-armed measurement retries, while the browser gate sampled transient geometry and could click a remounting jump-bottom control.
Fix: target the native scroll extent, require an off-bottom displacement to survive a full frame before writing, and make the browser gate wait for consecutive stable geometry frames while atomically clicking the current connected control.
Verification: pnpm test:transcript; pnpm build; pnpm test:transcript-browser; six concurrent transcript-scroll-stability Chromium runs; go run ./tools/repolint; git diff --check; exact merge-result verification against main-v2 at 83ccf6858f788fb40d4ff29ddca4988a995d3844; all required CI and CodeQL checks passed.
Problem: After dropping the complete_step receipt gate, todo_write could
replace or clear the current item on a plain Allow. Empty lists also skipped
Auto Guard because recoveryPlanTransition ignored todos: []. CI lint failed
because completestep_test.go grew past 800 lines.
Root cause: Current-item continuity was removed entirely, and empty
replacements were treated as invalid plans instead of structural dismissals.
Fix: Allow same-identity in_progress to completed without a sign-off.
Removing, replacing, or clearing the current item still requires
AuthorizePlanReplacement. Empty lists now enter plan-transition review.
Move the verification-hint test into its own file so repolint stays green.
Verification: go test ./internal/tool/builtin/ ./internal/agent/ ./internal/evidence/
go run ./tools/repolint
Problem:
Scratch execution could suppress rewind coverage incorrectly, while completion attention was reclassified by mutable client state. Platform paths, lint budgets, and locale budgets also kept CI red.
Root cause:
A command-token heuristic conflated script location with all side effects, write scope resolved symlinks before the checkpoint safety layer, and completion events omitted the turn-time policy decision.
Fix:
Keep checkpoint coverage fail-closed, add a narrow turn-local scratch delivery scope, classify workspace symlinks lexically for the safety layer, carry authoritative floor and attention fields, stabilize the macOS watcher test, and ratchet locale budgets by the measured delta.
Verification:
- go test ./... -count=1
- go test -race on evidence, completion, taskcontract, checkpoint, agent, and CLI packages
- go vet ./... in root and desktop modules
- go test ./... -count=1 in the desktop module
- Windows cross-compilation for evidence and checkpoint tests
- frontend completion tests, typecheck, production build, and bundle budgets
- go run ./tools/repolint
Problem: Models cited a git commit as kind=verification with no command.
complete_step rejected the sign-off without saying they could use files,
diff, or manual instead.
Root cause: The empty-command error only mentioned kind "manual".
Fix: Keep the verification command requirement and point at files, diff,
or manual when no session command is cited.
Verification: go test ./internal/tool/builtin/ -run TestCompleteStep
go test ./internal/tool -run TestBuiltinToolContractDocumentation
Problem: Loop tests still expected todo_write to refuse completions until
complete_step succeeded, so the new progress contract would look like a
regression.
Root cause: Those tests encoded the old sign-off-as-key design, including
the plan-transition replacement block.
Fix: Accept todo_write progress without a receipt, keep complete_step
unavailable in plan mode, and prove both channels can finish a list.
Completed history still cannot be rewritten.
Verification: go test ./internal/agent/ ./internal/control/
Problem: A finished task list stayed at 0/N because todo_write refused to
mark, replace, or clear the current item unless complete_step had already
succeeded. When complete_step was hidden in plan mode, that gate deadlocked.
Root cause: verifyTodoCurrentContinuity and verifyTodoCompletionTransitions
treated the checklist as a sign-off ledger instead of a progress UI.
Fix: Keep serial shape and step identity checks. Drop the complete_step
receipt requirement so todo_write can record progress in any workflow phase.
complete_step remains the optional evidence receipt.
Verification: go test ./internal/tool/builtin/ ./internal/evidence/
Problem: A pinned conversation could appear both in the pinned section and in its Global or project folder.
Root cause: The sidebar split removed only rows carrying the pinned flag, so catalog topic and runtime session projections of the same logical conversation could both remain visible.
Fix: Deduplicate project-tree rows by scope, workspace root, and topic ID, preserve same-ID topics in different projects, and isolate presentation helpers in a dedicated module.
Verification: 88 project-tree tests, runtime projection and shell-race tests, typecheck, ESLint, production build, bundle budgets, repolint, browser pin/unpin flow, and all required CI checks passed.
Problem
Capturing /tmp probe scripts recorded outside_workspace, and bash that
only ran those scripts recorded bash_side_effect. Rewind then asked
the user to confirm "partial project coverage" for files that were
never in the workspace.
Root cause
CapturePath treated every path outside the workspace root as a project
hole. observeBeforeMutation recorded a bash gap whenever the tool could
not preview a workspace path.
Fix
Add GapScratch. Scratch preview paths and bash commands that only name
scratch files use that reason. Rewind confirmation ignores scratch-only
gaps so workspace restore is not blocked by probe scripts.
Verification
go test ./internal/checkpoint/ ./internal/agent/ ./internal/control/ ./internal/cli/ -count=1
Problem
The transcript turned every quality-summary gap into an orange
"this turn still needs attention" card. Research turns that only
probed /tmp, and standard-floor workspace edits without review,
looked like failed delivery.
Root cause
completionSummaryNeedsAttention treated partial verdicts, unavailable
review, and any gap_kinds as interrupts. The card reused one generic
sentence for every case.
Fix
Align desktop and CLI with NeedsAttention. Failed checks and delivery
gaps keep a warning with specific copy. Workspace mutations on the
standard floor become a neutral "changes this turn" chip. Scratch-only
turns insert nothing.
Verification
go test ./internal/cli/ -count=1
pnpm exec tsx src/__tests__/use-controller-stream-progress.test.ts
pnpm exec tsx src/__tests__/completion-summary-ui.test.tsx
pnpm exec tsx src/__tests__/use-controller-meta.test.ts
Problem
Any successful write, including /tmp probe scripts, incremented
completion Mutations and produced unverified_change / unreviewed_change
gaps. The host then emitted a quality summary that frontends treated as
attention.
Root cause
completion.Build and emitCompletionSummary counted every Write/Mutation
receipt. They did not ask WriteScope whether the path was a project file.
Fix
BuildAt filters Changes and Mutations to workspace paths. NeedsAttention
interrupts only for blocked turns, failed checks, unbacked claims, or
delivery-floor proof gaps. Standard unreviewed writes and scratch-only
turns stay quiet.
Verification
go test ./internal/completion/ ./internal/agent/ -count=1
Problem
Probe scripts written to /tmp or session temp were treated as project
writes. Delivery obligations and later quality cards then treated a
research turn as incomplete delivery.
Root cause
Writer classification only asked whether a path looked sensitive. It
had no notion of where the write landed, so /tmp/btc_klines.py and a
workspace source file used the same duty table.
Fix
Add WriteScope (workspace / scratch / outside). /tmp, /private/tmp, and
reasonix-session-tmp-* are scratch. Scratch writers create no
DiffReview or delivery-floor FullVerify duties. ClassifyEffect still
keeps WorkspaceWrite for mutation-risk scoring.
Verification
go test ./internal/evidence/ ./internal/taskcontract/ -count=1
Problem
The generated v1.28.0 record re-listed fixes that already shipped in
v1.27.0, cited a pull request that was never merged, and omitted a
co-author who contributed inside this release range.
Root cause
The generator derived refs from the #9065 commit body, which references
its earlier incomplete attempts (#9013, #9054, #9027) as lineage. Those
numbers were treated as this release's own changes. #9013 and #9054
merged before v1.27.0 and are already credited in the v1.27.0 record;
#9027 was closed without merging.
Fix
- Drop the "Stale transcript navigation" (#9054) and "Question navigation
single activation" (#9013) fixed entries; both shipped in v1.27.0.
- Remove #9027 from the remaining "Question navigation landing" entry and
from the desktop transcript navigation highlight.
- Credit Linearl, whose Co-authored-by trailer is on bd8a8822b in #9072.
Verification
- scripts/validate-stable-release-record.mjs against the main-v2 catalog:
"reviewed Stable release record verified: v1.28.0".
- scripts/release-notes.test.mjs 6/6, release-verify-issues.test.mjs, and
check-single-release-public-contract.mjs all pass.
- v1.27.0 and v1.28.0 ref sets are now disjoint; the six user-facing PRs
of this range (#9062#9065#9072#9074#9075#9078) each appear once.
#9067 is CI-only and stays out of user-facing notes.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Problem
PR #8866 removed the light/balanced/delivery execution modes in favor of
one adaptive standard execution, and #8930 finished the fact-driven
cleanup. Delivery-grade sessions lost their sticky completion gates, and
ordinary sessions inherited the delivery-only readiness pause: nothing
lets a session pin delivery-level verification, and nothing lets an
ordinary session opt out of the recovery card.
Root cause
The role setting existed only as deprecated no-op compatibility shims
(SetAgentPreset, tokenMode, /preset), while the fact contract rebuilt
each turn had no session-scoped floor input. The final-readiness pause
was armed by delivery scope and strict obligations instead of by an
explicit, user-selectable floor.
Fix
- taskcontract: PolicyFloor enum + ReasonPolicyFloor. The floor in force
at write time is stamped on the evidence receipt, so the per-turn pure
replay re-derives identical floor obligations even after the session
floor changes: a downgrade never retracts established obligations, and
an upgrade never retroactively tightens old writes.
- control: SetQualityFloor/QualityFloor single write path on a grouped
sessionSettings sub-state; the floor rides runtimepolicy.Constraints
through withPlannerTurnMetadata into each turn's engine.
- agent: readinessPauseActive makes the floor the only thing that arms
the final-readiness pause. The standard floor restores the pre-#8866
balanced feel across all three execution modes -- a readiness gap is
still audited but never stops the turn. Goal keeps driving because its
FSM reads Agent.ReadinessResult directly rather than consuming
FinalReadinessError, so suppressing the pause costs it no signal.
- Delivery deepens verification; it does not take over persistence. The
readiness continuation stays bounded at its existing 1-2 turns, so the
floor owns verification depth and goal mode owns "keep going".
- entries: light and every alias fold silently to standard; unknown
values error. CLI /preset and --preset/--profile, ACP
session/set_config_option (work_mode/agent_preset/quality_floor) all
become real switches; boot.Options seeds the floor at build.
- desktop: WorkspaceTab.qualityFloor replaces the redundant tokenMode
field; the eight pinned compat sites now derive from the floor;
isolated worktrees infer delivery (floorInferred); the composer gains
a standard/delivery segmented control beside tool approval, orthogonal
to the execution-mode menu; BranchMeta persists quality_floor with
legacy delivery migration.
- AcceptDeliveryToTab clears awaiting_delivery with no model turn,
idempotently, touching no other status. It is bound to the persisted
tab state rather than only the end-of-turn card: the project-tree
topic status already carries that state, so a reopened session has an
exit and no second source of truth is added. Adapted from #9037
(Phase 1) for issue #9036.
Verification
- go test ./internal/... (agent, control, taskcontract, boot, cli, acp,
evidence, agentpreset)
- go test -race ./internal/control/ ./internal/taskcontract/
./internal/agent/
- cd desktop && go test . (TestTabEventSinkForwardsImmediateWorkspace-
Mutation fails identically on pristine origin/main-v2 - pre-existing)
- desktop/frontend: pnpm typecheck, pnpm lint:hooks, pnpm build
(all bundle budgets PASS)
- gofmt, go vet ./..., make lint (golangci-lint + repolint clean,
ratchet baseline unchanged)
Cache-impact: none - the floor is host-only session state; the golden
baseline (system prompt, tool schemas, provider request, prefix shape)
stays green and TestEffectQualityFloorDoesNotTouchProviderPrefix pins
byte-identical prefixes across floors.
Co-authored-by: Linearl <[email protected]>
The bounded grace release must leave the owner able to acquire again, otherwise
the fix would trade a permanent stall for a self-lock. That contract was
implicit: the existing tests proved the lease gets released, not that either
session can actually take it afterwards — which is the whole user-visible point
of the fix.
The test drives the full alternation: owner A acquires, retains a resident job,
goes idle and loses the lease to the grace window; owner B then acquires while
A's job is still running; A reacquires for its next turn. Passes with
-race -count=3.
Problem: a session that started a resident background service (dev server,
watcher, debug server) kept the workspace write lease forever. Its own UI went
fully idle, yet every other session targeting the same workspace blocked
indefinitely on "another session is writing to this workspace", with no
recovery short of killing the job or restarting the app.
Root cause: jobs.Manager reports every started job to Owner.RetainUntil (wired
via WithJobStartObserver in boot), which increments the `background` counter.
releaseIfIdleLocked refused to release while `background != 0`, and a job's
done channel closes only when its run function returns. A resident service
never returns, so `background` stayed >= 1 and `acquired` stayed true long
after the last agent run had ended.
Fix: a retained background job now extends the lease only for a bounded grace
period after the final agent run ends, then the lease is released even while
the job keeps running. The grace release validates a lease epoch, so it can
never release a later acquisition when Timer.Stop loses the race with an
already-running callback, and BeginRun cancels any pending grace release so a
new turn never has the lease pulled out from under it.
Verification: three regression tests in internal/workspacelease cover a
resident job releasing after the grace window and the workspace becoming
acquirable by another owner, an active run cancelling a pending grace release,
and a finished job still releasing immediately. Ran with -race -count=2;
reverting the fix makes the first test fail. make lint (golangci-lint 0 issues,
repolint clean), go vet, and the boot/agent/control/tool-builtin/jobs suites
pass.
Problem:
The zh labels read plain "阶跃星辰" while five presets now span two
billing channels (Coding Plan subscription vs pay-as-you-go), so the
channel a preset targets was invisible at a glance.
Fix:
Label the subscription presets "阶跃星辰 Coding Plan (/ Anthropic)"
(zh-TW 階躍星辰, en "StepFun Coding Plan") and the metered ones
"阶跃星辰 API 按量付费" — matching the repo convention where Coding
Plan is kept as the official product name (Kimi/Qwen/GLM presets) and
only the brand is localized. Descriptions note the channel (step_plan
订阅 / 按量付费) explicitly. Contract test updated to pin the channel
suffix in every locale.
Verification:
- settings-contract 49/49
- npm run build (all bundle budgets PASS)
Problem:
StepFun runs two parallel billing channels — the Coding Plan
subscription (step_plan endpoints, monthly Credit pool) and the
pay-as-you-go standard API (account balance) — but Reasonix only offered
step_plan presets plus the Responses one. Users with pay-as-you-go keys
had no preset, even though the standard channel serves the same
reasoning models and, on the Anthropic protocol, caches prefixes
automatically.
Root cause (verified against the official docs overview + live probes
with a real key):
- Standard /v1/chat/completions and /v1/messages both serve the
step-3.7/3.5-flash SKUs; the step_plan endpoints return
"you have no active step plan subscription" for pay-as-you-go keys.
- reasoning_effort and output_config.effort measurably change reasoning
depth on the standard channel (low 49 vs high 300 output tokens).
- step-3.7-flash accepts image input on the standard channel (answered
"red" for a generated PNG) while step_plan rejects images outright.
- /v1/messages auto-caches prefixes without cache_control markers
(cache_read_input_tokens 128 on the second turn).
Fix:
- New curated presets "stepfun-api" (openai, https://api.stepfun.com/v1,
vision on step-3.7-flash) and "stepfun-api-anthropic" (anthropic,
origin base URL, thinking=adaptive) with the low/medium/high effort
ladder from the docs.
- Desktop i18n for both presets in en/zh/zh-TW (按量付费 / 按用量付費),
SettingsPanel cases, bridge mocks, and contract-test coverage.
- zh/zh-TW locale bundle budgets +0.1 KiB per the established ratchet.
The full StepFun matrix is now: stepfun / stepfun-anthropic (Coding
Plan), stepfun-responses / stepfun-api / stepfun-api-anthropic
(pay-as-you-go).
Verification:
- go test ./internal/config/ ./internal/provider/responses/
./internal/provider/openai/ (fresh runs, incl. the new
pay-as-you-go contract test)
- frontend: tsc --noEmit, npm run build (all budgets PASS),
settings-contract 49/49
- live probes: model gating, effort depth delta, vision, auto-caching
Problem:
StepFun exposes a Responses API alongside its chat-completions and
Anthropic-compatible endpoints, but Reasonix offered no preset for it, and
the three StepFun presets showed English-only labels ("StepFun") even in
the Chinese UI.
Root cause (verified live against api.stepfun.com with a real key):
- POST /v1/responses and /step_plan/v1/responses exist and speak the
OpenAI Responses wire; reasoning.effort low/medium/high works; tools
work; streaming emits response.reasoning_text.delta.
- Only step-3.7-flash is Responses-enabled (3.5 SKUs return "this model
is not enabled for the Responses API").
- The endpoint silently ignores previous_response_id (a continuation
billed only new-turn tokens and the model hallucinated), so it is
stateless like DeepSeek.
- Input reasoning items REQUIRE a summary list (400 without, 200 with),
matching DashScope's contract.
- web_search tools are silently ignored (model answers it has no
internet access), so no server-side search flag.
Fix:
- responses vendor table: add "stepfun" (stateless, toolCallReasoning,
summaryRequired) with exact-host detection for api.stepfun.com/.ai on
both the standard and step_plan paths.
- New curated preset "stepfun-responses" (kind=responses,
https://api.stepfun.com/v1, single step-3.7-flash model, stateless
mode, low/medium/high efforts).
- Desktop i18n: localize all three StepFun preset labels and
descriptions in en/zh/zh-TW ("阶跃星辰" / "階躍星辰"), wire the
label/description cases in SettingsPanel, add the bridge mock preset,
and extend the settings contract test.
- zh/zh-TW locale bundle budget +0.1 KiB per the established ratchet
(three presets' localized copy, ~0.1 KiB gzip, 0.2% over the old
gate); repolint baseline carries the touched files' existing debt.
Verification:
- go test ./internal/provider/responses/ ./internal/config/
./internal/boot/ (fresh runs)
- desktop frontend: tsc --noEmit, npm run build (all bundle budgets
PASS), settings-contract (49/49), bundle-contract (21/21)
- live curl probes with a real key on /v1/responses: effort, tools,
summary-required, statelessness, model gating
Problem:
Users connecting StepFun (阶跃星辰) as a custom OpenAI-compatible provider
got HTTP 404 on every call, while the same base URL worked in
Anthropic-protocol clients. Setup looked healthy because the model probe
succeeded, so the failure only appeared at chat time.
Root cause:
StepFun's docs hand Anthropic-SDK users a base without /v1
(https://api.stepfun.com/step_plan) because that SDK appends /v1/messages
itself. Pasting the same base into Reasonix's OpenAI-compatible client
concatenates {base}/chat/completions — a 404 — while the wizard's model
probe tries {base}/v1/models as a fallback and succeeds. The endpoint
asymmetry let a broken chat URL pass setup. Verified against the live
endpoints: /step_plan/chat/completions and /step_plan/messages return
404; /step_plan/v1/{chat/completions,messages,models} return 401 without
a key (paths exist). Both official regional hosts (api.stepfun.com China,
api.stepfun.ai global) behave identically.
Fix:
Canonicalize known official StepFun step_plan URLs at the provider
boundary, following the existing Token Rhythm pattern: the chat client
resolves any documented form of the base (with or without /v1, chat or
models leaves, doubled suffixes) to /step_plan/v1/chat/completions, and
the model fetch resolves to /step_plan/v1/models, so probe and chat can
never disagree. The user's regional host choice is preserved (#7066);
relay gateways, lookalike domains, the standard api.stepfun.com/v1
surface, and unknown paths stay untouched.
Verification:
- go test ./internal/provider/openai/ ./internal/config/ (43 new
StepFun cases incl. host-preservation, negative-domain, and
probe/chat-agreement assertions)
- go test -race ./internal/provider/openai/ -run "StepFun|TokenRhythm"
- go test ./internal/tool/builtin/ ./internal/boot/
- go vet; gofmt; repolint clean on changed files
- live endpoint probes with curl on both regional hosts
Problem:
Official DeepSeek-V4-Pro underperforms in Reasonix because its agent
post-training is peaked on DeepSeek Harness minimal-mode's first-line
persona. Without that sentence, thinking stays in the chat distribution.
Root cause:
Reasonix starts with the generic Reasonix system prompt and, in auto
mode, injects Chinese thinking on Chinese user turns. Both fight the
English "We need" agent trace the model was trained on.
Fix:
Prepend the official DSH persona as the first system-prompt paragraph
only for api.deepseek.com DeepSeek-V4-Pro. Strip it when the session
is not that model. Pin auto reasoning language to English for that
entry so per-turn Chinese inference cannot override the persona.
Explicit zh/en settings stay user-owned.
Verification:
- go test ./internal/config/ -count=1
- go test ./internal/boot/ -count=1
- go test ./internal/tool/builtin/ -count=1
- make lint
Problem: expanded long transcripts could flash or oscillate after the native scrollbar reached the bottom; after the first corrective write the viewport could also strand far above the bottom when the post-drag remeasure read as a shrink.
Root cause: every repeated non-bottom scroll delivery while tail-follow was active re-armed the tail writer, so WebView2/Virtuoso measurement churn could loop programmatic bottom writes against native scrolling. Conversely, gating re-arm on the bottom-to-non-bottom edge alone left no convergence lane when the native-thumb release remeasure netted a height drop and was misread as CONTENT_SHRANK (which deliberately does not re-aim the tail).
Fix: keep the edge trigger for bottom-adjacent jitter, and let a substantial displacement (>= 24px above the bottom, same scale as the shrink threshold) re-arm the tail writer regardless of the previous delivery state, so a misread shrink cannot strand the viewport. The tail-settle tick also checks convergence before writing, so a late layout event against an already-settled viewport emits no redundant write.
Verification: pnpm test:transcript (46 passed incl. new substantial-displacement and misread-shrink cases); pnpm build; transcript scroll stability browser gate (52 consecutive local runs: zero stranded-tail stalls, idle stable-tail writes 0 of 0; residual 284/288 waits reproduce at the same rate on main-v2 base and are pre-existing); git diff --check.
Problem: after 1.27.0, clicking an early question in the navigator rail of a
long transcript still jumped to the transcript tail (or appeared dead when
already at the tail). The rewind jump had the same defect.
Root cause: `scrollToDataIndex` dispatched `firstItemIndex + dataIndex` to
Virtuoso's `scrollToIndex`, but Virtuoso's index normalizer clamps any index
to `totalCount - 1` — react-virtuoso expects a data-relative index even when
`firstItemIndex` is set. With the 1,000,000 index base, every jump clamped to
the last row. #9054 (selection cleanup) and #9013 (single activation) fixed
different failure modes; the index defect itself shipped through.
Fix: `scrollToDataIndex` now takes the data-relative index only. Both call
sites (question navigation and the rewind signal) pass the row index straight
through. #9054's stale-selection cleanup in handleJumpToQuestion is preserved
unchanged. Recovery restores keep using `firstItemIndex + index` because they
feed `initialTopMostItemIndex`, where Virtuoso does expect the absolute
location.
Verification:
- new transcript-question-jump.test.tsx asserts real landing (mounted target
row inside the viewport) for first/middle/tail positions, back-and-forth
jumps, stale-text-selection jumps, rewind, and older-history prepend;
reverted against the pre-fix code it fails on the first jump (timeout
waiting for the target question to mount)
- wired into `pnpm test:transcript` (all suites green)
- `pnpm run test:typecheck`, `pnpm run lint:hooks`, `check:scroll-writer`: OK
- transcript-recovery-race.test.tsx updated for the new one-arg signature
Index fix authored by hanswu in closed PR #9027; re-applied here on top of
#9054 with the landing tests extended and wired into the standard script.
Co-authored-by: hanswu <[email protected]>
Problem: every PR's lint job turned red today with
`internal/remote/auth.go:150-151: SA4023: this comparison is always true`
on the GOOS=windows cross-platform leg, including frontend-only PRs whose
merge tree is byte-identical to main-v2 in every Go file. PR #9062 and
#9065 both hit it deterministically; the same leg passed on the 2026-08-17
23:36 UTC main-v2 push run with the same tree, tool pin (golangci-lint
v2.12.2, Go 1.26.6), and runner image hash. Not reproducible locally
(macOS binary, clean cache, CI Go toolchain: 0 issues), so a runner-side
analysis-cache state flipped the pre-existing finding to visible.
Root cause: dialAgent's Windows stub (agent_windows.go) always returns a
non-nil error, so staticcheck is correct that `err != nil` after the call
is trivially true under GOOS=windows. The comparison is meaningful on
Unix where dialAgent can succeed; the finding is dormant debt of the
documented "named-pipe transport is a V2 follow-up" stub, not a bug any
PR introduced.
Fix: one scoped exclusion in .golangci.yml — path internal/remote/auth.go,
linter staticcheck, rule SA4023 — mirroring the existing SA5011 scoped
suppression pattern. SA4023 keeps guarding every other file, and the
exclusion self-justifies removal when the Windows agent dialer is
implemented.
Verification:
- GOOS=windows golangci-lint run ./internal/remote/: 0 issues
- GOOS=darwin and native legs: 0 issues
- full ./... sweeps clean on the SA5011-pattern shape (config parses,
exclusion scoped)
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* fix(desktop): recover question navigation after lost selection
Problem:
- Assistant completion prose could appear to contradict the host-owned readiness card.
- A lost WebView2 pointerup could leave transcript selection owning scroll, so question navigation clicks were silently rejected.
Root cause:
- The readiness copy did not explicitly distinguish assistant-generated text from the system check result.
- Question navigation did not clear stale transcript selection before requesting an indexed jump.
Fix:
- Clarify readiness copy in English, Simplified Chinese, and Traditional Chinese.
- Clear native and retained transcript selection before the question navigator submits its single scroll request.
- Cover the selection-to-navigation transition with reducer, race, and real-browser regression evidence.
Verification:
- pnpm test:transcript
- pnpm build
- pnpm typecheck
- pnpm lint:hooks
- pnpm check:scroll-writer
- PLAYWRIGHT_BROWSERS_PATH=.pw-browsers node bench/transcript-scroll-stability.mjs
- git diff --check
* fix(desktop): keep locale bundles within budget
Shorten the readiness clarification without changing its meaning so the Simplified and Traditional Chinese lazy chunks remain below their enforced gzip budgets.
* fix: allow ordered complete step batches
Remove the artificial one-signoff-per-round guard while keeping complete_step serial and Todo-ordered. Update executor handoff guidance and regression coverage so consecutive evidence-backed sign-offs can share one provider round without changing provider-visible tool schemas.
* feat: shadow anchor safety for delete range
Record model-visible read windows as turn-scoped line digests and compare delete_range targets in a content-free shadow audit. Keep the legacy fresh-read gate and provider schemas unchanged while preserving audit forwarding through every sink wrapper.
* feat: enforce interval fingerprints for delete range
Use eligible model-visible anchor intervals to replace the legacy same-turn full-read gate for built-in delete_range. Native target errors remain native, same-batch reads stay ineligible, and a host-only kill switch restores the legacy policy.
* feat: close anchor safety rollout gaps
Add content-free anchor audit aggregation to e2ebench, expose the legacy fresh-read rollback switch only through trusted user configuration, document ordered sign-offs, and expand batch/partial-window regression coverage.
* refactor: extract anchor safety owners
Problem: the implementation added lines to several already-baselined oversized files and failed the repository lint gate.\n\nRoot cause: new anchor audit, gate, config rendering, ledger, and batch tests were placed in legacy owner files.\n\nFix: move each concern into a focused sibling file and compact the user-global config preservation without changing runtime behavior or updating lint baselines.\n\nVerification: go test ./...; go test -race ./internal/agent ./internal/evidence ./cmd/e2ebench; go vet ./...; go run ./tools/repolint.
* fix: use split sequence for read observations
Problem: CI modernize lint rejected strings.Split allocation in the read_file observation parser.\n\nRoot cause: the parser iterated over a materialized slice even though it only streams once.\n\nFix: range over strings.SplitSeq.\n\nVerification: focused builtin/agent tests, go vet, repolint, and golangci-lint all pass.
Problem: transcript-scroll-stability intermittently timed out after native thumb release because an upward wheel could remain in tail-follow, and the browser gate sometimes targeted transient or browser-owned gutter geometry.
Root cause: USER_SCROLL_INTENT did not retain gesture direction, so a queued SCROLL_DELIVERED(atBottom=true) could reclaim the tail before Chromium applied the upward wheel default action. The benchmark also reused stale viewport coordinates.
Fix: record whether active reader intent may claim the physical tail, allow that transition only for downward/native-bottom gestures, and clear the capability with the intent lifecycle. Re-resolve a visible row-padding target for outer wheel gestures and let trusted wheel input settle before assertions.
Verification: pnpm test:transcript; pnpm test:transcript-browser; pnpm test:typecheck; pnpm build; transcript-scroll-stability 10 consecutive Chromium runs; go run ./tools/repolint; git diff --check.
* fix(provider): recover Responses tool turns without reasoning
Problem:
DeepSeek Responses, MiMo Responses, and reasoning-disabled Responses runs could stop before executing a valid tool call when the provider omitted a reasoning item.
Root cause:
The Responses adapter declared replay-required reasoning but could not express that its function_call/function_call_output history remains valid when the optional reasoning item is absent. It also kept the replay contract enabled when reasoning was explicitly disabled.
Fix:
Declare the protocol-valid empty-reasoning fallback for recognized stateless Responses vendors, make the replay requirement effort-aware, and retain one exact probe for DeepSeek Pro while Flash, MiMo, and disabled-thinking turns continue without a redundant request.
Verification:
- go test ./... -count=1
- go test -race ./internal/provider/responses ./internal/agent -run Responses -count=1
- go vet ./...
- ./scripts/cache-guard.sh
- go run ./tools/repolint
* test(provider): cover live DeepSeek Responses recovery
Problem:
The deterministic fixture covered missing Responses reasoning, but the official paid endpoint had no Agent-level live tool-loop or forced-omission regression.
Root cause:
Existing live Responses coverage exercised server web search only, so it did not prove client tools execute exactly once when Flash or Pro omits replayable reasoning.
Fix:
Add credential-gated live Agent loops for official Flash and Pro plus a localhost stream proxy that removes reasoning events from real DeepSeek Responses tool turns. Assert Flash continues without a retry, Pro retries the frozen request once, and both execute the tool exactly once.
Verification:
- official Flash/Pro: 10 live tool loops each
- forced missing reasoning: Flash stripped 25 events; Pro stripped 57 events across two responses
- go vet -tags=live ./internal/agent
- go run ./tools/repolint
* fix(desktop): converge transcript tail on native geometry
Problem: v1.26 could still strand very long sessions above the physical bottom after a session switch, a native scrollbar release, or delayed Virtuoso measurement. The jump-bottom control remained visible and the adjacent workspace resizer overlapped the scrollbar hit area.
Root cause: the arbiter treated Virtuoso's logical atBottom callback as truth, bounded tail convergence to a short retry window, and let stale frames outlive their scroll surface. Reader intent and native thumb release were not delivered with authoritative physical geometry.
Fix: derive bottom ownership from the live scroller, keep tail-follow convergent across later layout changes, bind asynchronous work to the current generation and scrollport, and hand off nested/user gestures explicitly. Move the workspace resize hit area into the dock and centralize pointer cleanup. Add deterministic races plus a sanitized 70-tool/44-assistant long-turn browser fixture.
Verification: pnpm test:transcript; focused resize/workspace tests; pnpm build; real Chromium transcript browser gates; repolint; git diff --check; Windows 11 WebView2 at 100%, 125%, and 150% DPI with repeated session switches, jump-bottom clicks, composer resizes, and native thumb drags.
* test(desktop): target the outer transcript gutter
Problem: the browser gate used the transcript center to create outer wheel intent after native thumb release. Expanded nested tool or code scrollers could correctly retain that gesture, leaving the test waiting for manual mode.
Root cause: the test input point did not guarantee ownership by the outer scrollport after nested-scroll handoff became explicit.
Fix: aim the explicit-bottom precondition at the reserved right transcript gutter, matching the storm precondition. Product timeouts, pixel thresholds, and scroll behavior remain unchanged.
Verification: transcript-scroll-stability.mjs passed twice consecutively in real Chromium.
* test(desktop): require tail ownership during churn
Problem: the browser gate stopped issuing downward wheels after observing a transient physical bottom, then waited for tail-follow separately. Random height churn could land between that sample and the scroll delivery, leaving the test in manual mode with no further user input.
Root cause: the loop termination condition checked native distance but not whether the arbiter had accepted the same gesture as tail ownership.
Fix: keep both measurement-churn loops active until the transcript is within one pixel and reports tail-follow. Attempt budgets, timeouts, and pixel tolerances remain unchanged.
Verification: transcript-scroll-stability.mjs passed four consecutive real Chromium runs.
Problem:
When requestAnimationFrame stopped firing (WebView2 window minimized or
occluded, main thread saturated by a long transcript), text/reasoning
deltas piled up in the rAF batch buffer indefinitely: nothing was flushed
until a non-stream event (e.g. Stop) called drain(). Users saw the
transcript frozen on "thinking…" with the whole reply appearing only
after pressing Stop, even though the backend had finished streaming.
Root cause:
createRafBatch only flushed on requestAnimationFrame callbacks and had no
fallback when frames stopped being produced.
Fix:
Arm a 200ms stall timer alongside the rAF handle. Whichever fires first
flushes; an earlier flush cancels the timer, so the visible path keeps its
one-flush-per-frame behavior and the fallback only engages while rAF is
stalled. Add a dedicated raf-batch test suite covering the visible path,
the stalled path, drain semantics, re-entrant pushes, and the microtask
fallback.
Verification:
- tsx src/__tests__/raf-batch.test.ts (19/19)
- tsx src/__tests__/stream-delta-batch.test.ts (20/20, regression)
- tsx src/__tests__/use-controller-stream-progress.test.ts (95/95, regression)
- tsc --noEmit
- eslint src/lib/rafBatch.ts src/__tests__/raf-batch.test.ts
* Fix tool-result cache prefix stability
Problem: complete tool RawContent was promoted into ordinary provider requests, making large results consume context and destabilize cacheable prefixes.
Root cause: sampling, summaries, projection replay, and covered-prefix hashing shared the promoted RawContent representation instead of the bounded persisted Content.
Fix: keep provider-visible tool results at 32KB, add session-scoped paged recovery through use_capability, and exactly migrate promoted-RawContent sidecars back to bounded hashes without changing session JSON or top-level tool schemas.
Verification: focused agent tests, race tests, cache guard scenarios, boot/repolint tests, and DeepSeek live A/B cache trend checks.
* Extract tool-result capability helpers
Move the new marker and restricted-list helpers out of already-large agent files so the implementation stays within repository size budgets without changing behavior or repolint baselines.
* Handle missing raw results by marker reference
When a new-format truncated record no longer has RawContent, retain the original result_ref from its marker so explicit recovery returns the stable unrecoverable-result error instead of a misleading not-found response.
* Modernize tool-result iteration
Use slices.Backward and strings.FieldsSeq so the new capability code satisfies the repository's golangci modernize checks without changing selection or marker parsing behavior.
* Fix provider projection isolation
Problem:
- Request normalization could mutate its provider-visible input copy and break active-turn and overflow progress decisions.
- Pressure pruning could derive provider-visible content from local RawContent.
Root cause:
- ModelMessages has a zero-copy fast path, but request-only metadata cleanup assumed an isolated slice.
- The pressure prune source preferred RawContent over bounded Content.
Fix:
- Detach the request message slice before request-only rewrites.
- Prune only provider-visible Content or the legacy ProviderContent representation.
- Add regressions for input immutability and RawContent pressure isolation.
Verification:
- go test ./...
- go test -race ./internal/agent
- ./scripts/cache-guard.sh
- go vet ./...
- go run ./tools/repolint
* Harden tool-result migration isolation
Problem:
- promoted sidecars could retain full tool-result bodies after their hashes were migrated
- restricted capability frontends could share a session reader across agents
Root cause:
- sidecar migration normalized only covered hashes
- clone paths handled only bare UseCapabilityTool instances
Fix:
- normalize exact promoted projection bodies to canonical bounded Content and fail closed on ambiguous bodies
- clone restricted frontends, resolvers, and allowlists for subagents and planners
- add load, recovery-copy, duplicate-ID, schema-stability, and session-isolation regressions
Verification:
- go test ./internal/agent ./internal/boot -count=1
- go test -race ./internal/agent -count=1
- ./scripts/cache-guard.sh
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
* Satisfy capability clone lint
Problem:
- CI lint rejected the bool-map clone loop under the modernize ruleset
Root cause:
- the helper used a manual map assignment loop
Fix:
- copy immutable allowlist snapshots with maps.Copy
Verification:
- golangci-lint run --timeout=5m
- go test ./internal/agent -run 'Test(RestrictedCapabilityFrontendCloneKeepsAgentSessionsIsolated|PlannerRestrictedCapabilityFrontendCloneKeepsExecutorSession|PlannerToolRegistryClonesUseCapability)' -count=1
- go vet ./internal/agent
- go run ./tools/repolint
* Fix path-bound tool-result session binding
Problem:
- explicit write_paths subagents exposed use_capability but could not read their own retained tool results
Root cause:
- pathBoundCapabilityProxy did not forward the session binder and cloneCapabilityFrontend did not rebuild that wrapper around an agent-owned frontend
Fix:
- forward session binding through the path-bound wrapper
- deep-clone its inner unrestricted or restricted frontend before rebuilding the wrapper
- cover parent/child session isolation and provider-visible schema stability
Verification:
- go test ./...
- go test -race ./internal/agent
- go vet ./...
- golangci-lint run --timeout=5m
- go run ./tools/repolint
- ./scripts/cache-guard.sh
Problem:
The fixed no-progress guard cannot be evaluated against real runs without first observing where an adaptive investigation account would have spent.
Root cause:
The runway work in #8404 mixed its counterfactual scorer and trajectory fields with an immediate replacement of live guard behavior on an obsolete runtime baseline.
Fix:
Keep the account private to OutcomeTracker, persist presence-aware balance/dry/idle/spent samples, preserve the optional state across experiment forks, and aggregate counterfactual spend in e2ebench. Leave ProgressTracker, arbiter verdicts, notices, prompts, and Goal behavior unchanged.
Verification:
- go test ./...
- go test -race ./internal/evidence ./internal/trajectory ./internal/agent ./cmd/e2ebench
- go vet ./...
- go run ./tools/repolint
- golangci-lint run --timeout=5m ./...
- scripts/check-cache-impact.sh
- scripts/check-docs-impact.sh
- git diff --check
Co-authored-by: yhh <[email protected]>
* fix(event): stop the quoting sink from swallowing every audit channel
CostQuoteSink forwarded Emit but not the optional sink capabilities, so every
recorder below it received nothing. In the CLI run chain that is the stats
recorder and the trajectory recorder: a real `reasonix run --trajectory` wrote
2130 event records and zero audit records — no outcome progress, no readiness
audits, no completion reports, no delegation admissions, no protocol recovery.
The shadow instrumentation those channels carry is the input to the EBM and
reasoning-governor experiments, so their trajectories have been empty of the
samples they were built to compare, and cmd/e2ebench has been silently falling
back to its verification backfill.
Embed AuditForwarder, which exists for exactly this and whose own comment
records the lesson: hand-written forwarding lost capabilities at multiple
wrappers while their owning tests stayed green.
The regression test drives the package dispatchers rather than the methods, so
it fails with a named channel per capability instead of a build error — the
dispatchers are the real path, and a wrapper that loses one no-ops silently.
* fix(event): preserve every optional sink capability
Problem:
The quoting fix and sibling decorators still dropped RunBudget and WorkspaceMutation, while stats consumed explicit turn-completion signals without forwarding them.
Root cause:
Optional sink capabilities were repeated as partial handwritten method lists, and the tests repeated another incomplete interface list.
Fix:
Define one optional-capability contract, enforce it on every decorator, forward the missing signals through the production chain, and keep CostQuoteSink on one authoritative inner sink.
Verification:
- go test ./internal/event ./internal/boot ./internal/stats ./internal/trajectory ./internal/control ./internal/cli
- git diff --check
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
* Fix cross-session navigation ghost content
Problem:
Cross-session navigation could leave the source transcript and session-only controls visible until asynchronous tab or history work completed, producing ghost conversations and unsafe interactions.
Root cause:
The app had no navigation-scoped surface transition, and hydration implicitly reused resident items without proving session identity. Older async completions could also release newer visual transitions.
Fix:
Add a compare-and-clear navigation surface intent, synchronously mask source session UI during every navigation path, and hand off to the target hydration loader. Split hydration into preserve-current and replace-surface policies, require matching non-empty session identity before retaining placeholders, and keep target failures isolated from source content.
Verification:
Focused navigation, hydration, tab-switch, and transcript tests passed. Frontend type checks, transcript suite, production build, repository lint, diff checks, and an embedded-browser delayed-navigation inspection passed.
* Close navigation identity and reveal races
Problem:
Tab switching could reuse resident rows when a tab ID was rebound to another session generation, and stale Reveal calls could leave backend focus on a superseded tab.
Root cause:
switchTab did not apply the shared session identity policy, while App discarded stale backend-activating Reveal results without reasserting the visible tab.
Fix:
Apply replace-surface hydration for unproven tab identities, preserve only explicitly proven same-session state, and guard both Reveal paths with visible-tab backend repair. Add deterministic deferred-promise regressions for generation rebind failures and stale Reveal completions.
Verification:
- focused navigation and hydration race suites
- pnpm typecheck
- pnpm test:transcript
- pnpm build
- go run ./tools/repolint
- git diff --check
* fix(desktop): harden navigation surface handoff
Problem:
- Workspace changes could expose the source transcript before Wails returned.
- A delayed backend sync could overwrite a newer same-tab session generation.
Fix:
- Route workspace changes through the shared navigation intent and mask.
- Fence backend syncs by navigation generation and explicit hydration policy.
- Preserve only provably same-session history or an unbound active runtime tail.
- Keep live prompt/runtime state intact when target history loading fails.
Verification:
- Navigation, hydration, prompt, topic, worktree, and running-tab regression suites
- pnpm typecheck; pnpm test:typecheck; pnpm test:transcript; pnpm build
- go run ./tools/repolint; git diff --check
* fix(deps): pin complete Linux tray support
Problem:
Linux tray registration could expose an incomplete StatusNotifierItem surface and systray shutdown could dereference a missing DBus connection.
Root cause:
The tagged systray release predates the upstream StatusNotifierItem property and nativeEnd guards required by the desktop lifecycle recovery path.
Fix:
Pin fyne.io/systray to upstream commit f60f01be81c6, including the complete SNI property set and safe DBus shutdown guard.
Verification:
- go test ./... -count=1 (desktop module)
- Go module checksum verification through go test
* fix(desktop): coordinate native shell recovery
Problem:
Linux could keep a background process after losing its only restore path, present minimised GTK windows with an invalid show sequence, and treat DOM navigation as proof that the renderer was healthy.
Root cause:
Window presentation, tray readiness, and renderer recovery were owned by separate callbacks. Linux tray readiness trusted systray configuration rather than the live StatusNotifier registration, and WebKit recovery lacked a bounded compatibility restart contract.
Fix:
Add an App-owned shell coordinator, route main-window presentation through platform plans, confirm Linux GTK visibility, gate background close on bounded private-DBus health probes, and recover one stalled WebKitGTK launch with a loop-guarded software-rendering restart. Keep Windows and macOS presentation ordering and WebView2 guidance intact.
Verification:
- go test ./... -count=1 (desktop module)
- go test -race . -run desktop shell and recovery contracts
- go vet .
- CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go test -c .
- CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go test -c .
- go run ./tools/repolint
* fix(desktop): expose shell restore capability
Problem:
Users who selected close-to-background could not tell when the current desktop session lacked a usable tray restore path.
Root cause:
The frontend had no read-only view of native shell readiness and therefore could only display the persisted close preference, not the current-session capability.
Fix:
Expose the sanitized DesktopShellStatus Wails contract and event, normalize it at the bridge boundary, and show a localized in-place warning without rewriting close_behavior.
Verification:
- pnpm lint:hooks
- pnpm typecheck
- pnpm test:typecheck
- desktop close behavior hint component test
* test(desktop): guard shell recovery contracts
Problem:
The platform presentation order, tray registration buckets, restart loop guard, stable frontend heartbeat, and settings fallback were previously implicit and easy to regress.
Root cause:
Existing tests covered the older Windows restore path but did not model the unified shell owner or Linux compatibility recovery journal.
Fix:
Add focused state, platform-action, tray-loss, environment, journal, WebKit heartbeat, shutdown, and frontend fallback coverage. Document the automatic WebKitGTK and StatusNotifier recovery behavior.
Verification:
- go test ./... -count=1 (desktop module)
- go test -race . -run desktop shell and recovery contracts
- pnpm test (all frontend suites)
- go run ./tools/repolint
- git diff --check
* fix(desktop): satisfy cross-platform shell lint
Problem:
The macOS desktop lint job rejected a shell coordinator helper that had no production callers.
Root cause:
The unused accessor remained after the tray-loss tests were rewritten around observable presentation behavior.
Fix:
Remove the dead accessor without changing coordinator state or platform presentation behavior.
Verification:
- golangci-lint run --timeout=5m
- focused desktop shell tests
- git diff --check
* fix(desktop): bound Linux shell health probes
Problem:
- StatusNotifier session-bus authentication could outlive the tray probe deadline.
- Mutter may report a minimised Wayland surface as visible and mapped, clearing recovery evidence before the window is usable.
Root cause:
- The private DBus connection performed Auth and Hello without a cancelable transport context.
- The native restore probe trusted GTK client-side visibility on Wayland without compositor acknowledgement.
Fix:
- Own and cancel the private DBus transport, reuse healthy connections, and cover watcher/host/item transitions plus stalled Auth and Hello.
- Require an active main window or active transient on Wayland while retaining the existing X11 visibility checks.
- Install dbus-daemon explicitly in both Linux CI jobs.
Verification:
- go vet ./...
- go test -race . -run 'Test(DesktopShell|TrayLoss|EvaluateStatusNotifier|LinuxRenderer|WebKitReload|WebKitRecovery|WindowRestore)' -count=1
- golangci-lint run --timeout=5m
- Ubuntu 24.04 ARM64 GNOME Wayland native launch, minimise, second-instance restore, timeout dialog, and no-host close smoke
* fix(desktop): exit when Wayland recovery stays unreachable
Problem:
- Wayland can reject a present request that has no activation token.
- Wails then creates the recovery dialog inside the minimised window's nested GTK loop, leaving both surfaces unreachable.
Root cause:
- The recovery timeout recorded the failure but had no terminal fallback when the compositor still did not acknowledge either the main window or its transient dialog.
Fix:
- Recheck native visibility shortly after showing the warning.
- If the compositor still exposes no usable surface, destroy the Reasonix GTK window on the main context and quit the outer loop cleanly.
Verification:
- Ubuntu 24.04 ARM64 GNOME Wayland production build
- maximised -> minimised -> no-token second-instance launch
- recovery journal timeout followed by controlled primary-process exit with no unreachable process left behind
* chore(desktop): satisfy repository comment policy
* fix(agent): scope unfinished todo readiness to closed loops
Problem:
Ordinary turns could treat a partially completed cross-turn todo list as an incomplete delivery, trigger automatic recovery, and leave users in Goal-flavored readiness handling.
Root cause:
The final readiness gate and run loop made incomplete todos unconditional hard failures, while the ordinary readiness continuation prompt also injected every open todo even when todo was not a reported gap.
Fix:
Gate incomplete-todo contradictions on closedLoopActive and include todo context in synthetic continuation prompts only when the host reports a todo gap. Preserve strict Goal, approved-plan, and strict-obligation behavior, and document the bounded ordinary continuation contract.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/control
- go vet ./...
- go run ./tools/repolint
- scripts/check-docs-impact.sh
- scripts/check-cache-impact.sh
- git diff --check
Co-authored-by: erphenheimer <[email protected]>
* fix(control): modernize readiness gap lookup
Problem:
The PR lint job rejected the hand-written membership loop under the modernize slicescontains rule.
Root cause:
The readiness prompt helper duplicated the standard library slices.Contains operation.
Fix:
Use slices.Contains directly and remove the redundant helper.
Verification:
- go test ./internal/control
- golangci-lint run --timeout=5m
- go vet ./internal/control
- go run ./tools/repolint
- git diff --check
---------
Co-authored-by: erphenheimer <[email protected]>
* Fix project tree reorder during topic switches
Problem:
Switching topics could temporarily reorder the project tree and regress visible activity timestamps before restoring the canonical order.
Root cause:
Single-surface tab pruning treated runtime ownership changes as catalog mutations, triggering broad directory reconciles. Reconcile batches published intermediate revisions, and the frontend replaced complete resident rows with incomplete catalog pages.
Fix:
Keep topic switching runtime-only, index committed sidecar changes by exact session path, remove discarded blank sessions exactly, publish directory reconciliation only after completion, and preserve complete frontend metadata across incomplete pages.
Verification:
- go test ./...
- cd desktop && go test ./...
- focused go test -race coverage for sessioncatalog and desktop
- frontend 187-suite test run, type checks, lint, CSS checks, and production build
* Satisfy repository size budgets
Problem:
The project tree ordering fix added regression coverage and catalog helpers to files that were already at their repository size budgets, causing the PR lint job to fail.
Root cause:
The behavior was correct, but the new tests and helpers were colocated with oversized legacy files instead of focused modules.
Fix:
Move catalog completeness and reconcile publication coverage into dedicated test files, relocate session-catalog helpers out of tabs.go, and remove a redundant reconcile comment without changing runtime behavior or lint baselines.
Verification:
- go run ./tools/repolint
- go test ./...
- cd desktop && go test ./...
- focused root and desktop go test -race
- cd desktop/frontend && pnpm test
- pnpm typecheck
- pnpm test:typecheck
- pnpm lint:hooks
* fix(desktop): use FSEvents for macOS workspace watching
Problem:
Large macOS workspaces can exhaust the process file descriptor limit during Desktop startup, preventing config migration, subagent cleanup, and session persistence.
Root cause:
The fsnotify kqueue backend consumes descriptors per watched filesystem entry while the workspace hub recursively registers directory trees.
Fix:
Use one native FSEventStream per macOS watch root, preserve recursive filtering and Git metadata semantics, and make stream teardown callback-safe across concurrent Remove and Close calls. Fail closed when CGO is unavailable instead of falling back to kqueue.
Verification:
Focused Darwin lifecycle tests pass with the race detector and cgocheck2. Pure-Go compilation, arm64/amd64 CGO builds, go vet, golangci-lint, repolint, and diff checks pass. macOS CI now runs native event and low-RLIMIT regressions.
* fix(desktop): synchronize FSEvents watcher startup
Problem: macOS CI could observe startup-time filesystem activity as live workspace mutations, while tests compared canonical FSEvents paths against /var aliases.
Root cause: FSEventStreamStart returns before the service has flushed its registration boundary, and temporary directory paths can resolve through the /private/var symlink.
Fix: synchronously flush each stream before Add returns, suppress callbacks until that boundary is established, and use canonical roots in native delivery tests.
Verification: Darwin lifecycle race tests, cgocheck2, no-CGO compilation, go vet, golangci-lint, repolint, clang syntax checks, and diff checks pass locally.
* test(desktop): isolate FSEvents startup delivery
Problem: exact workspace revision assertions raced with pre-subscription filesystem activity that FSEvents can assign and deliver after stream startup.
Root cause: FSEvents delivery is asynchronous across the service boundary; a synchronous flush still cannot define event creation time and can stall Add when the service is unhealthy.
Fix: remove the blocking startup flush and readiness gate, then let the two exact-count Darwin hub tests wait for startup events to settle before measuring their own mutations.
Verification: repeated Darwin race assertions, lifecycle race tests, cgocheck2, no-CGO compilation, go vet, golangci-lint, repolint, clang syntax checks, and diff checks pass locally.
Problem:
A single mouse click on the transcript question rail could emit two indexed jumps, causing long conversations to snap back toward the latest turn.
Root cause:
The rail handled both mousedown and the following click for the same physical gesture. The second handler could recalculate and overwrite the first destination after active-marker state changed.
Fix:
Make mousedown the sole pointer activation owner while preserving keyboard button activation. Add focused DOM coverage and a real-browser scroll-write assertion for the one-gesture/one-jump contract.
Verification:
- pnpm test:transcript
- pnpm typecheck
- pnpm build
- Chrome transcript scroll stability browser gate
- git diff --check
- Add max-height: none to .workspace-preview__body--code .code so the
.code--scroll-y class (added for virtual-scrolled files) does not cap
the preview at min(60vh, 28rem), which left the bottom half empty.
- Introduce codePreviewLayoutActive to keep the flex-column layout
during code file loading, avoiding stale gaps when the viewer mounts.
Ctrl+V ran the image path unconditionally and blocked the whole paste when
no image was found, reporting a missing wl-paste/xclip even where both are
installed. Separate an empty clipboard from a missing tool, degrade to text
paste, and skip the fallback when the terminal already delivered a bracketed
paste for that key press.
Closes#8992
* feat(billing): adapt DeepSeek V4 scheduled pricing
Problem:
DeepSeek V4 pricing now varies by Beijing peak windows, while Reasonix used static rates and did not expose the Pro low reasoning effort consistently.
Root cause:
Billing, budget enforcement, telemetry, and UI surfaces derived costs through separate paths without an occurrence-time rate schedule.
Fix:
- add effective-dated peak and off-peak DeepSeek V4 rate catalogs
- propagate one CostQuote through budgets, events, stats, CLI, ACP, and desktop
- migrate exact official defaults to config v7 without touching custom pricing
- support Pro low across Chat, Responses, and Anthropic protocols
- expose accessible peak, off-peak, and mixed-rate UI labels and documentation
Verification:
- go test ./...
- cd desktop && go test ./...
- cd desktop/frontend && pnpm test:typecheck
- cd desktop/frontend && pnpm test
- cd desktop/frontend && pnpm build
* chore(ci): refresh touched-file lint budgets
Problem:
The repository standards job rejects increases in legacy files that already exceed the global size and complexity ceilings.
Root cause:
Scheduled billing propagation and its protocol/UI coverage add small, deliberate increments to six existing baselined findings.
Fix:
Raise only those six per-file baselines to their measured values, leaving all unrelated baselines unchanged.
Verification:
- go run ./tools/repolint
- git diff --check
* fix(cli): remove obsolete pricing helper
Problem:
The lint job reports pricingCurrencyCode as unused after CostQuote became the single source for displayed currency.
Root cause:
The former static-pricing normalization helper remained after all call sites migrated to CostQuote.
Fix:
Remove the dead helper.
Verification:
- go test ./internal/cli
- go run ./tools/repolint
- golangci-lint run --timeout=5m
* fix(deepseek): preserve billing and effort semantics
Problem:
Skill subagents could prebuild static peak quotes, default DeepSeek V4 aliases were rejected, and multi-model provider effort settings were shadowed.
Root cause:
The skill options factory omitted QuoteContext, strict supported_efforts validation ran before built-in alias handling, and capability backfill ignored provider-level vocabularies.
Fix:
Propagate the shared quote context, retain aliases for the exact built-in DeepSeek V4 vocabulary, and keep provider-level and explicit model effort overrides authoritative.
Verification:
go test ./...
go vet ./...
go test -race ./internal/config ./internal/boot ./internal/event ./internal/agent
(cd desktop && go test ./...)
(cd desktop/frontend && pnpm test:typecheck && pnpm test && pnpm build)
* fix(config): keep effort aliases within lint budget
Problem:
The DeepSeek V4 alias compatibility block pushed NormalizeEffort beyond the repository's function-size, complexity, and comment budgets.
Root cause:
Alias detection was implemented inline in an already baselined normalization function.
Fix:
Move built-in model alias resolution into a focused helper without changing custom supported_efforts semantics or updating the repolint baseline.
Verification:
go run ./tools/repolint
go test ./internal/config
go test ./...
go vet ./...
* docs(release): prepare v1.25.4 notes
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* docs(release): remove automation from v1.25.4 credits
Problem:
Regenerating the reviewed v1.25.4 record after the release-gate fix treated the earlier Notes commit author as a product contributor.
Root cause:
The regenerated contributor list included github-actions[bot] from the first Notes merge.
Fix:
Keep the reviewed product contributors and remove the automation account from the public credits.
Verification:
Validate and render the release catalog and run the release-notes contract tests.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: SivanCola <[email protected]>
Problem:
The formal frontend release gate failed during test:typecheck on terminal regression tests.
Root cause:
The tests used Array.prototype.at outside the configured TypeScript lib target and declared the key property twice in a keyboard-event fixture.
Fix:
Use target-compatible final-element indexing and let the typed override provide the event key once.
Verification:
Run pnpm test:typecheck, pnpm test:terminal, pnpm test:all, and pnpm build.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* feat(agent): align context compaction with harness semantics
Problem:
Reasonix bounded tool results before provider admission and summarized through a separate prompt shape, reducing model-visible fidelity and prompt-cache reuse. Legacy retention and fallback behavior could also fabricate lossy summaries after failures.
Root cause:
Tool pruning, summary construction, timeout ownership, and persistence were split across independent paths with cache-breaking prompts and legacy keep rules.
Fix:
- make pressure maintenance single-flight and durably prune large tool results
- replay cache-aligned summary prefixes with fixed 16% retention and an 8192-token cap
- remove fabricated fallback summaries and unify provider idle guards at 300 seconds
- update compatibility defaults, desktop surfaces, documentation, and regression coverage
Verification:
- go test ./internal/agent ./internal/provider/... ./internal/config
- go test -race ./internal/agent ./internal/extension/providerext
- go test ./...
- cd desktop && go test ./...
- cd desktop/frontend && pnpm typecheck && pnpm test
- git diff --check
* test(agent): isolate compaction extension coverage
Problem:
The compaction changes added assertions to an already oversized extension test file, which exceeded its repolint carry-forward budget and failed the PR lint job.
Root cause:
The new summary-input mode coverage was placed beside legacy extension cases instead of in a focused test file.
Fix:
Move the two compaction summary-input extension tests into a dedicated file without changing their behavior or widening the lint baseline.
Verification:
- go test ./internal/agent -run TestCompactionPrepareReplace
- go run ./tools/repolint
- git diff --check
* fix(agent): harden context compaction recovery
Problem:
Overflow recovery could build an inadmissible summary request, extension guidance-only replacements lost provider replay fields, and covered-prefix identity ignored model-visible tool RawContent. Context-limit handling could also retry one original request twice, while default retention settings emitted a false deprecation warning and lint remained blocked.
Root cause:
Summary planning did not share the final request builder or account for the provider window, extension DTO round-trips were treated as message rewrites, projection hashes used bounded compatibility content, and output-budget and compaction retries had independent counters.
Fix:
Select the largest balanced admissible prefix for overflow summaries, preserve unchanged extension messages, migrate legacy bounded hashes to RawContent-aware hashes, enforce one recovery retry, recognize the boot default retention policy, and remove dead lint violations. Add regression coverage for each behavior.
Verification:
make lint
go test ./internal/agent ./internal/provider/... ./internal/config
go test -race ./internal/agent ./internal/extension/providerext
go test ./...
cd desktop && go test ./...
cd desktop/frontend && pnpm typecheck
* fix(agent): bound compaction maintenance retries
Problem:
- Pressure pruning copied every tool-result code point into a full rune slice, amplifying peak memory for large outputs.
- The runtime stuck latch suppressed maintenance after the provider-visible input changed.
Root cause:
- Unicode boundaries were computed by materializing the complete string.
- Retry backoff stored only a session-wide boolean instead of the blocked input identity.
Fix:
- Locate retained UTF-8 head and tail boundaries with constant-space scans.
- Scope the runtime stuck latch to the provider-visible input hash and clear it on lineage resets.
- Add allocation and changed-input regression coverage.
Verification:
- go test ./internal/agent
- go test -race ./internal/agent ./internal/extension/providerext
- go test ./...
- cd desktop && go test ./...
- make lint
- go vet ./...
* fix(desktop): account for compaction locale copy
Problem:
- The latest main-v2 left only 30 bytes below the simplified-Chinese locale budget.
- This PR adds 40 bytes gzip of intentional compaction policy guidance, putting the exact merge result 10 bytes over the gate.
Root cause:
- The locale ratchet still described the pre-compaction settings payload.
Fix:
- Raise only the simplified-Chinese locale allowance from 55.0 KiB to 55.1 KiB.
- Document the measured feature-owned delta beside the budget.
Verification:
- Latest main-v2: 56,290 bytes gzip
- Exact PR merge before fix: 56,330 bytes gzip
- Exact PR merge after fix: 56,330 / 56,422 bytes
- cd desktop/frontend && pnpm build
* fix(control): preserve AI session titles on reasoning models
Problem:
AI rename could fail with an empty-title error on reasoning models such as DeepSeek V4 Flash.
Root cause:
The 128-token completion cap included hidden reasoning tokens, so the provider could exhaust the budget before emitting visible title text.
Fix:
Raise the independent title request budget to 512 tokens and pass an optional low-effort override through bounded LLM calls. Providers that do not support the override keep their configured effort.
Verification:
- go test ./internal/control ./internal/provider/openai ./internal/goaleval ./internal/recovery -count=1
- cd desktop && go test . -run TestAIRenameSession|TestSessionTitleTranscript|TestControllerForTopic -count=1
- Live OpenCode Go DeepSeek V4 Flash title probe returned visible text with finish_reason=stop.
* fix(control): disable reasoning for session titles
Problem:
AI session rename could still return an empty title on endpoints whose supported effort vocabulary rejects the request-local low override.
Root cause:
The title call reused the session's high-reasoning provider instance, so a 512-token completion could still be consumed entirely by hidden reasoning before visible text was emitted.
Fix:
Resolve a title-only provider selection from the advertised effort vocabulary, preferring disabled reasoning and then none or low. Fall back to the ordinary provider if stale capability metadata cannot be resolved, and cover the reasoning-only length failure deterministically.
Verification:
- go vet ./...
- go run ./tools/repolint
- go test -race ./internal/control ./internal/boundedllm ./internal/provider/openai ./internal/goaleval ./internal/recovery -count=1
- go test ./...
- cd desktop && go test ./...
- Live OpenCode Go DeepSeek V4 Flash title probe returned visible text with reasoning disabled.
* fix(anthropic): recover unreplayable DeepSeek history
Problem:
DeepSeek Anthropic rejects restored tool and server-search turns when their required thinking content is missing, leaving affected /research sessions stuck on HTTP 400.
Root cause:
The provider serialized unreplayable historical activity without a final DeepSeek-specific safety projection. Folded pasted text also lacked an explicit regression at the structured subagent boundary.
Fix:
Project only malformed DeepSeek activity to its visible assistant text, drop paired tool results, and leave healthy history backing unchanged. Cover tool calls, server search, and expanded /research pasted text, with an opt-in live regression for the official endpoint.
Verification:
- go test ./... -count=1
- ./scripts/cache-guard.sh
- go vet ./internal/provider/anthropic ./internal/agent ./internal/control
- bounded live provider matrix for DeepSeek, LongCat, Zhipu Coding Plan, and OpenCode Go
* fix(agent): recover provider reasoning before tools
Problem:
Strict replay providers could suppress the only exact retry behind persisted warning state, while speculative tool events could reach the UI before replayability was known. GLM also treated valid tool turns without provider reasoning as unreplayable.
Root cause:
Recovery and event buffering were keyed to the diagnostic warning policy instead of the provider replay contract. GLM's broad preservation capability was interpreted as mandatory reasoning emission on every assistant turn.
Fix:
Give strict protocols one exact retry per sampling boundary, buffer replay-sensitive events until validation, and keep a second malformed turn fail-closed. Narrow GLM replay requirements to reasoning the provider actually emitted, and add deterministic plus credential-gated live coverage for OpenCode Go, LongCat, DeepSeek, and Zhipu.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/provider/openai
- cd desktop && go test ./...
- go vet ./...
- go run ./tools/repolint
- ./scripts/cache-guard.sh
- paid live provider matrix across OpenCode Go, DeepSeek, LongCat, and Zhipu Coding Plan
* fix(anthropic): use standard slice predicate
Problem:
The PR lint job rejected the manual missing-thinking scan under the modernize slicescontains rule.
Root cause:
The replay projection used a hand-written loop for an established slice predicate.
Fix:
Use the standard library slices.ContainsFunc helper while preserving the same early healthy-history return.
Verification:
- go test ./internal/provider/anthropic ./internal/control -count=1
- go vet ./internal/provider/anthropic ./internal/control
- golangci-lint run --timeout=5m ./internal/provider/anthropic/... ./internal/control/...
* fix(agent): keep GLM fallback turns streaming
Problem:
Thinking-enabled GLM responses that legitimately omitted reasoning were
buffered until the full SSE response completed, making long turns appear
stalled.
Root cause:
The sampling sink used the broad round-trip capability to defer all events,
even when the provider adopts an empty reasoning fallback without retry. The
GLM wire also omitted the empty reasoning_content field documented for tool
history.
Fix:
Keep fallback-compatible no-retry turns streaming, serialize the explicit
empty GLM tool-history field, and reject truncated preserved reasoning before
tools execute.
Verification:
- focused GLM streaming and replay tests
- go test ./...
- go test -race on agent and provider packages
- desktop tests, go vet, repolint, and cache guard
* fix(provider): modernize replay projection scan
Problem:
The CI lint gate rejected the shared replay projection pre-scan as a manually written containment loop.
Root cause:
The extraction preserved the loop form instead of the repository modernize rule used by golangci-lint.
Fix:
Use slices.ContainsFunc with the existing replayability predicate.
Verification:
- focused provider, Anthropic, and Agent replay tests
- golangci-lint v2.12.2: 0 issues
* fix(responses): close idle HTTP connections
Problem:
Bounded Responses provider probes left an HTTP/2 client read loop alive after successful tool loops, causing live Agent runs to fail goleak.
Root cause:
The Responses client owned an HTTP client but did not expose the optional CloseIdleConnections lifecycle hook already implemented by the OpenAI and Anthropic adapters.
Fix:
Delegate idle connection cleanup to the underlying HTTP client and cover delegation plus nil safety.
Verification:
- go test ./... -count=1
- go test -race ./internal/agent ./internal/provider/responses -count=1
- go vet ./...
- go run ./tools/repolint
- ./scripts/cache-guard.sh
- OpenCode Go Responses live Agent tool loops: 4 clean runs, 40 tool executions, no goleak
* fix(agent): recover repeated missing reasoning automatically
Problem:
DeepSeek Anthropic tool turns that omitted required reasoning stopped the run after one exact replay, forcing users to retry and repeatedly pay for the same provider fault.
Root cause:
Strict replay protocols had no typed provider-declared fallback, and their persisted incident state tracked only the exact-retry budget rather than a reusable fallback circuit.
Fix:
Keep the byte-identical replay as the first recovery, then use DeepSeek Anthropic's verified disabled-thinking mode after a second omission. Persist a provider/model/protocol-scoped fallback circuit, preserve tool-loop history, reject speculative tool calls, and expose protocol retry status without changing prompts.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/provider ./internal/provider/anthropic ./internal/event ./internal/eventwire
- go vet ./...
- go run ./tools/repolint
- live DeepSeek Anthropic disabled-thinking tool-loop probe
- credential leak checks for agent and Anthropic provider packages
* fix(agent): make reasoning fallback recover adaptively
Problem:
A second missing-reasoning response opened a fixed 24-hour disabled-thinking circuit. Because all later sessions stayed in fallback, the existing healthy-streak resolver normally had no thinking traffic to observe, so a transient or correlated replay failure could downgrade the same provider configuration for a full day.
Root cause:
The persisted incident tracked only when fallback opened. It had no half-open owner, retry schedule, or generation token, and intentional fallback responses still flowed through the missing-reasoning watcher.
Fix:
Add a configuration-scoped adaptive circuit with 10m, 30m, 2h, 6h, and 24h bounded backoff. Admit one cross-process half-open probe through a renewable lease, skip the correlated exact replay when that probe fails, and guard health/failure commits with the lease token. Keep fallback stable within a conversation and ignore its expected empty reasoning. Preserve the v2 state format with optional fields and migrate legacy fixed fallback entries to the shortest backoff.
Verification:
- focused adaptive recovery tests, 20 iterations
- go test -race ./internal/agent -count=1
- go test ./... -count=1
- cd desktop && go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- credential leak check for internal/agent
* fix(desktop): support terminal copy/paste and selection-to-chat
The integrated terminal never handled clipboard interaction: Ctrl+C always
reached the PTY as SIGINT, the webview right-click menu was suppressed
globally, and selection was nearly invisible in light mode. Reasonix already
carries writeClipboardText (async Clipboard API -> Wails runtime bridge ->
execCommand) and a composer insertion pipeline for selected text, but the
terminal used neither.
Wire the terminal into the existing paths:
- Ctrl+C / Cmd+C / Ctrl+Shift+C copy a live selection and swallow the chord;
without a selection Ctrl+C stays SIGINT, matching PowerShell's
selection-aware copy behavior.
- Context menu offers Copy/Paste/Add-to-chat with the shared writeClipboardText
/ ClipboardGetText bridges as permission fallbacks; native Ctrl+V keeps
working through xterm's own paste handler.
- Selecting output raises the same floating "Add to chat" action used by the
transcript, reusing the composer insertion pipeline with the console-fenced
formatting of addTerminalOutputToComposer; the floating action closes on
session switch, Escape, outside click, resize, or scroll.
- Fix selection colors: light #6ea8fe (was near-white #b9d7ff), dark #4a6d8c,
plus an explicit selectionForeground so selected text stays readable in every
theme; copy failures surface a diag.copyFailed toast.
Refs #7990
Refs #8474Fixes#8475Fixes#7845
* fix(desktop): preserve terminal selection lifecycle
Problem:
Terminal copy normalized selection text, stale clipboard completions could affect replacement sessions, and dark selection text missed WCAG AA contrast. The optional clipboard bridge method also exceeded its exact repolint budget by one line.
Root cause:
Copy and add-to-chat shared a trimming sanitizer, while asynchronous clipboard work was not bound to the terminal instance that started it. The explicit dark palette used a 4.33:1 foreground/background pair.
Fix:
Preserve xterm selection text for copy, bind copy and paste operations to a generation-scoped terminal lifecycle, centralize selection cleanup, use a 4.5:1-safe dark foreground, and ratchet only the bridge file budget from 4780 to 4781.
Verification:
pnpm --dir desktop/frontend test:terminal
pnpm --dir desktop/frontend typecheck
pnpm --dir desktop/frontend lint:hooks
pnpm --dir desktop/frontend check:css
pnpm --dir desktop/frontend check:waapi
pnpm --dir desktop/frontend build
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): keep terminal selection and drawer state current
Problem:
Delayed clipboard writes could clear a newer selection in the same terminal, while closing and reopening the drawer remounted xterm and repeatedly fitted every animation frame. Terminal selections also entered the composer as untyped text instead of quoted terminal context.
Root cause:
Clipboard ownership tracked only the terminal generation, not the selection revision. The drawer unmounted after its close transition and ResizeObserver drove fit plus PTY resize throughout height interpolation. Selection context had no terminal source discriminator.
Fix:
Bind copy cleanup to a terminal-and-selection snapshot, keep the terminal mounted after first open, pause fit during drawer transitions, prefetch the lazy chunk, retain same-tab workspace paint, and add typed terminal context cards with the shared add-to-chat shortcut. Hide warm collapsed controls from focus and portaled overlays.
Verification:
- pnpm test:terminal
- pnpm exec tsx src/__tests__/selected-text-context.test.ts
- pnpm exec tsx src/__tests__/composer-session-draft.test.tsx
- pnpm exec tsx src/__tests__/message-pasted-blocks.test.ts
- pnpm typecheck
- pnpm lint:hooks
- pnpm build
- go run ./tools/repolint
Co-authored-by: jiangrenhang <[email protected]>
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): isolate terminal state across tab switches
Problem:
Rapid tab switches could briefly expose the previous tab's terminal workspace and selection overlay. The selected-text parser also rejected every entry when a future client wrote an unknown source, and the clipboard bridge raised the repolint baseline for a one-line contract.
Root cause:
TerminalPanel read process-wide store fields without checking their owning tab, queued pointer selection work did not reject a detached host, and the source parser treated its new discriminator as a closed enum. The bridge declaration consumed a new physical line without offsetting local comment text.
Fix:
Scope terminal workspace, loading, errors, and active sessions to the rendered tab; clear selection actions before paint on owner changes; reject detached selection anchors; degrade unknown string sources to generic quoted context; and restore the original bridge file-size baseline.
Verification:
- pnpm test:terminal
- pnpm exec tsx src/__tests__/selected-text-context.test.ts
- pnpm exec tsx src/__tests__/composer-session-draft.test.tsx
- pnpm exec tsx src/__tests__/message-pasted-blocks.test.ts
- pnpm typecheck
- pnpm lint:hooks
- pnpm check:css
- pnpm check:waapi
- pnpm build
- go run ./tools/repolint
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): pause hidden terminal output rendering
Problem:
Keeping xterm mounted preserved drawer state, but hidden terminals continued parsing every PTY chunk and could stall the UI under sustained output.
Root cause:
The process-wide event bus kept a live xterm sink regardless of drawer visibility, and replay had no cursor to distinguish already-rendered history from output buffered while hidden.
Fix:
Expose sequenced bounded history to a lazy sink controller, pause xterm writes while the drawer is collapsed, and replay only retained missed chunks once when reopened. Add deterministic coverage for pause, bounded resume, idempotent activation, and live continuation.
Verification:
- pnpm test:terminal
- pnpm typecheck
- pnpm lint:hooks
- pnpm build
- go run ./tools/repolint
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
Co-authored-by: jiangrenhang <[email protected]>
* refactor(desktop): add transcript scroll-write probe and single-writer check
Problem: transcript scroll writes are spread across multiple modules
(scroll coordinator, recovery hook, selection retention), so regressions
like #8657 keep reappearing — each fix patches one writer without
constraining how writers interleave.
Fix (phase 0 of the scroll-arbiter refactor, no behavior change):
- Add transcriptScrollProbe.ts: a typed runtime probe recording
{owner, kind, top/index} for every imperative Virtuoso scroll write.
- Instrument all existing write sites (tail-follow scrollTo/scrollToIndex,
jump scrollToIndex, SCROLL_TO_OFFSET, recovery scrollToIndex/scrollBy).
- Add scripts/check-single-scroll-writer.mjs to the desktop build chain:
imperative Virtuoso scroll calls outside the allowed writer modules
fail the build.
Verification: check script passes on current tree and rejects a staged
violation fixture; pnpm test:transcript green (43 passed); tsc clean.
* fix(desktop): restart transcript remounts from measured geometry, EAW-aware estimates
Problem: on very long sessions the transcript cannot reach the bottom
(#8657 residual on v1.25.3). Every ref-resolution patch storm triggers a
keyed Virtuoso remount that collapses the measured size tree back to
static height estimates; the char-based estimator (~88 chars/line)
undershoots CJK rows by ~2x, so estimate-based scrollToIndex landings
drift several screens upward and the view appears pulled back.
Root cause (this commit's part): estimates never learn from reality.
Virtuoso applies heightEstimates only to an empty size tree, so each
remount restarts from static priors whose error grows with row count.
Fix (phase 1 of the scroll-arbiter refactor):
- transcriptRowEstimates.ts: East-Asian-Width-aware text estimation.
Wide code points (CJK, fullwidth punctuation, emoji) cost 2 display
columns, zero-width marks 0; each explicit line segment wraps
independently at 88 columns.
- transcriptMeasuredSizes.ts: session-scoped cache of Virtuoso's own
measurements (data-known-size), keyed by rowKey with per-kind medians;
synthesizes heightEstimates as measured ?? kindMedian ?? staticPrior.
- Transcript feeds measurements back from mounted rows and sources
heightEstimates from the cache, so any future remount restarts from
measured geometry instead of guesses.
Verification: new transcript-measured-sizes.test.ts (19 cases: EAW
columns, CJK vs ASCII wrap ratio, fallback chain, median convergence,
clear) plus the full test:transcript suite green; tsc clean.
* fix(desktop): stop rebuilding the transcript size tree on content patches
Problem: on very long sessions the transcript still cannot reach the
bottom (#8657 residual on v1.25.3). Ref-resolution patches
(history_items_patch) bump historyLayoutRevision once per resolved entry;
every bump scheduled a keyed Virtuoso remount at scroll idle, collapsing
the measured size tree back to estimates. On long sessions the patch
storm lasts minutes, so nearly every scroll pause triggered a remount
whose estimate-based anchor-restore landing sits several screens above
the real position — the view is pulled back whenever it nears the
bottom, and user wheel input cancels the restore mid-correction,
stranding it at the wrong landing.
Root cause: content updates were translated into geometry resets. A
patch only changes row content; Virtuoso already re-measures mounted
rows and compensates above-viewport height changes by itself.
Fix (phase 2 of the scroll-arbiter refactor):
- Delete the entire revision-driven rebuild chain from
useTranscriptVirtuosoRecovery (batch timer, deferral flags, 600 ms
coalescing, streaming hold) and the Transcript/App wiring of
historyLayoutRevision into the render layer. The reducer keeps the
revision as a pure content version.
- The blank-viewport watchdog is now the only rebuild trigger; its dedup
no longer keys on the revision (storm-proof cooldown-only).
- historyLayoutRevision prop removed from Transcript; patches flow
through data updates only.
Verification: transcript-recovery-race rewritten — a 50-patch storm with
interleaved user scroll intent performs zero remounts and zero
recovery-owned scroll writes (asserted via the phase-0 probe);
transcript-virtualization now asserts a content patch never remounts the
size tree and leaves tail-follow undisturbed; full test:transcript
suite, eslint, and tsc green.
* refactor(desktop): route all transcript scroll writes through one arbiter
Problem: transcript scroll writes lived in three modules (scroll
coordinator, recovery hook, selection retention). Twelve scroll-fix PRs
in v1.25.0-v1.25.3 each patched one writer without constraining how the
writers interleave, so #8657-class regressions kept reappearing under
new disguises. Anchor restores could also be abandoned silently — budget
expiry or a user gesture left the view at whatever intermediate landing
the restore had reached, with no terminal state and no telemetry.
Fix (phase 3 of the scroll-arbiter refactor):
- transcriptScrollArbiter.ts: the existing pure scroll reducer extended
with an explicit recovery-request lifecycle (RECOVERY_BEGIN/END,
CANCEL_RECOVERY). Writer preemption priority is fixed in code and
tests: selection > user intent > programmatic > recovery > tail-follow.
Every recovery request ends in an explicit terminal state —
done / cancelled(user-takeover | surface-switch | superseded) /
expired — never a silent exit.
- useTranscriptScrollArbiter.ts: the single writer around Virtuoso. Same
external interface as the old coordinator hook, plus
submitRecoveryRequest/retryRecoveryRequest/lastGoodAnchorRef. While
the anchor row is unmounted only scrollToIndex re-aims are emitted
(zero intermediate scrollBy); budget expiry suspends the request and
retries with a re-captured anchor at the next scroll idle (max 2)
before reporting expired.
- useTranscriptLayoutIntegrity.ts (replaces useTranscriptVirtuoso-
Recovery): detection and recovery-request lifecycle only — no
Virtuoso handle, no scroll writes. Blank watchdog now requires two
consecutive idle blank checks and restores to the arbiter's
lastGoodAnchor instead of the nearest mounted row (which mount lag
systematically placed above the viewport).
- Transcript drops the recoveryControlRef bridge; the arbiter is the
sink for all scroll intents. Recovery terminal states flow into
sessionDiagnostics (noteTranscriptRecoveryTerminal).
- check-single-scroll-writer allowlist shrunk to the arbiter module.
Verification: transcript-recovery-race rewritten (48 assertions incl.
T4 suspend/retry/expired with zero intermediate scrollBy, T5
user-takeover with lastGoodAnchor hand-off, T8 two-idle-confirm +
storm-proof cooldown, T10 selection preemption); full test:transcript
suite, eslint, tsc, and the single-writer check all green.
* fix(desktop): restore transcript remounts from captured Virtuoso state snapshots
Problem: the remaining keyed remounts (surface switches, blank-watchdog
rebuilds) still restarted Virtuoso from height estimates and a
recomputed initial location. With the measured-size cache (phase 1) the
geometry is close, but the exact scroll position was re-derived rather
than restored, and a first-mount scrollToBottom could yank a restored
view back to the tail.
Fix (phase 4 of the scroll-arbiter refactor):
- transcriptStateSnapshot.ts: resolveTranscriptStateSnapshot adapts a
captured {ranges, scrollTop} snapshot to the current row key
sequence — identical or appended keys restore as-is, prepended
history translates ranges by the index delta, anything else
(rewind, session switch) is discarded in favor of the
measured-height estimates.
- The integrity hook snapshots the outgoing Virtuoso at the last safe
moment (render-phase surface transition / just before a watchdog
rebuild), restores via restoreStateFrom, never together with
initialTopMostItemIndex (Virtuoso pipes both through the same
initial-location stream), and suppresses the first-mount
scrollToBottom when a snapshot placed the view.
- Governance: new desktop/AGENTS.md documents the transcript scroll
discipline (single writer + static check, explicit preemption
terminals with telemetry, no keyed remounts on patches, injectable
clocks, mandatory deterministic race tests); CONTRIBUTING.md points
to it.
Verification: new transcript-state-snapshot.test.ts (12 cases: restore
as-is, append, prepend translation with open-ended ranges, discard
mismatch/truncation/empty) plus 9 new end-to-end race assertions
(snapshot capture-restore around watchdog rebuilds, scrollToBottom
suppression, prepend wiring, cross-session discard); full
test:transcript suite (19 files, incl. 57 race assertions), tsc,
eslint, and the single-writer check all green.
* test(desktop): cover long-session reach-the-bottom in the scroll browser gate
- Update the transcript-selection bench harness to the phase-0 probe
signature ({owner, kind, top} record instead of positional owner/top);
the probe now also surfaces tail-follow and jump writes, so the
selection-ownership assertion observes strictly more than before.
- New scenario in transcript-scroll-stability (#8657 residual): on the
38-turn session, churn the heights of rows above the viewport (async
ref-resolution growth) while the user wheels downward repeatedly.
Asserts the physical bottom is reached and held, no multi-screen
upward snap occurs, and zero recovery-owned scroll writes happen.
Verification: both benches pass in real Chromium (selection 25
assertions, stability 36 assertions incl. the 4 new ones).
* test(desktop): reproduce the #8657 patch-storm pull-back end to end
Adds ref-resolution storm generation to the bench mock bridge so the
real-browser gate can reproduce the exact v1.25.3 residual failure:
- bridgeBenchFixtures: new bench:storm-40t session (40 turns; the newest
12 turns carry ~9KiB answers and ~6KiB reasoning, each served as a
4KiB preview + content ref). The resolution marker sits past the
preview cut so it only reaches the DOM after the ref resolves.
- bridge mock: mockHistorySlice emits content/reasoning refs for storm
fields; HistoryContentForTab paces resolutions by entry index
(~3 s storm) instead of bursting.
- transcript-scroll-stability bench: drive repeated downward wheels
WITH scroll-idle pauses (the exact moment the old chain remounted)
through the live storm. Asserts the bottom is reached, tail-follow
holds until the storm fully resolves, no persistent (5+ frame)
multi-screen pull-back occurs, and zero recovery-owned scroll writes
happen. Probes re-query the scroller per frame (remounts replace the
element) and count watchdog remounts.
Evidence (real Chromium, same scenario both builds):
- main-v2 + this mock: FAIL — the continuing storm knocks the
tail-following view 2073px (~2.6 viewports) off the bottom and leaves
it there, the user-reported #8657 behavior.
- this branch: PASS — bottom reached through the storm, tail holds at
0px until full resolution, zero persistent pull-back, zero recovery
writes (1 transient watchdog remount self-corrected within frames).
* fix(desktop): harden transcript recovery gates
Problem: suspended anchor recovery could wait forever or be lost in the real user-intent ordering; snapshot restores exceeded the supported Virtuoso data contract; Windows could not resolve the scroll-writer source root; and the bridge mock exceeded its repository budget.
Root cause: retries depended on a later user-idle callback that user takeover cancelled, changed or broken size trees were fed back into restoreStateFrom, URL.pathname was treated as a native path, and new history fixture logic remained in the oversized bridge module.
Fix: schedule bounded idle-aware recovery retries that user takeover cancels, restore snapshots only for identical row sequences and never after watchdog corruption, use fileURLToPath, and extract history mock windowing into a focused helper.
Verification: pnpm test; pnpm test:transcript-browser; pnpm build; go run ./tools/repolint.
* test(desktop): release controller timers after navigation races
Problem: the full frontend runner stopped after activate-topic-stale printed 17 passing assertions.
Root cause: the suite left its React root mounted, so controller timers introduced by the latest main-v2 turn-timing lifecycle kept the child process alive.
Fix: unmount the test root after all navigation-race assertions so hook cleanup releases the timers.
Verification: pnpm exec tsx src/__tests__/activate-topic-stale.test.tsx exits successfully with 17 passing assertions.
* fix(desktop): keep auto-fold shrink viewport steady
Problem: Auto-folding a completed reasoning block can visibly tug the transcript viewport after the content height drops.
Root cause: Tail-follow treated every layout extent change as growth and scheduled a new bottom write, even when the browser had already clamped scrollTop after a collapse.
Fix: Detect fold-sized height reductions, preserve tail ownership without issuing a tail command, and cancel any pending settle loop. This adapts the CONTENT_SHRANK policy from #8950 onto the single-writer arbiter.
Verification: transcript-scroll-release passes 21/21 and the complete transcript suite, including 57 deterministic recovery-race assertions, passes.
Co-authored-by: XTLine <[email protected]>
---------
Co-authored-by: XTLine <[email protected]>
* fix(desktop): stabilize project tree runtime projection
Problem:
Switching topics rebuilt the resident project tree, changed row metrics, and let catalog lag move active topics. A raw topic-id lookup could also project a colliding runtime into the wrong project, while resident metadata was retained indefinitely.
Root cause:
Runtime ownership and catalog updates shared the same broad invalidation path. The overlay did not consistently key runtime-only rows by scope and workspace, and its resident metadata map had no lifecycle pruning.
Fix:
Split runtime ownership from catalog reconciliation, overlay runtime state with structural sharing, keep row typography stable, scope runtime-only rows by project, and retain only catalog or currently active resident metadata.
Verification:
Project tree projection, row stability, shell race, TypeScript typecheck, focused Desktop Go tests, and repolint passed.
* fix(desktop): reconcile sessions when projects register
Problem:
A project added after session catalog startup could show an empty tree until a later periodic reconciliation.
Root cause:
Project registration updated metadata and root spelling but did not schedule the newly registered session directory for catalog reconciliation.
Fix:
Reconcile the project session directory at the registration boundary and let topic activation publish only its runtime ownership event, avoiding duplicate reconcile requests.
Verification:
The focused registration reconciliation test, project-tree Desktop tests, and repolint passed.
Co-authored-by: paradoxSCH <[email protected]>
* feat(desktop): add reliable project tree organization
Contribution:
Add persistent topic drag ordering, foldable per-project and global session groups, and aggregate active-session feedback on collapsed folders.
Integration:
Adapt the ideas from PRs #8608, #8699, and #8598 to the current lazy catalog and runtime projection architecture. Manual order activates only after an explicit drag, partial pages cannot drop topics, runtime-only rows stay transient, groups enforce exclusive membership, and organization logic lives outside the oversized tree and tabs modules.
Verification:
Organization unit tests, focused Desktop Go tests, TypeScript typecheck, React hook lint, project-tree regression scripts, and repolint passed.
Co-authored-by: Linearleaf <[email protected]>
* test(sessioncatalog): cover authoritative recency ordering
Coverage:
Exercise two reconciled topics where an external file touch makes the older JSONL mtime newer than the genuinely active session. The catalog must still order by authoritative sidecar activity.
Integration:
The production invariant is already present on main-v2 via #8694; this adds the end-to-end ListTopics regression coverage contributed independently in #8677 without duplicating production code.
Verification:
go test ./internal/sessioncatalog -run Reconcile passed.
Co-authored-by: swingmonkey <[email protected]>
* fix(desktop): clean blank sessions before fallback reconcile
Problem:
Archiving the final project topic could leave a default-titled zero-byte session in the sidebar cleanup set after registration-driven reconciliation.
Root cause:
Fallback construction registers the project and starts reconciliation before transient blank cleanup, allowing the stale blank to be indexed as a topic and exempted from deletion.
Fix:
Sweep existing transient blanks before opening the fallback runtime, then retain the post-open sweep that protects the active fallback path.
Verification:
go test . -run ^TestTrashTopicFallbackStaysOffCatalogSidebar$ -count=20
go test -race . -run ^TestTrashTopicFallbackStaysOffCatalogSidebar$ -count=10
* fix(desktop): harden project tree organization
Make manual session ordering authoritative across catalog pages, serialize and version group mutations, and invalidate stale frontend reads. Coalesce project registration scans, fully remove reconciled blank-session ghosts, and preserve organization metadata across downgrade round trips.
Add deterministic pagination, concurrency, archive, StrictMode, CAS conflict, registration, and compatibility regressions.
* test(desktop): release controller timers after activation coverage
Unmount the React root and close jsdom so the timer refresh added on main-v2 cannot keep the discovery runner alive after this suite passes.
* refactor(desktop): drain project catalog reconciliation
Track explicit reconcile completion through catalog shutdown so scans cannot outlive their catalog or test-owned workspace. Split manual ordering and registration logic into focused files to keep repository structure budgets unchanged.
Verify shutdown drainage and the formerly flaky pinned-session-owner cleanup path across repeated runs.
---------
Co-authored-by: paradoxSCH <[email protected]>
Co-authored-by: Linearleaf <[email protected]>
Co-authored-by: swingmonkey <[email protected]>
* fix(desktop): reconcile durable inbox delivery
Problem:
Executed or delivered guidance could remain visible in the Composer queue, and cancellation could restore messages that had already crossed admission.
Root cause:
Steer consumption was persisted after the frontend event, queue reconciliation relied on truncated text, and cancellation used all-or-nothing deletion without an item-level receipt.
Fix:
Move the durable consumed transition into the steer loader, emit revision-scoped inbox changes, reconcile by item ID, and restore only backend-confirmed withdrawals.
Verification:
- go test ./internal/agent ./internal/control ./internal/sessioninbox
- go test -race for the changed inbox, control, agent, and desktop paths
- cd desktop && go test ./...
- frontend focused tests, type checks, hook lint, and production build
* refactor(desktop): satisfy inbox lint budgets
Problem:
The inbox fix exceeded repository file-size and function-size budgets in CI.
Root cause:
New reconciliation tests and cancellation logic were added to legacy files that were already at or near their ratcheted limits.
Fix:
Extract cancellation, inbox event, steer loader, and regression-test ownership into focused files. Keep only a two-line bridge contract ratchet for the additive Wails method.
Verification:
- go run ./tools/repolint
- go test ./internal/agent ./internal/control ./internal/sessioninbox
- go test -race ./internal/sessioninbox
- cd desktop && go test ./...
- frontend type checks, hook lint, focused tests, and production build
* fix(inbox): linearize accepted steer deletion
Problem:
Deleting an accepted steer could race its loader and report success after the instruction crossed the consumed boundary.
Root cause:
DeleteInboxItem read accepted state and then performed an unrestricted accepted-to-queued-to-delete sequence across separate transactions.
Fix:
Serialize controller deletion with inbox admission and use one Store transaction that deletes pending or accepted items only while preserving a consumed winner.
Verification:
- go test ./internal/sessioninbox ./internal/control ./internal/agent
- go test -race ./internal/sessioninbox ./internal/control
- cd desktop && go test ./...
- go run ./tools/repolint
- git diff --check
* fix(desktop): reconcile early inbox acknowledgements
Problem:
Consumed guidance could reappear when its consume event arrived before the enqueue receipt, and a pending cancel disabled Stop in other tabs.
Root cause:
The composer appended receipts without remembering early item-ID acknowledgements, while cancel settlement used one component-global flag.
Fix:
Track in-flight guidance receipts per draft, suppress or deduplicate late receipts, and scope cancel settlement to the owning draft. Add deterministic interleaving coverage and keep the inbox revision fixture monotonic.
Verification:
- pnpm test
- pnpm build
- go test ./internal/sessioninbox ./internal/control ./internal/agent
- go test -race ./internal/sessioninbox ./internal/control
- cd desktop && go test ./...
- go run ./tools/repolint
* fix(control): resume ordinary readiness checks automatically
Problem:
Ordinary interactive turns that ended with host-known verification or review gaps stopped as Partial and required the user to press Continue checks.
Root cause:
The fact-driven readiness refactor waived recoverable gaps before the controller could observe a FinalReadinessError, so only Goal turns could continue automatically.
Fix:
Arm interactive controller turns for automatic readiness continuation, preserve prior evidence across bounded synthetic follow-ups, stop after two non-shrinking gap rounds, and hide host prompts from user history. Keep direct Agent API Partial semantics unchanged.
Verification:
- go test ./...
- go test ./internal/agent ./internal/control ./internal/i18n
- focused controller race tests
- go vet ./...
- go run ./tools/repolint
- git diff --check
* fix(control): bound ordinary readiness continuations
Problem:
Ordinary readiness recovery could keep opening follow-up turns whenever the missing category count shrank, with no absolute turn cap or user-input priority.
Root cause:
The controller received only missing labels and reason text, so it could not distinguish generic verification from exact or strict duties or compare host evidence progress.
Fix:
Add typed readiness continuation classes and evidence progress keys, cap generic recovery at one turn and high-confidence recovery at two progress-gated turns, yield to cancellation and queued user work, preserve manual recovery, and keep the prompt append-only. Use an in-memory inbox snapshot to avoid disk-lock latency.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/control
- go vet ./...
- go run ./tools/repolint
- git diff --check
* fix(agent): satisfy readiness classification lint
Problem:
The CI staticcheck pass rejected the readiness enforcement branch with QF1003.
Root cause:
Equivalent enforcement comparisons were expressed as repeated if conditions.
Fix:
Use switch forms for the classification branches without changing continuation semantics.
Verification:
- go test ./internal/agent ./internal/control
- go vet ./...
- go run ./tools/repolint
- golangci-lint run --timeout=5m with a clean cache
- git diff --check
* fix(control): keep readiness recovery user-priority safe
Problem:
Automatic readiness recovery exposed its synthetic prompt through desktop notice details and could miss user follow-ups committed by another inbox Store.
Root cause:
The continuation notice reused the provider-facing prompt as UI detail, while pending-work admission consulted only the Store in-memory manifest.
Fix:
Emit a content-free progress notice and add a non-blocking, read-only authoritative inbox snapshot. Conservatively yield when the inbox is busy, unreadable, foreign-owned, or newer-schema.
Verification:
- go test -count=1 ./...
- go test -race -count=1 ./internal/agent ./internal/control ./internal/sessioninbox
- cd desktop && go test -count=1 ./...
- go vet ./...
- go run ./tools/repolint
- git diff --check
* fix(control): preserve blocked readiness recovery
Problem:
Automatic readiness continuation could report success when an input extension or hook blocked the synthetic turn before Agent.Run. That also left the one-shot recovery preparation consumed. A related inbox integration could latch withdrawn steer entries as unapplied.
Root cause:
The controller treated a nil orchestration result as proof that Agent.Run completed, while the steer latch was set from the raw queue length before loaders filtered entries.
Fix:
Restore an unconsumed readiness preparation, count only continuations that reached Agent.Run, and derive the unapplied-steer latch from entries actually recorded. Add a focused extension-block regression test.
Verification:
- go test -count=1 ./...
- go test -race -count=1 ./internal/agent ./internal/control ./internal/sessioninbox
- cd desktop && go test -count=1 ./...
- go vet ./...
- go run ./tools/repolint
- git diff --check
* fix(desktop): preserve run timer across tab switches
Problem:
The composer run strip restarted at zero when a running tab was revisited.
Root cause:
Turn timing was reconstructed from frontend receipt time because tab metadata and turn_started events omitted the host authoritative start timestamp.
Fix:
Expose the active turn start on desktop events and tab snapshots, restore it during frontend reconciliation, and keep legacy missing-field behavior safe for new remote turns.
Verification:
- cd desktop && go test ./...
- cd desktop && go test -race . -run turn-timing tests
- focused frontend controller and tab-switch suites
- cd desktop/frontend && pnpm typecheck && pnpm lint:hooks && pnpm build
- go run ./tools/repolint
* fix(desktop): reject stale turn timing snapshots
Problem:
An asynchronously fetched tab snapshot from an older turn could arrive after a newer lifecycle event, rewind the composer timer, or mark the new turn idle.
Root cause:
backend_status trusted the reported timestamp without a general turn-lifecycle freshness fence, and unordered status updates could replace a newer surviving local clock.
Fix:
Record monotonic observations for local turn lifecycle transitions, reject snapshots that began before those transitions, and keep active snapshot timestamps monotonic while still accepting newer backend authority. Add deterministic coverage for stale running, stale idle, completed-turn resurrection, and legacy unordered status paths.
Verification:
- pnpm exec tsx src/__tests__/turn-timing-race.test.ts
- focused controller, tab-switch, prompt, cancel, stream, and composer suites
- pnpm typecheck && pnpm test:typecheck && pnpm lint:hooks && pnpm build
- cd desktop && go test ./...
- cd desktop && go test -race . -run turn-timing tests -count=1
- go run ./tools/repolint
Co-authored-by: guomengjia618-dot <[email protected]>
---------
Co-authored-by: guomengjia618-dot <[email protected]>
* fix(lsp): use official intellij-server as Kotlin default / Kotlin 默认 LSP 切换为 JetBrains 官方 intellij-server
* fix(lsp): default Kotlin to official kotlin-lsp with intellij-server fallback / Kotlin 默认 LSP 改为官方 kotlin-lsp，intellij-server 作后备
* test(lsp): cover primary-priority in fallback resolution / 补充 resolveCommand 主命令优先测试
* fix(lsp): preserve explicit command ownership
Problem:
Kotlin users received incomplete Linux install guidance, and an explicit custom command could silently inherit the built-in intellij-server fallback.
Root cause:
The default hint treated the standalone archive as Windows-only, while LSPSpecs overlaid Command without replacing the default command family.
Fix:
Document platform-specific installation steps, clear built-in fallbacks when Command is explicitly overridden, and move LSP spec assembly into its own owner file with focused regression coverage.
Verification:
- go test ./internal/lsp ./internal/boot
- go test -race ./internal/lsp ./internal/boot
- go vet ./...
- go test ./...
- go run ./tools/repolint
- golangci-lint run ./internal/lsp/... ./internal/boot/...
- git diff --check
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
Problem:
Custom OpenAI providers pointed at tokenrhythm.studio often 404 because
users omit /v1, double /v1, or paste a complete chat URL as base_url.
Reasonix then appends /chat/completions or probes {base}/models.
Root cause:
Official Token Rhythm routes are already complete under
https://tokenrhythm.studio/v1. Reasonix treated those values as ordinary
OpenAI bases and concatenated another path.
Fix:
Before the first request, rewrite known official Token Rhythm URLs to
https://tokenrhythm.studio/v1/chat/completions and
https://tokenrhythm.studio/v1/models. Identification uses net/url
allowlisting only: https, exact host, port empty or 443, no userinfo,
query, fragment, or escaped path, and a closed known-path set. Other
providers keep existing request_url > chat_url > base_url and
model-fetch candidate semantics. Config files are not rewritten.
Verification:
- go test ./internal/provider/openai ./internal/config
- go test ./internal/tool/builtin ./internal/boot
- go vet ./internal/provider/openai ./internal/config ./internal/tool/builtin ./internal/boot
- golangci-lint run ./internal/provider/openai/... ./internal/config/...
- go run ./tools/repolint
* fix(desktop): restart plugin runtimes on reload
Problem:
Desktop users could not invoke /reload from the composer, and explicit runtime reloads adopted unchanged native sidecar clients. Linked plugin code therefore stayed on the old process until the app restarted.
Root cause:
The desktop slash catalog omitted /reload, while the runtime graph treated manifest-identical sidecars as unchanged and moved their live clients into the replacement manager.
Fix:
Route desktop /reload to ReloadRuntime and expose it in slash completion. Mark explicit full reload preflight to restart unchanged sidecars, preserving semantic no-op/cache diagnostics and retiring old processes only after a successful swap. Document the desktop entry point.
Verification:
- go test ./...
- go vet ./...
- cd desktop && go test ./...
- cd desktop && go vet ./...
- go test -race ./internal/boot ./internal/extension ./internal/extension/sidecar
- cd desktop && go test -race . -run TestSubmitReloadRoutesToRuntimeReload|TestReloadRuntime -count=1
* Fix sidecar impact reporting for forced reloads
Problem:
RuntimePlan.AffectsSidecars reported false for a semantic no-op plan even when an explicit desktop reload must replace unchanged sidecar processes.
Root cause:
The predicate returned early on IsNoOp without considering the activation-only RestartUnchangedSidecars instruction.
Fix:
Recognize forced unchanged-sidecar restarts as sidecar lifecycle work while preserving graph no-op, prefix, and unrelated-subgraph semantics. Add a focused regression test for the contract.
Verification:
- go test ./...
- go test -race ./internal/boot ./internal/extension ./internal/extension/sidecar
- cd desktop && go test ./...
- cd desktop && go test -race . -run 'TestSubmitReloadRoutesToRuntimeReload|TestReloadRuntime' -count=1
- make lint
* docs(release): prepare v1.25.3 notes
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* docs(release): complete v1.25.3 review record
Problem:
The regenerated release record attributed the workflow bot as a contributor and omitted the already-reviewed fact-driven execution change from PR 8930.
Fix:
Keep human attribution only and restore a bilingual, source-grounded fact-driven execution entry while retaining the Windows, policy, and DOMPurify release-blocker fixes.
Verification:
Validate the catalog, run release-note contract tests, render v1.25.3, and check the diff.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: SivanCola <[email protected]>
Problem:
Mermaid resolved DOMPurify 3.4.12, which is affected by the moderate IN_PLACE detached-subtree XSS advisory tracked by Dependabot alert 58.
Fix:
Override DOMPurify to the patched 3.4.13 release in the desktop workspace and record the exact integrity in the lockfile.
Verification:
Run the complete frontend test suite and production build, confirm pnpm resolves only DOMPurify 3.4.13, and verify pnpm audit reports no known production vulnerabilities.
* docs(release): prepare v1.25.3 notes
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* docs(release): prepare v1.25.3 notes
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* docs(release): prepare v1.25.3 notes
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* docs(release): keep v1.25.3 attribution human
Problem:
The regenerated release record included the workflow bot as a product contributor because the review branch is itself associated with the open release-notes PR.
Fix:
Keep the generated product record and PR citations unchanged while removing the automation identity from the contributor list.
Verification:
Validate the release catalog, run release-note contract tests, render v1.25.3, and check the diff.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: SivanCola <[email protected]>
* test(config): encode write-access TOML fixture safely
Problem: Windows CI could not parse the write-access ancestor fixture because an absolute path was interpolated into a TOML basic string without escaping.
Root cause: the test assembled allow_write with raw string concatenation, so the Windows path prefix \U was interpreted as an incomplete TOML Unicode escape before the behavior under test ran.
Fix: render the fixture array through the production TOML string encoder.
Verification: go test ./internal/config; git diff --check
* fix(policy): scope mutation constraints to their targets
Problem: scoped instructions such as "do not change any config" were promoted to a turn-wide mutation ban, preventing authorized output files from being written.
Root cause: runtime constraint parsing used substring matching and did not distinguish global read-only directives from target-specific protections.
Fix: parse instruction clauses, retain explicit global English and Chinese mutation bans, and leave scoped or actor-specific restrictions to the model-visible instruction.
Verification: go test ./internal/runtimepolicy ./internal/agent ./internal/control; git diff --check.
* style(policy): use modern string splitting helpers
Problem: the v1.25.3 policy fix tripped the repository modernize linter on two manual Index-and-slice operations.
Root cause: the clause parser used strings.Index where the current lint baseline requires strings.Cut.
Fix: replace both mechanical splits with strings.Cut without changing matching behavior.
Verification: go test ./internal/runtimepolicy ./internal/agent ./internal/control; golangci-lint run --timeout=5m ./internal/runtimepolicy/....
* refactor(evidence): classify concrete tool effects
Host execution policy must judge the concrete tool call, resolved paths,
and receipts. Unify bash, file, MCP, and proxy effects into EffectProfile
and replace path substring matching with segment-aware classification so
author.go is not treated as an auth path.
Cache-impact: none. EffectHint is host-only and is not serialized into
provider tool schemas.
Verification: go test ./internal/evidence ./internal/shellsafe ./internal/tool
* refactor(contract): make obligations and receipts authoritative
TaskContract no longer classifies the prompt. Rebuild the contract from
approved plans, active goals, todos, project checks, and real receipts.
Obligations can only be added, satisfied, or invalidated by a later
related write. Denied or failed writers create no post-success duties.
Cache-impact: none. Contract state stays host-only and is not injected
into the system prefix or tool schemas.
Verification: go test ./internal/taskcontract ./internal/evidence
* refactor(agent): add monotonic execution guard pipeline
Replace scattered TaskPolicy preflight with a dedicated runtimepolicy
engine. Guards merge Deny > Ask > Allow > Abstain, Plan writes stay
hard-blocked even under YOLO, and the contract lock is never held
across permission, tool execution, or user prompts.
Stop injecting <execution-policy> into new turns. Historical v2 tags
remain readable on disk and are stripped only when building the
provider request.
Cache-impact: intended. Removing the per-turn execution-policy suffix
keeps user history append-only. Executor tool schemas and the system
prefix are unchanged.
Verification: go test ./internal/runtimepolicy ./internal/agent
go test -race ./internal/runtimepolicy ./internal/agent
* refactor(planner): remove automatic task-weight routing
DecidePlannerRoute is now explicit-only: plan-first, plan-for-approval,
plan-only, or Goal start. Ordinary wording, file counts, and risk
keywords stay executor-only. Drop Light/Full planner depth from the
route, the planner-turn block, and leftover complexity tables.
Move ClassifyGoalBudget into control so Goal budget compatibility
survives after deleting taskintent.
Cache-impact: intended planner-prefix change. The planner system prompt
no longer branches on Light/Full depth. Executor schemas and prefix
are unchanged. planner_model remains available for explicit planning.
Verification: go test ./internal/control ./internal/agent
* refactor(agent): decouple delegation and capability routing
Replace InheritedTaskPolicy with InheritedExecutionContext so children
inherit constraints, Plan read-only, Goal scope, and a delegated
contract slice. Read-only children stay read-only from the tool set,
not from prompt classification. Child receipts merge into the parent
ledger; prose claims do not satisfy parent obligations.
The capability router uses TaskPolicy no longer: strong catalog matches
return immediately, and the semantic router runs only when the catalog
is ambiguous.
Cache-impact: none. The provider-visible core tool set is unchanged.
Verification: go test ./internal/agent ./internal/control
go test -race ./internal/agent ./internal/control
* test(agent): lock fact-driven execution contracts
Pin the functional matrix, cache-schema stability, historical
execution-policy restore, and stop rules against the fact contract.
Final readiness now consumes obligations and receipts instead of
prompt-invented missing mutation. Ordinary Recoverable gaps complete
as Partial; Goal and Strict gaps cannot look successful.
Delete the leftover TaskPolicy package now that production callers
are gone.
Cache-impact: none beyond the already-intended execution-policy
strip. Executor schema bytes stay identical across ordinary, Plan,
Goal, and obligation states.
Verification: go test ./internal/agent ./internal/control ./internal/boot
go test -race ./internal/agent ./internal/control
* docs: document fact-driven execution model
Document that ordinary requests always enter the executor, that there
is no automatic simple/light/full task mode, and that Plan, Goal,
permission, and the task contract are independent. Host verification
obligations come from real tool actions. The Harness minimal preset
is not a task-complexity mode, and the tool catalog stays stable to
protect the prompt cache.
Cache-impact: none. Documentation only.
Verification: docs reviewed against DecidePlannerRoute, MapWriter,
and the new GUIDE/SPEC two-model sections.
* fix(contract): bind execution proofs to observed facts
Problem:
Fact-driven obligations could be cleared by targeted verification, unrelated reads, mismatched review reports, or replayed receipts. Sequential single-file writes also bypassed multi-file preconditions, while active Goal and explicit full-verification facts were not consistently enforced.
Root cause:
Receipt folding matched broad evidence kinds without target, scope, verdict, or cumulative-write context. Engine rebuild did not restore its receipt watermark, and live/shadow contract rebuilds omitted policy facts.
Fix:
Require project-wide or repository-declared full verification, bind review evidence to exact targets and review kinds, revoke proofs on later failures, and escalate cumulative production writes. Preserve active Goal, constraint, and receipt-sequence facts across engine and shadow replays, with adversarial regression coverage and updated documentation.
Verification:
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/evidence ./internal/taskcontract ./internal/runtimepolicy ./internal/agent ./internal/control
- go vet ./...
- go run ./tools/repolint
- git diff --check
* fix(agent): let ceiling recovery bypass stale maintenance receipts / 越过硬上限后不再被失败回执卡死
A failed or blocked maintenance receipt used to answer ErrCompactionRequired
at every physical recovery point (overflow trigger, or a view at/above the
hard input ceiling), so one failed summary stranded the session past the
provider limit with no automatic way back. Receipts and the stuck flag now
back off sub-critical pressure retries only; above the ceiling the fold runs
and degradeFoldSummary still guarantees progress when the summarizer is down.
Receipts are input-hash scoped and refresh on newer failed views, so a
transcript that moved on gets one fresh attempt with same-view retries still
backed off. A recovery fold that lands under the trigger clears the stuck
latch so the next pressure round compacts normally.
Cache-impact: low - provider-visible prefix is unchanged; only the timing of
when automatic compaction is allowed to fire changes
Cache-guard: TestFailedSummaryReceiptStillRecoversAtHardCeiling,
TestFailedSummaryReceiptTracksLatestViewHash,
TestCeilingRecoveryClearsStuckLatch plus the existing failure/degradation
suite in compact_summary_failure_test.go
* fix(agent): keep compaction across tail-only rewinds / 尾部回退不再丢弃压缩投影
Editing a message rewinds the conversation to that message and resubmits.
CoveredCount used to record the build-time transcript length, so the verbatim
tail was frozen inside the projection and even a tail-only truncation crossed
into covered territory: the fold was discarded, the visible context ballooned
back to the pre-compaction transcript, and the next round re-paid a full
summary. The projection body now freezes only prefix + digest + kept messages
with CoveredCount at the fold boundary (translated to canonical indices when
folding on top of a live projection), so the tail splices from the transcript;
rewind invalidation is conditional on the projection actually going stale.
Re-folds whose boundary lands inside the prior projection body keep the
unfolded body suffix verbatim instead of dropping it from the model context.
Cache-impact: low - the provider-visible request bytes are identical for an
unchanged tail; tail-side rewrites now stay visible instead of serving stale
frozen copies
Cache-guard: TestTailOnlyRewindKeepsCompactedView, control-level
TestTailRewindKeepsCompactionProjection, and
TestRefoldIntoBodyKeepsUnfoldedBodyTail pin the changed boundaries; the
incremental/restart suites stay green
Documentation-impact: none - docs describe compaction behavior, which is
unchanged; this restores the documented behavior after message edits
* Allow one hard-ceiling fold after pressure compaction
Problem:
- A turn that compacted under pressure could grow past the hard ceiling and then be rejected by the same-turn latch.
Root cause:
- lastTurn treated must-free overflow recovery as a duplicate of the earlier pressure fold.
Fix:
- Allow exactly one must-free fold after an earlier same-turn compaction.
- Track the recovery turn so tiny windows retain the cache-protection backoff.
- Add deterministic coverage for recovery and the bounded second attempt.
Verification:
- go test ./internal/agent focused compaction and cache cases -count=20
- go test -race ./internal/agent focused compaction and cache cases -count=5
- go test ./... -count=1
- go test -race ./internal/agent ./internal/control -count=1
- cd desktop && go test ./...
- go vet ./internal/agent ./internal/control
- go run ./tools/repolint
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): defer transcript layout rebuilds until user scroll idles / 滚动期间推迟对话布局重建
Problem
On Windows (WebView2), scrolling down continuously through a long settled
transcript still blanked the viewport and snapped the view back up, even
with the live-turn footer restructure from #8903. Refs #8657, refs #8688.
Root cause
The settled-history recovery path was left behind by the streaming fix:
1. Ref-resolved history content bumps historyLayoutRevision while the user
scrolls, and the recovery effect rebuilt Virtuoso's size tree (key
remount) in the middle of the gesture — the visible blank frames.
2. The anchor restore loop was budgeted at 8 frames (~128 ms). On WebView2,
heavy rows (fold cards, tables, code blocks) mount slower than that, so
the loop gave up and left the view at the estimate-based scrollToIndex
landing, which underestimates tall rows — the multi-screen upward snap.
3. Plain wheel/touch/keyboard/pointer scroll never invalidated pending
recovery anchors (only jump-bottom/JumpBar/rewind did), so an in-flight
restore kept fighting the user's scroll — the pull-back feel.
4. The blank-viewport watchdog could fire mid-scroll after only two frames,
mistaking transient mount lag for size-tree breakage.
Fix
- Defer revision-driven size-tree rebuilds while user scroll is active;
flush exactly once when the scroll goes quiet, re-capturing the anchor
from the user's resting position first.
- Route wheel/touch-move/touch-start/key/pointer-down intent through
noteUserScrollIntent: it invalidates in-flight restores (user intent >
recovery) and arms the quiescence window; scroll events only extend an
active window, so programmatic scrolls never arm it.
- Gate the blank-viewport watchdog on scroll quiescence; a blank that
persists into idle still earns a rebuild (dedup + 2 s cooldown unchanged).
- Budget the anchor restore by wall clock (1 s) and wait for the anchor row
to mount instead of counting 8 frames, so slow mounts still land.
Verification
- transcript-recovery-race: 20/20, including new deterministic coverage —
no rebuild mid-scroll, deferred rebuild on idle, gesture aborts an
in-flight restore, blank gated while scrolling and armed at idle, restore
re-aims past the old 8-frame budget and settles on a slow-mounting row.
The pre-existing cooldown assertion now converges the stubbed anchor row
first, since the restore loop legitimately outlives the old frame budget.
- pnpm test: all 176 frontend suites pass; pnpm build green (eslint, CSS
checks, tsc, vite build, bundle budget); repolint clean.
* fix(desktop): hold transcript rebuilds while streaming and coalesce revision resets / 流式期间挂起布局重建并合并补丁重置
Problem
Follow-up failures on the v1.25.3-test.8903 build (refs #8657/#8688):
1. While streaming with the reasoning display in auto/expanded mode, the
view kept snapping away from the tail and could not stay at the bottom.
2. Switching to a long session stuttered for the first seconds as
ref-resolution patches each forced their own Virtuoso remount.
3. Hidden/summary reasoning modes barely showed either symptom.
Root cause
Every resolved history ref bumps historyLayoutRevision, and each bump
remounted Virtuoso (keyed reset). During streaming the tail anchor's first
restored frame covers only history rows — the multi-thousand-px live
footer sits below the fold — so every remount snapped a tail-following
view up before the restore pulled it back. auto/expanded reasoning modes
maximize the footer height and the number of ref-bearing rows, which is
why they trigger it most; hidden/summary keep both small.
Fix
- holdRevisionResets (the turn is streaming): revision-driven rebuilds are
deferred and run once when streaming ends; mid-scroll still defers to
scroll idle. The blank-viewport watchdog is unaffected.
- Coalesce revision-driven rebuilds to at most one per 600 ms so patch
bursts (session open, stream end) collapse into a single remount.
Verification
- transcript-recovery-race: 25/25, adding deterministic coverage for the
streaming hold (defer + flush on stream end) and the 600 ms coalescing
window (defer + fire when the interval lapses).
- transcript-virtualization: 43/43.
* fix(agent,desktop): keep the todo panel live and retire stale wrap-up notices / 待办面板实时化并回收过期收尾卡
Problem
Two follow-up reports on the test build (refs #8657/#8688 family):
1. The task panel did not update in real time: a todo_write sharing a
provider tool batch with a long-running call only flipped its card to
done when the whole batch drained, so the panel sat on the previous
list.
2. After every todo was completed, the conversation tail could still show
the "wrap-up checks incomplete" notice: the live card is appended
unconditionally on a final_readiness turn_done and nothing retracts it,
and the pending marker replays on reload until the next user turn.
Fix
- Emit the todo_write ToolResult as soon as the call executes instead of
waiting for the batch to drain; the batch-end emission for the same call
id re-emits with full metadata and lands idempotently.
- The turn_done reducer retracts a delivery notice whose only missing
requirement was todos once the turn's own items show an all-complete
todo_write; notices now carry their structured missing list so the
filter stays precise (non-todo gaps survive).
- A pending readiness marker whose only gap was todos is consumed once a
rebuilt canonical list shows every item completed, so a reload no longer
replays the stale card.
Verification
- internal/agent: new reload coverage — todo-only marker consumed when the
rebuilt list is complete; survives when the gap exceeds todos; survives
while todos stay incomplete. go test ./internal/agent ./internal/control
./internal/evidence green.
- use-controller-meta: 148/148, adding reducer coverage — all-complete
list retracts the stale card, mixed-gap card survives, incomplete list
keeps it.
- pnpm test: all 176 frontend suites pass; pnpm build green; repolint
clean.
* fix(agent): keep terminal tool results unique
Problem:
Successful todo_write calls published ToolResult twice when another tool in the provider batch was still running. Append-only history and trajectory consumers therefore observed duplicate terminal results, while the new file also failed gofmt on Ubuntu and macOS CI.
Root cause:
The live todo refresh reused the terminal ToolResult kind because the React reducer happened to upsert by call ID. That frontend behavior was not a valid contract for raw or append-only event sinks.
Fix:
Add an additive ToolResultPreview event for early successful local state, teach the desktop reducer to upsert it, and leave the provider-ordered ToolResult as the call's only terminal event. Forward the preview through nested runtimes, count it as topic activity, and format the Go sources.
Verification:
- go test ./...
- go test -race ./internal/agent
- cd desktop && go test ./...
- cd desktop/frontend && pnpm test && pnpm build
- go vet ./internal/agent ./internal/event ./internal/eventwire
- go run ./tools/repolint
- scripts/cache-guard.sh
* test(desktop): make recovery timing deterministic
Problem:
The transcript recovery race suite waited on real 60–620 ms delays, which made scheduling assertions slower and vulnerable to host load.
Root cause:
The test exercised window timers and Date.now directly without controlling the clock.
Fix:
Install a deterministic in-test clock for window timers and Date.now, then advance each batching, idle, and coalescing boundary explicitly.
Verification:
- transcript recovery race test (25/25)
- 20 repeated deterministic runs
- full transcript suite
- frontend typecheck, hooks lint, and production build
- repolint
* fix(config): pin OpenCode Go windows to a shared capability table
Problem:
OpenCode Go presets still used conservative 128K/262K provider windows,
so 1M models compacted around 100K. Official DeepSeek and OpenCode Go
also had no shared ContextBudgetPolicy, so auto max_output_tokens=0
could not be admitted locally.
Root cause:
Context and output limits were hardcoded in presets and adapters
separately. Old OutputBudget()/SharesContextWindow() could not express
"shared window, 384K auto, omit the wire field until the remaining
space is tight".
Fix:
- Add ContextBudgetPolicy plus a static OpenCode Go models.dev table.
- Official DeepSeek, Kimi K3, and exact OpenCode Go routes implement
the new policy; old interfaces remain a fallback.
- Migrate only unmodified official presets in memory. Custom catalogs,
endpoints, and positive overrides stay user-owned.
Co-authored-by: kanchengw <[email protected]>
Verification:
- go test ./internal/provider ./internal/provider/openai ./internal/provider/responses ./internal/provider/anthropic ./internal/config ./internal/agent -run 'ContextBudget|OpenCodeGo|ForkCapture|SharedWindow'
- go test ./internal/config -run 'NormalizeLegacyOpenCode|LoadForEditOpenCode|OpenCodeGoContext'
* fix(agent): clip shared-window output and recover from context 400s
Problem:
The UI could show 63% prompt while the request failed HTTP 400 because
prompt + completion exceeded the shared window. After the 400 the turn
could stick, leaving Compact/Retry/Fork/Rewind unusable (#8909).
Root cause:
max_output_tokens=0 skipped local output admission even when the
provider auto budget was 384K. Shared-window 400s were terminal
malformed-request errors. Summary guards also required a positive
configured output budget.
Fix:
- Admit after interceptors: physical_remaining = window - prompt - 8K.
- 0 uses the provider auto budget; negative omits the field and
compacts instead of injecting; positive caps can still clip down.
- Parse trusted 400/413/422 context-limit errors, learn the window in
memory, retry once by changing only MaxTokens, then compact once.
- compact_ratio stays prompt-only. Successful recovery is an info
notice, not an error card.
Verification:
- go test ./internal/agent ./internal/provider ./internal/control -count=1
- go test -race ./internal/agent ./internal/provider/... ./internal/config -count=1
- Issue #8909 and screenshot cases: 229502 and 123195 exact clips
* fix(desktop): show this-turn context budget and restore actions
Problem:
The context ring is prompt/window, so 63% still looked healthy while
the request overflowed. After a terminal 400, Compact/Retry/Fork/Rewind
stayed disabled if running was not cleared.
Root cause:
Context Panel had no send-time admission view. TurnDone with an error
must clear running; that contract needed an explicit regression.
Fix:
Add optional contextBudget through ContextMaintenanceSnapshot,
ContextInfo, and ContextPanel. Show prompt, output reserve, physical
remaining, cap source, and last recovery. Successful auto-recovery is
an info line; terminal errors keep message actions available.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop/frontend && pnpm test:all && pnpm build
- Wails JSON keeps new fields omitempty; arrays stay []
* docs: describe provider-auto output budgets and overflow recovery
Problem:
SPEC/GUIDE still said max_output_tokens=0 meant omit/skip local
checks, which is how #8909 leaked a 384K server completion into a
nearly full shared window.
Root cause:
Docs described the old homemade ladder and omit-only official
DeepSeek behavior, not provider-auto admission, OpenCode Go send
rules, or in-session 400 learning.
Fix:
Document the 0 / positive / negative contract, keep compact_ratio
independent of output, and add an opt-in live A/B hook. Request
digest plus cache-guard remain the offline cache evidence.
Verification:
- Documentation-impact: updated GUIDE/SPEC EN+ZH
- ./scripts/cache-guard.sh (tail averages 92%-96%, threshold 90%)
- git diff --check
* fix(agent): publish recovered context budgets accurately
Problem:
- learned context-limit retries left the Context Panel showing the pre-error output budget
- the live cache hook never sent a provider request
- live provider conformance could fail on one model-following deviation
Root cause:
- recovery changed only the frozen request and recovery label, not the atomic admission snapshot
- placeholder imports kept the opt-in test compiling without exercising the API
- the conformance assertion treated probabilistic tool selection as deterministic
Fix:
- atomically publish learned retry source, observed window, physical remainder, effective output, and clipping state
- run a real warm/omitted/limited DeepSeek cache A/B with identical messages and tools
- allow one bounded conformance retry while preserving immediate failure for runtime errors
Verification:
- go test ./... -count=1
- go test -race ./internal/agent (focused recovery and isolation cases)
- make lint
- ./scripts/cache-guard.sh
- real DeepSeek cache A/B and LongCat conformance probes
* fix(agent): close context budget review gaps
Problem:
- Legacy OpenCode Go installs could miss same-pass window backfill.
- Session swaps could expose the previous admission, while unknown providers showed a shared-window warning.
- The retry guard omitted provider-visible fields and nested server-search data remained shallow-frozen.
Root cause:
- Combined migrations used short-circuit evaluation, transcript reset retained admission, and the UI ignored window mode.
- Recovery coverage compared a partial digest, and freezeProviderRequest did not clone nested search values.
Fix:
- Run both OpenCode Go migrations for every matching provider and cover one-pass idempotence.
- Clear transcript admission, gate shared-window UI, and compare the full provider request except MaxTokens.
- Deep-copy nested server-search results and raw payloads.
Verification:
- go test ./... -count=1
- go test -race ./internal/agent ./internal/provider/... ./internal/config -count=1
- make lint
- cache-guard, desktop Go tests, frontend test:all and production build
* refactor(agent): isolate turn and sampling setup
Problem:
The latest main-v2 merge result pushed beginRunTurn and streamWithSamplingRecovery past the repository function-size ratchet, blocking PR #8921 in CI.
Root cause:
Background-evidence leasing and per-attempt usage/sink setup remained inline in orchestration functions. Their growth combined with the reasoning-replay work from #8924 exceeded the shared budget.
Fix:
Extract background-evidence leasing, frozen-request attempt accounting, and attempt-sink selection into focused helpers without changing request bytes, retries, locking, or persistence.
Verification:
- go test ./internal/agent -run 'Test.*(Sampling|ContextLimit|MissingReasoning|BackgroundEvidence|BeginRun|RunTurn)' -count=1
- go vet ./internal/agent
- go run ./tools/repolint
- git diff --check
* fix(provider): make DeepSeek reasoning replay fail-safe
Problem:
DeepSeek Anthropic conversations could become unreplayable after server-side web search, interrupted tool turns, or truncated/missing reasoning, causing follow-up HTTP 400 responses.
Root cause:
Reasoning preservation and recovery only modeled client tool_calls, Anthropic reused OpenAI's empty-field fallback assumptions, and the byte guard silently retained an incomplete reasoning tail.
Fix:
Add message-aware replay capabilities, replay thinking before server search blocks, fail closed before unsafe client tools, salvage completed search answers through a provider-only history projection, repair legacy sessions once, and honor explicit DeepSeek protocols on custom Anthropic gateways. Also adapt PR #7763's explicit thinking-enabled OpenAI gateway replay support.
Verification:
go test ./...
go test -race ./internal/agent ./internal/control
cd desktop && go test ./...
go vet ./...
./scripts/cache-guard.sh
Co-authored-by: Wooseong Kim <[email protected]>
* refactor(agent): isolate reasoning replay recovery
Problem:\nThe reasoning replay fix exceeded repository function-size ratchets in streamWithFrozen and streamWithSamplingRecovery, and several test files crossed their per-file budgets.\n\nFix:\nExtract bounded reasoning and retry-finalization helpers, move provider capabilities into a focused file, and split replay tests by concern without changing request serialization or recovery behavior.\n\nVerification:\ngo run ./tools/repolint\ngolangci-lint run --timeout=5m ./...\ngo test ./...\ngo test -race ./internal/agent ./internal/control\ncd desktop && go test ./...\ngo vet ./...\n./scripts/cache-guard.sh
* test(provider): add live reasoning replay matrix
Problem:\nThe existing live DeepSeek probe stopped after the server-search response, so it did not exercise the follow-up request that triggered the reported HTTP 400. LongCat, GLM Coding Plan, and OpenCode Go also lacked focused live tool-replay coverage.\n\nRoot cause:\nThe live matrix validated initial streaming but not provider-issued reasoning and search-block replay across a subsequent request or an interrupted Agent save/load boundary. Anthropic clients also had no bounded-probe hook for closing pooled HTTP connections.\n\nFix:\nExtend the build-tagged probes with DeepSeek search continuation, Agent interruption/restart, and compatible-provider tool loops. Add the same CloseIdleConnections probe lifecycle hook already exposed by the OpenAI adapter.\n\nVerification:\nAll authorized live provider scenarios passed for DeepSeek Anthropic/OpenAI, LongCat, Zhipu Coding Plan, and OpenCode Go.\ngo run ./tools/repolint\ngolangci-lint run --timeout=5m ./...\ngo test ./...\ngo test -race ./internal/agent ./internal/provider/anthropic ./internal/provider/openai
---------
Co-authored-by: Wooseong Kim <[email protected]>
* feat(session): unify AI and agent-driven titles
Problem:
Session titles could be generated from the Desktop or written by an agent only through separate partial designs. The agent proposal accepted arbitrary paths, while the Desktop proposal did not share the canonical session-title projection or guard stale provider completions.
Root cause:
The runtime had no host-bound current-session title tool and no shared callback from canonical BranchMeta updates into Desktop compatibility indexes. AI title generation also lacked an owner check across asynchronous tab or session changes.
Fix:
Add a hidden current-session-only set_session_title capability, classify it as host-state mutation, keep it out of subagents and provider-visible schemas, and project successful writes through the Desktop legacy/catalog refresh path. Add bounded no-tool AI rename, deterministic stale-completion guards, multilingual UI actions, and full first-message hover previews.
Verification:
- go test owning root packages
- go test all Desktop packages
- focused root and Desktop race tests
- go vet root and Desktop packages
- frontend typecheck, ESLint, and project-tree runtime tests
- repository lint
Co-authored-by: han-wu_frgr <[email protected]>
Co-authored-by: jiangrenhang <[email protected]>
* fix(session): preserve newer and explicit titles
Problem:
Desktop metadata refreshes could replace an explicit session title with the logical topic title, and a delayed AI rename could overwrite a newer manual title.
Root cause:
SyncMetadata unconditionally preferred projected topic metadata, while AIRenameSession checked only controller/path ownership before an unconditional BranchMeta write.
Fix:
Preserve the representative session CustomTitle during metadata projection and add a BranchMeta lock-scoped compare-and-apply rename used by AI completion. Add deterministic metadata-sync and manual-vs-AI interleaving regressions.
Verification:
- focused agent, catalog, and desktop regressions
- Go race detector on title interleavings
- affected Go and Desktop test suites
- go vet, frontend typecheck, and repolint
* fix(session): keep title projections current
Problem:
- delayed rename callbacks could overwrite the legacy title projection with stale data
- explicit session titles could retain an automatic title source and be localized as defaults
- runtime topic snapshots could parse an entire transcript while waiting on its save lock
Root cause:
- the compatibility projection trusted the callback payload instead of the current BranchMeta
- catalog title source described topic metadata rather than the representative display title
- the preview fallback used the full authoritative display loader
Fix:
- project the canonical title while holding the legacy map lock
- derive the returned topic title source from the representative session custom title
- read only the first authored display-index range and fail closed on stale indexes
Verification:
- affected Go and Desktop suites pass, including focused race tests
- frontend runtime tests, typechecks, ESLint, go vet, and repolint pass
---------
Co-authored-by: han-wu_frgr <[email protected]>
Co-authored-by: jiangrenhang <[email protected]>
* fix(agent): keep compaction across tail-only rewinds / 尾部回退不再丢弃压缩投影
Editing a message rewinds the conversation to that message and resubmits.
CoveredCount used to record the build-time transcript length, so the verbatim
tail was frozen inside the projection and even a tail-only truncation crossed
into covered territory: the fold was discarded, the visible context ballooned
back to the pre-compaction transcript, and the next round re-paid a full
summary. The projection body now freezes only prefix + digest + kept messages
with CoveredCount at the fold boundary (translated to canonical indices when
folding on top of a live projection), so the tail splices from the transcript;
rewind invalidation is conditional on the projection actually going stale.
Re-folds whose boundary lands inside the prior projection body keep the
unfolded body suffix verbatim instead of dropping it from the model context.
Cache-impact: low - the provider-visible request bytes are identical for an
unchanged tail; tail-side rewrites now stay visible instead of serving stale
frozen copies
Cache-guard: TestTailOnlyRewindKeepsCompactedView, control-level
TestTailRewindKeepsCompactionProjection, and
TestRefoldIntoBodyKeepsUnfoldedBodyTail pin the changed boundaries; the
incremental/restart suites stay green
Documentation-impact: none - docs describe compaction behavior, which is
unchanged; this restores the documented behavior after message edits
* fix(agent): restore compacted projections after restart
Problem: Long sessions could reload their full transcript after every desktop restart, discarding a valid compaction sidecar and re-paying the context and token cost. Fork-first rewinds and branches could also lose a valid parent projection.
Root cause: The durable covered-prefix fingerprint was computed before the deterministic tool-pair repair applied during LoadSession, so old transcripts with repaired tool metadata no longer matched after restart. Fork and branch children did not copy the parent's sidecar.
Fix: Fingerprint the provider wire-safe prefix, strictly migrate v1.25.2 sidecars only when the exact pre-repair disk prefix matches, preserve that raw view through resume wrappers, and copy only prefix-validated projections to fork and branch children. Process-local transcript versions remain CAS metadata rather than durable identity.
Compatibility and cache impact: No sidecar schema change. Legacy hashes are rewritten only after an exact raw-prefix and normalized-wire equivalence check; real history edits fail closed. Unchanged provider request bytes remain stable.
Verification: go test ./... -count=1; desktop and SDK suites; go test -race ./internal/agent ./internal/control -count=1; go vet; repolint; request-byte stability; git diff --check.
Co-authored-by: XTLine <[email protected]>
---------
Co-authored-by: XTLine <[email protected]>
* fix(desktop): give the SSH remote window a native frame on Windows
On Windows the Wails window is created Frameless and the frontend draws its
own chrome: the drag rail via --wails-draggable and the minimise/maximise/
close buttons via the App bindings.
The remote web child window can do neither. main() launches it with
bindings = nil, and domReadyRemoteWindow then navigates it to the host's
Serve page over loopback HTTP, so neither window.go.main.App nor the Wails
runtime exists in that document. internal/serve's UI carries no drag regions
or window controls at all. The result on Windows is a window with no
titlebar, no way to drag it, and no way to minimise or restore it — the only
ways out are the keyboard system menu or killing the process.
Keep the native OS frame for remote windows so Windows itself supplies the
titlebar and window controls.
Also stop remote windows inheriting the saved main-window size.
desktop-window.json stores the main window's *outer* size, which for a
maximised window is the display plus the invisible resize borders (e.g.
2574x1454 on a 2560x1440 screen). The remote window is created without
WS_MAXIMIZE and then centred, so inheriting that size centres a window larger
than the display and pushes its top-left corner off-screen.
Co-Authored-By: Claude Opus 5 <[email protected]>
* fix(desktop): satisfy launch config lint
Problem:
The PR's detailed launch configuration comments exceed the repository essay limit and leave the required lint job red.
Root cause:
Native-frame and saved-geometry rationale was duplicated in function comments beyond the five-line per-position budget.
Fix:
Condense both comments while preserving the window-mode and geometry invariants.
Verification:
- go run ./tools/repolint
- cd desktop && go vet ./...
- cd desktop && go test . -run TestDesktopWindowFramelessExcludesRemoteWindow|TestInitialDesktopWindowSize -count=1
- git diff --check
Co-authored-by: SivanCola <[email protected]>
* chore(repolint): allow detailed declaration docs
* fix(cache): gate standing instruction changes
Problem:
Standing instruction edits alter the provider-visible stable prefix, but the cache-impact guard ignored their canonical filenames and allowed a no-impact declaration.
Root cause:
The guard enumerated implementation paths without covering the instruction documents discovered by the runtime resolver.
Fix:
Treat canonical and local REASONIX, AGENTS, and CLAUDE documents at any repository depth as cache- and system-prompt-sensitive. Reject a none declaration for those files and add focused contract coverage to the release workflow suite.
Verification:
- bash scripts/check-cache-impact.test.sh
- bash scripts/release-workflows.test.sh
- bash -n scripts/check-cache-impact.sh scripts/check-cache-impact.test.sh scripts/release-workflows.test.sh
- go run ./tools/repolint
- git diff --check
---------
Co-authored-by: donut <[email protected]>
Co-authored-by: Claude Opus 5 <[email protected]>
Co-authored-by: SivanCola <[email protected]>
* fix(acp): report readiness-gate failure as end_turn + warning
The balanced preset injects verify=targeted, so turns whose work completed
without a whitelisted verification command end with a FinalReadinessError.
sessionPrompt collapsed that into stopReason=error, which ACP supervisors
treat as a hard failure and which is not a legal ACP v1 enum value anyway.
Mirror the TUI: emit a [warning] chunk with the gate reason and end the
turn normally; cancellation and real errors keep their existing mapping.
Fixes#8811.
* fix(acp): return failures through JSON-RPC
Problem:
ACP v1 has no error stop reason. The readiness fix handled controlled delivery gaps, but genuine failures still emitted stopReason=error, and cancellation could diverge when a runner returned nil.
Root cause:
sessionPrompt collapsed controller outcomes into an ad-hoc StopReason and sampled cancellation separately for telemetry and the prompt response.
Fix:
Classify the completed run once: cancellation returns cancelled, readiness and recovery pauses return end_turn, and genuine failures use a bounded credential-redacted JSON-RPC error. Reuse the same protected reason for status telemetry and document the ACP behavior in English and Chinese.
Verification:
- go test ./internal/acp -count=1
- go test -race ./internal/acp -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
Co-authored-by: Oxygen56 <[email protected]>
* fix(acp): redact readiness warning diagnostics
Problem:
Final-readiness warnings copied the raw gate reason into ACP message chunks, so credential-like text and arbitrarily long criteria could cross the external protocol boundary.
Root cause:
The warning path bypassed the bounded strong-redaction helper used by JSON-RPC failures and status telemetry.
Fix:
Add a reusable credential-text clipping helper, apply it to readiness warnings with a 2,048-byte bound, and cover secret-shaped and oversized reasons at the wire level.
Verification:
- go test ./internal/acp -count=1
- go test -race ./internal/acp -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- go test ./internal/productdocs -count=1
- git diff --check
* fix(acp): protect readiness status reasons
Problem:
The final-readiness warning was protected, but the same gate reason still reached the ACP vendor status update through the weaker general text redactor.
Root cause:
The readiness-paused telemetry branch did not use the external-error redaction helper shared by prompt failures.
Fix:
Route FinalReadinessError status reasons through the bounded strong-redaction path and cover opaque credential-shaped text in the status regression test.
Verification:
- go test ./internal/acp -count=1
- go test -race ./internal/acp -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- go test ./internal/productdocs -count=1
- git diff --check
* fix(acp): preserve UTF-8 in bounded diagnostics
Problem:
ACP diagnostics clipped at the 2,048-byte boundary could split a multibyte UTF-8 rune. JSON encoding then replaced the invalid suffix and could grow the decoded payload beyond the documented limit.
Root cause:
clipStatusValue sliced strings directly at the byte limit without first normalizing invalid input or backing up to a rune boundary.
Fix:
Normalize diagnostic text to valid UTF-8, clip only at rune starts, and cover both a multibyte JSON boundary and invalid input with focused regression tests.
Verification:
go test ./internal/acp -count=1
go test -race ./internal/acp -count=1
go test ./... -count=1
go vet ./...
go run ./tools/repolint
go test ./internal/productdocs -count=1
git diff --check
* fix(acp): preserve resumable prompt outcomes
Problem:
ACP exposed legacy status credentials, reported deliberate run boundaries as InternalError, and created a synthetic failed turn for stale readiness recovery requests.
Root cause:
Persisted turn outcomes used weak clipping, prompt result mapping did not recognize Agent run-pause classes, and status publication happened before one-shot recovery admission.
Fix:
Strongly redact restored and persisted outcomes; map explicit max-steps and task budgets to successful ACP v1 responses with paused status and warnings; defer recovery status publication until the checkpoint is admitted and return InvalidRequest for stale actions.
Verification:
go test ./... -count=1
go test -race ./internal/acp ./internal/control -count=1
go vet ./...
golangci-lint run --timeout=5m ./...
go run ./tools/repolint
---------
Co-authored-by: SivanCola <[email protected]>
Co-authored-by: Oxygen56 <[email protected]>
* feat(config): add SCNet (国家超算互联网) provider presets / 新增国家超算互联网模型预设
Add curated OpenAI- and Anthropic-compatible presets for the SCNet
token-plan API (https://api.scnet.cn/api/llm/v1 and /api/llm/anthropic).
Both presets auto-fetch the dynamic model catalog from the official
/v1/models endpoint; the static list seeds the picker and stays as the
offline fallback. Endpoints and defaults were verified against scnet.cn's
official API documentation.
* fix(config): align SCNet presets with provider contracts
Problem:
The SCNet Anthropic preset sent adaptive thinking to a gateway that only accepts enabled or disabled thinking, and both presets exposed stale or protocol-incompatible models.
Root cause:
The presets shared one unfiltered OpenAI model catalog and treated a non-empty curated list as a dynamic fallback, while the frontend preserves curated models.
Fix:
Keep separate current Token Plan model lists, restrict the Anthropic preset to its supported subset, omit the OpenAI models endpoint and adaptive thinking from Anthropic, update browser mocks, and add config and wire-shape regressions.
Verification:
- go test ./...
- go test -race ./internal/config ./internal/boot -run SCNet -count=1
- go vet ./internal/config ./internal/boot
- go run ./tools/repolint
- desktop preset integration tests
- frontend typecheck and production build
Co-authored-by: SivanCola <[email protected]>
* fix(config): refresh SCNet provider contracts
Problem:
The SCNet Anthropic preset exposed an outdated two-model subset, omitted documented Kimi vision capability, and let DeepSeek V4 inherit the provider's native thinking request shape.
Root cause:
The preset encoded an older SCNet compatibility snapshot and relied on model-name reasoning inference instead of the gateway's documented OpenAI contract.
Fix:
Align both protocol presets with the current Token Plan catalog, declare the documented vision models, pin DeepSeek V4 to SCNet's reasoning_effort shape, and add end-to-end request-contract coverage.
Verification:
- go test ./... -count=1
- go test -race ./internal/config ./internal/boot -run SCNet -count=1
- go vet ./internal/config ./internal/boot
- go run ./tools/repolint
- pnpm build (desktop/frontend)
- git diff --check
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
Problem:
Windows workspace trees can remain locked while Reasonix watches nested directories, preventing rename or removal operations.
Root cause:
The generic watcher opens one handle per directory on Windows, while the source contribution could not receive maintainer-side CI fixes because its fork branch disabled maintainer edits.
Fix:
Use one recursive overlapped ReadDirectoryChangesW subscription per workspace root, preserve fsnotify on other platforms, and satisfy wrapped-error and integer-range lint contracts.
Verification:
GOOS=windows golangci-lint run --timeout=5m ./...
Focused workspace watcher tests and go test -race passed.
Windows test cross-compilation, go vet, repolint, and git diff --check passed.
Co-authored-by: Nath-Vikky <[email protected]>
* fix(desktop): localize new-session sidebar titles / 修复侧边栏新会话标题不随系统语言显示
* Add runtime sidebar title regression coverage
Problem:
The catalog-only regression did not exercise the new live runtime projection, and the manual-title test could pass vacuously when the catalog returned no visible session-backed topic.
Root cause:
The runtime projection now shares snapshot assembly with project-tree events, while metadata-only topics are intentionally filtered from ordinary catalog pages.
Fix:
Add a runtime snapshot localization test and give the manual-title case a real session before asserting the exact topic identity and unchanged label.
Verification:
- cd desktop && go test ./... -count=1
- cd desktop && go vet ./...
- cd desktop && go test -race . -run 'Test(ProjectTreeRuntimeSnapshotLocalizesAutoTopicTitle|CatalogTopicTitleLocalizesAtSidebarBoundary|CatalogManualDefaultTitleIsNotLocalized)$' -count=1
- go test ./internal/sessioncatalog -count=1
- go vet ./internal/sessioncatalog
- go run ./tools/repolint
- git diff --check
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: ShumzZzZz <[email protected]>
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): stream the active turn as the list's in-flow footer / 活跃 turn 移出虚拟列表
Problem
On Windows (WebView2) the transcript flickers badly during streaming and
long conversations cannot reliably reach the bottom: the jump-to-bottom
button often appears to do nothing and the view is pulled back mid-stream
(#8657, #8688). Twelve scroll/render fix PRs (v1.25.0-v1.25.2) did not
resolve it because they all patched around the same structural premise.
Root cause
An unbounded, per-frame-growing turn lived inside the virtual list as
measured rows:
1. Streaming reasoning used a head-chopping truncation window; every
~2000 chars the text lost its common prefix and the parsed markdown
tree was discarded wholesale, then re-parsed in full on the main
thread.
2. Transcript re-renders every streaming frame; the inline itemContent
closure changed identity each frame, so Virtuoso re-mapped every
mounted row.
3. Per-frame row growth fed per-frame scroll writes (autoscrollToBottom
is inert without followOutput; a single-frame settle retry), which
oscillated between estimated and measured heights.
4. Height churn could trip the blank-viewport watchdog (its dedup key
included scrollTop, so it never deduped while streaming) into
full-list remounts, and the recovery anchor-restore loop fought user
input: nothing cleared the pending anchor on jump, so a click inside
the restore window was pulled back. A lost pointerup could also
strand selection mode, making scrollToBottom a silent no-op.
Fix
- splitTranscriptLiveRows moves the active turn's rows out of the
virtual data; LiveTurnRegion renders them as the list's in-flow
Footer, inside the scroller but outside the measured size tree.
Virtuoso tracks the footer height itself and reports it through
totalListHeightChanged, which drives tail-follow; when the user
scrolls away, nothing re-pins. Completion materializes the turn back
into the list behind a two-phase handoff with surface guards and a
bounded safety net.
- Streaming reasoning renders as append-only plain text
(StreamingReasoningText) and swaps to worker-parsed Markdown exactly
once on completion; the truncation window and its prop chain are
deleted.
- Scroll arbitration: jump/JumpBar/rewind invalidate pending recovery
anchors first (user intent outranks recovery and follow); the tail
settle re-aims across a bounded frame budget until the DOM reports
the bottom; a stale selection gesture no longer silently eats the
jump-bottom click; the blank watchdog dedups on surface+revision with
a cooldown.
- renderRow/itemContent keep stable identities, so token frames no
longer re-map mounted rows.
Verification
- pnpm test: all 175 frontend suites pass, including new coverage for
the live split, streaming staying out of the list and materializing
on completion, plain-text reasoning swapping to formatted Markdown,
and jump-bottom holding the tail with an in-flight recovery restore.
- pnpm build green (eslint, CSS checks, tsc, vite build, bundle budget).
- desktop Go suite green (no Go changes).
- Not covered locally: real WebView2 on Windows (#8657/#8688 need a
Windows recheck), Playwright browser benches (CI; they assert
settled-history behavior only).
* refactor(desktop): extract Transcript tail components / 拆分 Transcript 尾部组件
The live-turn footer work pushed Transcript.tsx to 1247 lines, 167 over
its repolint file-size budget (1080). Extract the self-contained tail
components into their own modules — ProcessFoldHeader, QuestionJumpBar,
and the row cards (PhaseCard/SteerCard/NoticeCard/CompactionCard) —
bringing the file to 945 lines. NoticeCard keeps its historical export
path from Transcript.tsx. No behavior change.
Verification: repolint clean; tsc + eslint clean; pnpm test passes all
175 suites.
Problem:
Ordinary same-surface tasks could be interrupted by a final-readiness recovery card after the requested work had already landed, solely because verification or review evidence was incomplete.
Root cause:
Medium-risk and multi-file mutations were promoted to closed-loop evidence, and targeted post-write verification was enforced as a hard final-answer gate. The completion summary did not include configured project-check gaps.
Fix:
Keep ordinary same-surface mutations on targeted evidence, report their missing checks and review through the host completion summary, and reserve hard closure for high-risk, security, persistent, explicit full-verification, Goal, missing-mutation, and unfinished-todo cases. Preserve wire keys and tool schemas while removing remaining Delivery wording from visible copy.
Verification:
go test ./...
cd desktop && go test ./...
frontend focused tests and TypeScript typechecks
cache-prefix and tool-schema focused tests
* feat(sandbox): add Codex-style on-demand write-access grants
Problem
Writes outside the workspace were either silently blocked or forced
users toward unsandboxed sandbox_escape. File tools could not request
the target parent directory, and Bash had no structured way to declare
extra write roots.
Root cause
The host treated workspace confinement as a static snapshot. There was
no session-scoped writable-root manager, no write_access approval kind,
and no single-card merge of ordinary Ask permission with directory
expansion.
Fix
Keep the workspace writable by default and isolate outside writes until
the user grants once, session, or project persist. File tools declare
parent directories automatically. Bash accepts additional_write_dirs
plus justification and stays inside Seatbelt/bubblewrap. Sub-agents
inherit a snapshot and cannot expand. Protected Reasonix state stays
read-only even after a home grant.
Verification
- go test ./internal/config ./internal/sandbox ./internal/tool/builtin ./internal/permission ./internal/agent ./internal/control ./internal/cli ./internal/acp ./internal/bot ./internal/boot
- go test ./...
- cd desktop/frontend && pnpm test:typecheck && pnpm test && pnpm build
* fix(sandbox): harden approved write roots
Problem:
Approved write paths could change identity after the user prompt, protected project or future runtime state could be reopened by a broad grant, and project grants were cleared with session grants.
Root cause:
Write roots were not revalidated through directory creation and sandbox construction, protected roots enumerated only existing children, and persisted grants were stored in the session bucket.
Fix:
Verify approved path identities before and after creation and before sandbox use, protect the Reasonix state boundary while reopening only safe children, keep project grants in the baseline, and split the added surfaces to satisfy repository size gates.
Verification:
go test ./...
go test -race ./internal/sandbox ./internal/control
go vet ./...
GOOS=windows GOARCH=amd64 go test -c ./internal/sandbox
pnpm test
pnpm build
go run ./tools/repolint
* fix(sandbox): require exact approved path identity
Problem: case-insensitive approval comparison could reuse a write grant for a distinct case-only path on case-sensitive macOS or Windows filesystems.
Root cause: sameWritePath used EqualFold for every Darwin and Windows path even though both platforms can expose case-sensitive directories.
Fix: compare the already-canonical approved path exactly and add a regression test for case-only identity changes.
Verification: go test ./internal/sandbox
* chore(lint): keep security comments within repo limits
Problem: the merged helper note and path-identity rationale exceeded repolint's comment-length budget.
Root cause: integration added explanatory prose next to already-dense comment blocks.
Fix: remove the redundant helper note and condense the security rationale without changing behavior.
Verification: go run ./tools/repolint
* fix(sandbox): satisfy cross-platform lint gates
Problem: Darwin lint saw a Linux-only helper as unused, and the concurrency test used a pattern rejected by the pinned modernize analyzer.
Root cause: the helper lived in a platform-neutral file even though only bubblewrap needs it; the test predated WaitGroup.Go.
Fix: move path resolution beside the Linux bubblewrap caller and modernize the test goroutines.
Verification: sandbox tests and race tests; repolint; pinned golangci-lint; Windows and Linux sandbox test compilation.
* fix(deps): update x/image for GO-2026-6222
Problem: CI govulncheck found the vision image decode path reachable through the vulnerable VP8L decoder in golang.org/x/image v0.44.0.
Root cause: the dependency predates the excessive-allocation fix published in v0.45.0.
Fix: upgrade x/image to v0.45.0 and its required x/text v0.41.0 dependency.
Verification: Go 1.26.6 full tests; control image tests; govulncheck reports zero affected vulnerabilities; repolint and pinned golangci-lint.
* fix(ci): align desktop deps and platform helpers
Problem: the security dependency update left the desktop module untidied, while Windows lint compiled a non-Windows sandbox helper with no callers.
Root cause: the repository has separate root and desktop module locks, and the protected-state helper lived in a platform-neutral file.
Fix: synchronize the desktop x/image/x/text versions and compile the helper only on sandbox backends that use it.
Verification: exact CI race and atomic coverage commands; Darwin/Windows root lint; Windows desktop lint; full desktop tests on Go 1.26.6.
* fix(sandbox): remount approved temp roots under bwrap
Problem: Linux bubblewrap hides approved host /tmp write roots behind the session-private /tmp mount, and the protection-order regression test inspected the first bind instead of the post-protection remount.
Root cause: approved roots were rebound without rebuilding destination parents after /tmp was replaced.
Fix: recreate only the approved root's parent mountpoints before its exact bind, correct the ordering assertion, and add a regression test for temporary write roots.
Verification: affected-package tests and race tests; Linux cross-compilation and lint; repository lint.
* fix(sandbox): skip redundant protected mounts
Problem: Linux bubblewrap refused to launch when a Reasonix state boundary did not exist, even when that path was disjoint from every writable root.
Root cause: protected paths were rebound unconditionally although the read-only root filesystem already denied writes to disjoint paths.
Fix: apply protected remounts only when a writable root overlaps the boundary, preserving fail-closed behavior for ancestor and descendant grants.
Verification: Linux bubblewrap 0.9 integration test; affected-package tests; CI-equivalent race sweep; Linux lint and repository lint.
* test: characterize session, rewind and lock crash windows
Phase-0 guardrails for the concurrency/rewind refactor:
- Add crash-injection seams at the remaining persistence boundaries of
the session save protocol (session-checkpoint, branch-meta,
event-index) alongside the existing wal-append/atomic-write hooks.
- Pin the recovery outcome of a crash at each boundary: WAL append
(previous checkpoint stays authoritative), checkpoint rename on the
full-rewrite path (event log authoritative, compatibility checkpoint
absent), revision ledger (stale ledger heals via ledgerStale without
new WAL records), derived event index (nothing authoritative lost).
- Pin the sidecar inventory a healthy first save produces, with the
legacy .lock sidecars documented as a tolerated class the refactor
removes.
Existing suites already pin lease generation, deletion races, and
checkpoint transaction crash windows; those baselines stay green.
* refactor(lock): delegate workspace lease to filelock
workspacelease now owns only participation accounting — active runs,
retained background jobs, lazy acquisition, waiting/acquired UI state,
and release-when-idle. Cross-process and in-process serialization is
delegated entirely to internal/filelock:
- acquisition first attempts filelock.TryAcquire (local slot + OS lock
in one non-blocking step), then on contention flips waiting=true,
fires the wait notice exactly once, and waits via filelock.Acquire
bounded by ctx;
- the package's duplicated Unix/Windows lock implementations and its
own un-reclaimed in-process registry are deleted.
The lock file name, canonicalization, git-worktree folding, and release
semantics are unchanged; desktop conflict cards keep reporting the same
Owner state.
* refactor(session): introduce generation-bound SessionWriter
SessionWriter is the single authoritative writer identity for one session
file, unifying what was spread across the lease, the lease-info sidecar,
and per-session persist state:
- the session lease (one writer per lease, cached on it, so rebinds share
one save-serialization domain);
- the writer identity (writer ID, PID, hostname), now published inside
the .lease.lock file itself through the held lock handle — .lease.json
becomes a read-only compatibility source and new writers never create
it (LoadSessionLeaseInfo dual-reads lock file then legacy sidecar);
- writer-save serialization: authorities minted through a writer hold
its saveMu for the whole save cycle, serializing turn-end snapshots,
periodic autosave, and shutdown snapshots issued through one lease;
- the writer's event-log baseline (revision, digest, tail offset),
recorded by setPersistedBaseline and consumed by the upcoming save-CAS
refactor.
SaveIfAbsent (imports, migrations, fork creation) now runs under an
ephemeral session lease so those writers never race another runtime.
Controller binds mint authorities through the lease's writer facade.
Windows/Unix writeOwnerInfo implementations publish through the held
handle so the metadata dies with the lock file on RemoveAndUnlock.
* refactor(session): make event-log tail the single save CAS
Writer-bound saves now classify against the SessionWriter event-log
baseline (revision, digest, tail offset) and the paired in-memory
persisted view. When the on-disk log size and event index still match
that baseline, the save decides no-op / append / replace without
reloading the transcript or walking dual revision/digest ownership.
Bind adopts the loaded persist ledger so the first save after a
controller attach can use the same tail CAS. Recovery-lane writes stay
unpaired and fall back to the existing full classification.
Also keep the branch independently lint-clean: workspacelease is no
longer a utility leaf now that it delegates to filelock, and the
SessionWriter comments/crash tests are trimmed to the comment budget.
Verification:
- go test ./internal/agent ./internal/checkpoint ./internal/filelock ./internal/workspacelease ./internal/control
- go test -race on the same packages
- make lint
* refactor(session): collapse recovery conflicts to one stable branch
True snapshot divergence now writes one recovery file keyed by the root
branch ID and writer generation. Nested -recovery- names peel back to
that root so later conflicts update the same path instead of growing a
recovery-on-recovery chain.
SaveRecoveryBranch no longer enforces SessionRecoveryMaxDepth. The
controller always takes the same fork path; the historical depth-cap
isolated copy is gone. RecoveryDepth is still stamped as 1 so older
readers keep a usable field.
Verification:
- go test ./internal/agent ./internal/checkpoint ./internal/filelock ./internal/workspacelease ./internal/control
- make lint
* feat(files): add conditional structured-file writes
write_file, edit_file, multi_edit, and notebook_edit now capture a
publish fingerprint (existence, SHA-256, mode; overlay buffer hash when
the host buffer is the source) at first read and re-check it immediately
before the atomic write. A mismatch returns typed ErrFileChanged and
leaves the destination untouched.
This is the Reasonix-writer CAS: workspace lease still serializes our
writers, and unknown shell/MCP side effects stay coverage gaps.
Verification:
- go test ./internal/tool/builtin
- go test ./internal/agent ./internal/control -run 'TestWrite|TestEdit|TestWorkspace|TestMutation'
- make lint
* refactor(checkpoint): add v3 turn directories and legacy reader
New checkpoints write turns/<turn>/meta.json plus files/NNNN.before
payloads and no longer emit turn-N.json. Load prefers the v3 directory
layout and still reads leftover v1/v2 turn files so old sessions remain
restorable. Payloads are raw bytes; encoding is re-detected on load.
Verification:
- go test ./internal/checkpoint
- make lint
* refactor(rewind): replace file transaction with idempotent operations
File precheck now treats current==before as already restored and does
not conflict. Plans gain ConversationAction, and results carry
operationId/branch/partial/conversationForked so fork-first conversation
rewind can stay a separate step.
Verification:
- go test ./internal/checkpoint ./internal/control
- make lint
* refactor(rewind): make conversation rewind fork-first
CLI and desktop conversation rewind now fork a new session instead of
truncating the parent. both = fork, then file restore; a file conflict
keeps the new branch and returns partial=true. CommitFileRewind commits
only the file half. Desktop views expose conversationAction, branch,
operationId, and partial.
Verification:
- go test ./internal/control ./internal/checkpoint
- cd desktop && go test . -run 'TestRewind|TestCheckpoint'
- make lint
* cleanup: remove legacy save lock from writer-bound hot path
Production saves that already hold a SessionWriter no longer acquire
.jsonl.lock. The session lease is the cross-process ticket; the
compatibility flock remains only for unbound test/import paths.
Verification:
- go test ./internal/agent -run 'TestWriterBoundSaveSkipsCompatibilityFileLock|TestWriterTail|TestSaveSnapshot'
- make lint
* test: add Windows, race and crash-restart matrices
Pin writer-generation invalidation and repeated writer-bound saves that
must not spawn recovery files. Crash windows stay in the existing
characterization suite. Session lock, delete-disposition, and atomic
replace still need a real Windows runner.
Verification:
- go test ./internal/agent -run 'TestSessionWriterGenerationInvalidatesPriorSave|TestRepeatedWriterSavesDoNotCreateRecoveryBranches'
- make lint
* docs: document session ownership, rewind semantics and worktree fallback
Add bilingual session-ownership notes and update checkpoint docs so
conversation rewind is described as a parent-preserving fork.
Verification:
- make lint
* fix(session): publish Windows lease owner info without SetFilePointerEx
Problem:
Windows CI failed to compile the new lease owner-info writer.
Root cause:
writeOwnerInfo called windows.SetFilePointerEx, which is not in
golang.org/x/sys/windows, so test, lint typecheck, and desktop-windows
jobs all failed.
Fix:
Seek with SetFilePointer, truncate with SetEndOfFile, then WriteFile.
A Windows test pins that a shorter replacement document does not leave
stale trailing bytes.
Verification:
- GOOS=windows GOARCH=amd64 go test -c ./internal/agent
- GOOS=windows GOARCH=amd64 go test -c ./internal/control
* fix(desktop): open conversation rewind forks in a new tab
Problem:
Conversation rewind forked on disk but left the visible tab on the
untruncated parent. Edit-and-resubmit then appended to the parent.
Desktop tests still expected in-place truncation and the old
depth-cap recovery outcome.
Root cause:
CommitRewind kept switchToFork=false and never opened result.Branch.
The frontend reloaded the source tab and sent the edited prompt there.
Fix:
Reuse the ForkForTab tab-open helper after a conversation fork.
Frontend types now carry branch/tab fields, activate the fork with the
same last-click-wins rule as an explicit fork, and send edit-resubmit
to that tab. File undo still targets the source tab. Tests match the
new contracts.
Verification:
- go test ./desktop -run 'TestDesktopRewindCommitAndUndoUseAuthoritativeControllerState|TestSetEffortForTabReanchorsDepthCapRecoveryBranch|TestForkCreatesActiveTabWithoutSwitchingSourceController'
- go test ./internal/agent ./internal/control ./internal/checkpoint ./internal/workspacelease
- node --import tsx --test desktop/frontend/src/__tests__/app-chrome-tabs.test.ts
* fix(session): keep Windows lease metadata readable
Problem:
- Windows could not inspect .lease.lock owner metadata while another process held the byte-range lease, so the Windows control test failed with a sharing violation.
Root cause:
- The owner JSON started at the same byte protected by LockFileEx, and readers used Go's default non-sharing file open.
Fix:
- Reserve byte zero for the cross-version lock and store JSON from byte one.
- Open lease handles with explicit read/write/delete sharing and read owner metadata after the locked byte.
- Route stale lease cleanup through the lease-specific lock primitive.
Verification:
- go test ./internal/agent ./internal/control ./internal/checkpoint
- GOOS=windows GOARCH=amd64 go test -c ./internal/agent
- GOOS=windows GOARCH=amd64 go test -c ./internal/control
* fix(rewind): complete v3 retention and fork routing
Problem:
- Schema v3 checkpoint captures still duplicated every preimage into the blob store and retained expired raw payloads indefinitely.
- A durable conversation fork that failed to attach to a desktop tab could fall back to resubmitting on the parent session.
- Frontend source growth exceeded exact repository lint ratchets.
Root cause:
- Capture and GC still followed the v2 blob lifecycle even after v3 introduced per-turn directories.
- Fork attachment errors did not change an otherwise successful rewind result.
- Rewind contracts remained embedded in already-ratcheted frontend files.
Fix:
- Store new preimages only in v3 turn directories, verify payload hashes on load, and delete expired turns as whole directories while retaining v1/v2 compatibility.
- Fail closed when a fork cannot be attached and keep the durable branch available for manual recovery.
- Extract rewind view/state contracts and their focused routing test.
- Update English and Chinese ownership/rewind documentation.
Verification:
- go test ./internal/checkpoint
- cd desktop && go test ./...
- pnpm --dir desktop/frontend typecheck
- pnpm --dir desktop/frontend exec tsx src/__tests__/rewind-fork-routing.test.ts
- pnpm --dir desktop/frontend exec tsx src/__tests__/app-chrome-tabs.test.ts
- go run ./tools/repolint
* test(checkpoint): use integer range in retention coverage
Problem:
- The v3 retention regression test failed the repository's intrange lint rule.
Root cause:
- The test used a classic counted loop even though the module targets Go 1.22 or newer.
Fix:
- Use the integer range form without changing test behavior.
Verification:
- make lint
- go vet ./...
* fix(rewind): isolate fork state from file undo
Problem:
- A both-scope fork carried the parent transcript snapshot into the file restore transaction, so a later file undo could overwrite parent messages added after the fork.
- Re-encoding a malformed or non-canonical text preimage could change its original bytes.
Root cause:
- The file transaction retained the original both scope, conversation boundary, checkpoint backup, and forward transcript even though the conversation action had already completed as a separate fork.
- Schema v3 persisted only the decoded FileSnap view after removing checkpoint blob duplication.
Fix:
- Normalize fork-backed both rewinds to code-only transactions with no conversation boundary, forward transcript, or checkpoint backup.
- Preserve captured raw bytes in memory and write them directly to the v3 turn payload.
- Cover parent continuation through undo and malformed UTF-16 byte fidelity.
Verification:
- go test ./internal/checkpoint ./internal/control
- go test -race ./internal/checkpoint ./internal/control
- cd desktop && go test -race . -run TestDesktopRewindCommitAndUndoUseAuthoritativeControllerState
- make lint
- Windows agent and control cross-compilation
* fix(concurrency): close recovery and rewind gaps
Problem:
- Recovery branches could collide across process restarts.
- Session redaction checked leases without holding one through rewrite.
- V3 checkpoints lacked downgrade numbering and byte-retention guards.
- Partial code rewind was not surfaced after conversation fork.
Root cause:
- Recovery identity used only the lease generation.
- Doctor used a check-then-write lease probe.
- V3 storage omitted a previous-reader marker and quota accounting.
- History hydration replaced an early warning notice.
Fix:
- Bind recovery identity to writer and generation, with collision rotation.
- Hold ordered session writer leases across redaction.
- Add payload-free v2 markers, load arbitration, and whole-turn v3 quota GC.
- Show a localized partial-rewind warning after session reload.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/checkpoint ./internal/doctor
- cd desktop && go test ./...
- pnpm build && pnpm test:all
- frontend type checks and browser partial-rewind exercise
- previous-reader checkpoint compatibility exercise
* refactor(lint): extract rewind and checkpoint helpers
Problem:
- CI repo standards rejected new growth in two oversized legacy files.
Root cause:
- Checkpoint load arbitration and rewind result plumbing remained embedded in their large coordinators.
Fix:
- Move checkpoint loading into a focused package file.
- Centralize rewind result normalization, target settling, and partial notice dispatch.
- Keep the existing file-size baseline unchanged.
Verification:
- go run ./tools/repolint
- go test ./internal/checkpoint -count=1
- go test -race ./internal/checkpoint -count=1
- pnpm lint:hooks
- pnpm typecheck
- pnpm test:typecheck
- rewind fork routing contract
* fix(session): complete ownership handoff across rewinds
Problem:
Intentional session-path changes could leave frontends guarding the old transcript while controllers continued on a fork. Writer-bound saves also bypassed the compatibility lock, and older checkpoint readers could resurrect markerless v3 turns after truncation.
Root cause:
Conversation rewind was fork-first but several consumers did not activate or register the returned branch. Path changes had no shared prepare-before-publish authority hook, recovery lane identity followed lease generations, and v3 directories were treated as live without their compatibility marker.
Fix:
Add a controller transition handshake and wire it through CLI, serve, Desktop, ACP, and bot runtimes. Keep the legacy save lock for cross-version serialization, stabilize recovery lanes across rebinds, and make v2 markers the liveness record for v3 checkpoint turns.
Verification:
make lint
go vet ./... && go test ./... -count=1
go test -race ./internal/agent ./internal/checkpoint ./internal/control ./internal/bot ./internal/serve ./internal/acp ./internal/doctor -count=1
cd desktop && go vet ./... && go test ./... -count=1
cd desktop/frontend && pnpm build && pnpm test:all
Windows amd64 cross-compilation and real v1.23.0/v1.25.1 downgrade truncation checks
* feat(runtime): replace execution modes with adaptive standard policy
Problem
Reasonix exposed Light/Balanced/Delivery (and legacy TokenMode) as a
user-selectable execution mode. That split the product into three
workflows, leaked mode labels into UI/ACP/CLI, and let low-risk work
pay Delivery ceremony or high-risk work skip closed-loop evidence.
Root cause
Planner route, verification, review, and completion were branched on
AgentPreset/TokenMode/deliveryProfile instead of task risk.
Fix
Derive one TaskPolicy per turn from intent, risk, structure, and user
constraints. Planning, verification, review, and evidence closure follow
that policy and may only ratchet upward. New UI/CLI/ACP surfaces no
longer offer an execution mode. Deprecated flags, slash commands, ACP
options, and Wails SetAgentPreset*/SetTokenMode* stay accepted for one
compatibility version as no-ops. New persisted compat fields pin
agentPreset=balanced and tokenMode=full. Isolated worktrees keep their
on-disk directory and no longer force Delivery.
Verification
- go test ./...
- cd desktop && go test .
- go test -race ./internal/control ./internal/acp ./internal/taskpolicy
- frontend tsc --noEmit plus Composer/isolated-worktree/send-failed tests
* fix(ci): restore desktop bindings and satisfy repolint
Problem
CI lint failed on comment, file-size, and complexity overruns. Desktop
jobs failed TypeScript because Wails still exports deprecated
SetAgentPreset*/SetTokenMode* and DeliveryWorktree aliases that
AppBindings no longer listed.
Root cause
The standard-execution change kept the one-version Go compatibility
methods bound, but the frontend drift check requires every generated
Wails method on AppBindings. The same change also grew several
already-baselined files past comment and size budgets.
Fix
Bind the deprecated Wails methods as no-op aliases in AppBindings and
the browser mock. Extract ExecutionPolicyBlock and boot test helpers,
split Derive helpers, and compress comments and tests so repolint stays
inside existing budgets.
Verification
- go run ./tools/repolint
- go test ./internal/taskpolicy ./internal/acp ./internal/boot ./internal/control ./internal/evidence ./internal/cli ./internal/capability ./internal/agent
- cd desktop && go test . -run 'TestLoadTabSessionProfile|TestSetTokenMode|TestSetAgentPreset|TestDeliveryWorktree|TestCreateDelivery|TestIsolated'
- desktop/frontend tsc --noEmit
- isolated-worktree and composer-profile frontend tests
* fix(ci): drop unused mode leftovers and preset UI assertion
Problem
After repolint went clean, golangci-lint failed on an ineffectual
ACP workMode assignment, an unused CLI footer helper, a desktop
token-mode snapshot helper, and a strings.Builder modernization
in boot tests. The desktop frontend job failed because the change
panel no longer renders a Balanced preset label.
Root cause
Execution-mode removal left unused compatibility helpers and an
assignment that was immediately overwritten with the pinned
compat value. The workspace-changes test still required the old
preset localization.
Fix
Pin ACP status WorkMode to balanced without reading the unused
runtime profile, delete the unused helpers, join the boot
transcript with strings.Builder, and assert only the localized
verdict on the change panel.
Verification
- go run ./tools/repolint
- golangci-lint run ./internal/acp ./internal/cli ./internal/boot
- go test ./internal/acp ./internal/cli ./internal/boot
- desktop go test -c
- pnpm exec tsx src/__tests__/workspace-changes-errors.test.tsx
* fix(runtime): close standard execution review gaps
Problem:
- Capability routing could run before TaskPolicy was frozen.
- Atomic edits could finish without a mutation, and later low-risk edits could hide earlier high-risk changes.
- Explicit full verification did not force full planning and review.
- Legacy execution modes remained discoverable in CLI, desktop styling, docs, telemetry, and benchmark axes.
Root cause:
- Policy metadata and evidence checks were evaluated at inconsistent points in the turn lifecycle.
- Compatibility controls were registered directly on public surfaces.
- Benchmark and documentation cleanup stopped short of the last profile-specific paths.
Fix:
- Freeze policy before routing, enforce atomic mutation readiness, and ratchet risk across the complete turn ledger.
- Promote explicit full verification to full planning and forced review.
- Hide one-version compatibility parsing behind non-discoverable adapters and remove dead UI, telemetry, documentation, and benchmark profile surfaces.
- Add regression coverage for routing, readiness, risk, compatibility help, and standard benchmark commands.
Verification:
- go test -p 4 -timeout=8m ./...
- go vet ./...
- go run ./tools/repolint
- ./scripts/cache-guard.sh
- go test -race on release-critical packages and repeated plugin refresh coverage
- desktop Go vet/tests, frontend pnpm test:all/build, and SDK Go vet/tests/race
* test(desktop): tolerate slow Windows autosave
Problem:
- The Windows desktop job could fail while the asynchronous turn snapshot was still completing.
Root cause:
- Autosave assertions used a two-second deadline, shorter than legitimate Windows antivirus and indexer delays observed in CI.
Fix:
- Use a shared ten-second autosave test deadline without changing production retry behavior.
Verification:
- Autosave persistence test passed 100 consecutive runs.
- Autosave persistence test passed 20 race-enabled runs.
- Full desktop Go test suite passed.
* fix(desktop): reconcile partial trash before restore
Problem: A committed topic archive can leave a sidecar at the live path when Windows temporarily blocks one step of the multi-artifact move. An immediate restore then reports the leftover sidecar as an unrelated conflict.
Root cause: RestoreSession preflighted destination artifacts without honoring the durable cleanup-pending marker used by committed archive recovery.
Fix: Reconcile pending desktop cleanup before restore conflict checks and retain the cleanup-in-progress response when reconciliation cannot finish. Add a deterministic partial-move regression test.
Verification: desktop go test ./...; desktop go vet ./...; targeted restore tests x100; targeted race tests x30; repolint; git diff --check.
* test(plugin): synchronize no-op refresh cycle
Problem:
The no-op tool-list refresh test could observe cycleDone after a fast refresh had already completed, causing the race job to report that the cycle never started.
Root cause:
The controlled transport did not block tools/list in this test, so the refresh goroutine could finish and clear the cycle handle before the test captured it.
Fix:
Block the controlled tools/list call, capture the active cycle, then release the refresh and assert its no-op behavior.
Verification:
go test -race ./internal/plugin -run '^TestToolListRefreshNoOpPreservesAdapterGeneration$' -count=1000
go test -race ./internal/plugin/...
go run ./tools/repolint
golangci-lint run --timeout=5m ./internal/plugin/...
* fix(runtime): preserve adaptive risk across absolute paths
Problem
Deep absolute mutation paths could lose sensitive owner directories during risk classification, allowing a stale low-risk policy to survive the first write. Verification allowlists also recognized only test commands, so vet, lint, and typecheck could bypass an explicit user restriction.
Root cause
Risk classification truncated absolute paths without workspace context, and parent, child, and background evidence did not share a workspace-aware classifier. The task-policy gate maintained a narrower verifier list than the evidence subsystem.
Fix
Normalize paths lexically against the owning workspace while preserving deep sensitive owners and conservative out-of-workspace behavior. Propagate host-only workspace context through subagents and background task/fleet evidence without serializing it. Reuse the canonical verification classifier in the pre-execution policy gate.
Verification
- go test ./internal/evidence ./internal/taskpolicy ./internal/agent ./internal/jobs ./internal/control
- go test -race ./internal/evidence ./internal/agent ./internal/jobs ./internal/control
- go vet ./internal/evidence ./internal/taskpolicy ./internal/agent ./internal/jobs ./internal/control
- go run ./tools/repolint
- git diff --check
* fix(ci): align latest base contracts
Problem:
The latest main-v2 reasoning display mode was not represented in the startup settings contract, and the new path helper tripped the modernize linter.
Root cause:
PR #8732 added the expanded reasoning option after this branch was created, while the path helper retained a manual membership loop.
Fix:
Require the expanded reasoning option and locale key in the startup contract, and use slices.Contains for exact risk-path segment checks.
Verification:
pnpm exec tsx src/__tests__/startup-settings-contract.test.ts
pnpm test:all
golangci-lint run --timeout=5m ./...
wails generate module
* docs(release): prepare v1.25.2 notes
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* docs(release): prepare v1.25.2 notes
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
* docs(release): review v1.25.2 notes
Problem:
Regenerating the notes after the release-blocking test fix made the open notes PR self-referential, added github-actions[bot] as a contributor, and dropped reviewed user-facing changes and guide links.
Fix:
Restore the comprehensive reviewed bilingual record. The merged test-only PR does not change the product outcomes described by the notes.
Verification:
Validate the release catalog, run the release-note tests, render v1.25.2, and scan the rendered public text for private data.
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: SivanCola <[email protected]>
Co-authored-by: SivanCola <[email protected]>
Problem:
The full frontend suite rejected the newly added expanded reasoning display option because the startup settings contract still expected only three modes.
Root cause:
The product implementation and localized labels were updated, but the static settings-source assertion was not extended with the new mode.
Fix:
Include expanded in the expected reasoning display mode list.
Verification:
pnpm tsx src/__tests__/startup-settings-contract.test.ts
pnpm build
./scripts/cache-guard.sh
go test ./internal/plugin -run 'Tool|List|Name|Notification|Refresh' -count=5
* feat(desktop): add expanded reasoning display mode that stays open after completion / 新增思考完成后保持展开的持续展开模式
* fix(desktop): keep completed sub-agent reasoning expanded
Problem:
Expanded reasoning mode still collapsed a sub-agent ToolCard when the sub-agent left the reasoning phase, hiding the completed reasoning preview.
Root cause:
The parent card default-open state depended on an actively running reasoning phase even though the nested reasoning state remained expanded.
Fix:
Keep sub-agent cards with reasoning open in expanded mode while preserving an explicit user collapse. Add regression coverage for live completion, manual collapse, and restored completed history.
Verification:
- pnpm exec tsx src/__tests__/subagent-progress-card.test.tsx
- pnpm exec tsx src/__tests__/message-reasoning-panel.test.tsx
- pnpm typecheck
- pnpm lint:hooks
- git diff --check
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): keep expanded reasoning process folds open
Problem:
Completed inline reasoning still disappeared because the enclosing process fold auto-closed even when reasoning display mode was expanded.
Root cause:
The inner reasoning component knew about the expanded mode, but fold reconciliation only considered the independent process-fold preference.
Fix:
Track an expanded-reasoning pin per reasoning-bearing fold, preserve it across completion and history restore, and keep manual parent collapse authoritative. Tool-only folds remain unchanged.
Verification:
- pnpm exec tsx src/__tests__/transcript-rows.test.ts
- pnpm exec tsx src/__tests__/transcript-process-fold.test.ts
- pnpm exec tsx src/__tests__/message-reasoning-panel.test.tsx
- pnpm exec tsx src/__tests__/subagent-progress-card.test.tsx
- pnpm exec tsx src/__tests__/reasoning-display-preference.test.ts
- pnpm build
- Real-browser running, completion, collapse, and re-open regression
Co-authored-by: SivanCola <[email protected]>
---------
Co-authored-by: SivanCola <[email protected]>
* fix(agent): persist final readiness recovery
Problem:
Balanced turns could repeatedly surface an incomplete delivery check, and the recovery action was limited to the desktop process lifetime.
Root cause:
Readiness failure armed delivery-only in-memory state, while non-delivery profiles rejected the recovery path and lost the evidence ledger.
Fix:
Persist a provider-excluded one-shot readiness checkpoint, restore its bounded evidence exactly once, and expose the same recovery contract through Desktop, CLI, ACP, and HTTP. Preserve legacy bindings and localize the user-facing action.
Verification:
- go test ./...
- cd desktop && go test ./...
- cd desktop/frontend && pnpm typecheck
- cd desktop/frontend && pnpm exec tsx src/__tests__/send-failed.test.ts
- targeted go test -race recovery suite
- git diff --check
* fix(agent): release blocked readiness retries
Problem:
A required agent.before_start extension could block an explicitly prepared readiness recovery before the turn began, leaving the visible card pending but the live agent unable to prepare it again.
Root cause:
The one-shot preparation bit was cleared only by beginRunTurn, which is not reached when the pre-start interceptor aborts.
Fix:
Release the in-memory reservation on pre-start failure while leaving the durable pending marker intact, and add a deterministic regression test. Also normalize adjacent frontend indentation found during review.
Verification:
- focused final-readiness and extension tests
- desktop frontend typecheck
- git diff --check
* refactor(recovery): isolate readiness owners
Problem:
The initial fix added focused behavior and regression coverage to several already-large owner and test files, exceeding repository capacity ratchets.
Root cause:
Recovery checkpoint, transport, history, and test code remained embedded in broad legacy files instead of adjacent owner-specific units.
Fix:
Extract final-readiness provider, evidence, desktop, serve, controller, and test logic into cohesive files. Keep only unavoidable protocol and dispatch seams in the large owners, and update the nine affected ratchets with narrowly measured sub-one-percent source growth (the controller file shrinks overall).
Verification:
- go test ./...
- cd desktop && go test ./...
- targeted go test -race recovery suite
- cd desktop/frontend && pnpm typecheck
- go run ./tools/repolint
- git diff --check
* style(agent): modernize recovery scan
* fix(desktop): preserve prompts across session switches
Problem:
Pending ask and approval cards could disappear when a running session was switched, resumed, or reattached while prompt delivery overlapped frontend hydration.
Root cause:
Prompt replay was global or timed before response-driven resets, and detached runtime replay could race the frontend runtime-epoch fence.
Fix:
Add tab-scoped replay, reconcile and replay after Resume/OpenChannel hydration, preserve backend-confirmed prompt state during activation, and publish the transferred runtime epoch on the same sink FIFO before replay.
Verification:
Added deterministic tests for pre-response prompts, old/new epoch interleaving, A-B-A activation completion, scoped replay isolation, and runtime fence ordering. Full root and desktop Go suites, focused race tests, frontend typechecks, lint, and focused frontend suites pass.
Co-authored-by: myipanta <[email protected]>
* test(desktop): keep prompt race coverage within lint budgets
Problem:
The initial prompt-race patch added coverage to three files that already exceeded the repository size ceiling, causing repolint to reject their incremental growth.
Root cause:
The scoped replay and A-X-A regression cases were placed beside broad legacy suites, and the small replay bridge helper remained inside the oversized controller module.
Fix:
Move the Go scoped replay test and frontend replay helper into focused files, and relocate the A-X-A prompt race into the existing stale-navigation suite without changing production behavior.
Verification:
go run ./tools/repolint
go test ./... -count=1
cd desktop && go test . -count=1
cd desktop && go test -race . -run Test(RuntimeReattachFencesPendingAskBeforeReplay|ReplayPendingPromptsForTabDoesNotReplaySiblingAsk)$ -count=1
cd desktop/frontend && npx tsc --noEmit
cd desktop/frontend && npx tsc -p tsconfig.test.json --noEmit
cd desktop/frontend && npx eslint src/lib/useController.ts src/lib/promptReplay.ts src/__tests__/activate-topic-stale.test.tsx src/__tests__/tab-switch-hydration.test.tsx
---------
Co-authored-by: myipanta <[email protected]>
* fix(tool): complete_step returns terminal message on the final todo / 最后一个待办完成时 complete_step 返回终止消息，不再循环 (#8816)
* test(agent): guard terminal complete_step result
Problem:
The builtin tests cover final and non-final todo messages, but the real Agent path did not assert that host-advanced serial plans surface the terminal result.
Root cause:
The existing end-to-end test checked canonical todo completion and final readiness without inspecting the last complete_step tool result.
Fix:
Assert that the final complete_step result contains the terminal completion message and omits the continuation instruction.
Verification:
- go test ./internal/agent -run TestE2ESerialPlanHostAdvancesAndAllowsFinalAnswer -count=1
- go test ./internal/tool/builtin
- git diff --check
---------
Co-authored-by: jiangrenhang <[email protected]>
Co-authored-by: SivanCola <[email protected]>
Problem:
- Compacted recovery chains could fail strict prefix coverage and make ordinary topic loading fall back from the newest transcript to the short root session.
Root cause:
- The default-open path reused the conservative content proof intended for canonical adoption and cleanup, so a safe single lineage was treated like ambiguous forks after compaction rewrote message arrays.
Fix:
- Resolve a complete, monotonic, single-child parent chain to its unique leaf for display and continuation only.
- Keep adoption and cleanup gated by strict content coverage, reject forks, missing links, cycles, and turn or activity regressions, and route catalog, resume, and desktop retarget paths through the shared continuation decision.
Verification:
- go test ./... (clean source view)
- cd desktop && go test ./...
- focused go test -race for sessioncatalog and desktop continuation paths
- go vet ./... in both Go modules
- make lint (clean source view)
Co-authored-by: wuyong-exe <[email protected]>
* fix(desktop): recover transcript layout after hydration
Problem: Long conversations could scroll into a blank viewport after lazy history content expanded, hiding the previously visible rows until the user switched sessions.
Root cause: Content patches changed mounted row heights without invalidating React Virtuoso's cached size tree, and there was no logical anchor recovery or blank-viewport guard.
Fix: Track layout revisions, rebuild the size tree in a bounded batch, preserve manual and tail anchors, cancel stale cross-session callbacks, and add a blank-viewport self-heal with content-aware estimates.
Verification: pnpm test:transcript; pnpm typecheck; pnpm test:typecheck; pnpm build; go run ./tools/repolint; transcript-scroll-stability browser gate; git diff --check.
* perf(desktop): bound transcript height estimation
Problem: Estimating a very large hydrated transcript row allocated an array for every explicit line during React rendering.
Root cause: The estimator used String.split even when wrapped text length already guaranteed the configured height cap.
Fix: Return at the cap before scanning large text and count newlines with a bounded allocation-free loop for smaller content.
Verification: transcript layout recovery test; pnpm typecheck; pnpm test:typecheck; pnpm build; transcript-scroll-stability browser gate; go run ./tools/repolint; git diff --check.
* test(desktop): isolate transcript hydration benchmark
Problem: the delayed long-answer fixture changed the shared tools-session geometry and caused the existing selection benchmark to time out in CI.
Root cause: the hydration regression reused a fixture whose selection test assumes stable scroll distances, and the selection harness could not opt into a local system Chrome executable.
Fix: move delayed hydration to the small bench session, scope lazy content loading to its marker, restore the tools fixture, make the hydration navigation deterministic, and support an explicit browser executable.
Verification: pnpm test:transcript-browser; pnpm test:transcript; pnpm build; pnpm typecheck; pnpm test:typecheck; go run ./tools/repolint; git diff --check.
Problem:
Partial catalog scans could hide metadata-only conversations after the first page. A newer catalog event for one project could also discard a valid slower page for another project, and the stale-turn regression test no longer satisfied its TypeScript contract.
Root cause:
The continuity merge discarded the metadata cursor and ran only for the first page. ProjectTree compared every topic response against one global revision watermark. The watchdog test simulated a pre-turn state by adding a field outside the watchdog state contract.
Fix:
Use the catalog keyset ordering for mixed metadata pages, retain a per-project topic revision watermark, and exercise the real optimistic reducer state in the watchdog test. Add deterministic pagination and cross-project interleaving coverage.
Verification:
- pnpm test:all
- pnpm build
- cd desktop && go test ./...
- focused desktop and sessioncatalog race tests
- make lint and go vet ./... in a clean worktree
- git diff --check
* fix(control): skip remember/forget prompts in interactive YOLO / YOLO 下不再弹出记忆审批
Problem:
Interactive YOLO still showed the remember/forget approval card. Users
who chose YOLO expected no tool-approval interruption, but saving
feedback or updating an existing memory still hit "ask remember".
Root cause:
The interactive gate always injected Ask rules for remember/forget, and
YOLO bypass treated those tools as fresh-human decisions. Only a bounded
create-only project/reference remember could skip the prompt.
Fix:
Treat remember/forget as ordinary tool approvals in interactive YOLO:
do not inject the forced Ask rules, let YOLO pre-approve them, and drain
pending memory cards when switching to YOLO. Ask/Auto, deny rules, plan,
sandbox escape, config writes, Guardian/hooks, and headless YOLO stay on
the previous contract.
Verification:
- gofmt -l on the touched control files
- go vet ./internal/control/
- go test ./internal/control/ -count=1
- make lint
- git diff --check
* fix(control): align memory approval with Auto and YOLO
Problem:
Auto still interrupted remember/forget calls, and live approval-gate swaps could race with active tool checks.
Root cause:
Memory tools were forced into Ask under Auto, while Agent replaced an interface field without synchronization.
Fix:
Treat interactive memory calls as normal Auto fallback while preserving explicit ask/deny and headless boundaries. Keep YOLO's explicit-ask bypass, drain only eligible pending prompts, synchronize gate snapshots, and document the behavior. This adapts the core policy direction from #5049 by @myipanta.
Verification:
- go test ./...
- go vet ./internal/agent ./internal/control
- go test -race ./internal/agent -run TestAgentServicesGateSwapIsRaceSafe -count=1
- focused Auto, YOLO, and headless memory approval race tests
Co-authored-by: myipanta <[email protected]>
* test(agent): satisfy integer-range lint
Problem:
The gate race regression test used a classic integer loop rejected by the repository's intrange lint rule.
Root cause:
The test was written before running the full repository lint target.
Fix:
Use the Go 1.22 integer-range form while retaining the loop index used to alternate gate values.
Verification:
- make lint
- go test -race ./internal/agent -run TestAgentServicesGateSwapIsRaceSafe -count=1
- git diff --check
---------
Co-authored-by: myipanta <[email protected]>
* fix(agent): make planner research adaptive
Problem:
Planner depth imposed fixed two- and six-round research ceilings. Large or truncated tool results could exhaust the ceiling before the planner submitted a usable plan, causing an unnecessary executor fallback.
Root cause:
PlannerDecision coupled plan detail with MaxResearchRounds, while the finalization round blocked the structured submit_plan tool that carried the actual result.
Fix:
Remove the planner-specific round field and context override, let shared progress/context/task guards own runaway protection, and treat submit_plan as a package-private terminal tool. Safety-boundary finalization permits only a valid terminal submission and preserves fail-closed plan-only and approval routes.
Verification:
- go test ./...
- go test -race ./internal/agent ./internal/control
- go vet ./...
- go run ./tools/repolint
- git diff --check
* test(desktop): pin WebView2 COM apartment thread
Problem:
The Windows vendored WebView2 edge job timed out in TestCookieManager after environment creation reported that CoInitialize had not been called.
Root cause:
The test initialized its COM apartment on a Go goroutine without pinning that goroutine to its OS thread. Go could migrate it before WebView2 setup, leaving the calling thread without COM initialization.
Fix:
Lock the test goroutine to its OS thread for the complete COM and WebView2 lifecycle, then unlock it after teardown.
Verification:
- Go 1.26.6 Windows/amd64 edge test binary cross-compiled successfully
- go run ./tools/repolint
- git diff --check
* test(desktop): keep WebView2 calls on COM thread
Problem:
After pinning TestCookieManager itself, its t.Run sections still executed COM interface calls from child goroutines and failed with an object-thread affinity error.
Root cause:
testing.T.Run owns a separate goroutine, so apartment-bound WebView2 objects created by the parent test were used from a different OS thread.
Fix:
Execute the two logical cookie sections inline on the locked parent goroutine while retaining section names in verbose test logs.
Verification:
- Go 1.26.6 Windows/amd64 edge test binary cross-compiled successfully
- go run ./tools/repolint
- git diff --check
* fix(desktop): harden display performance boundaries
Problem:
Workspace tree scrolling synchronously rewrote the complete persisted state on every event, while Markdown images had no shared decoded-pixel budget and transcript regressions lacked a real-browser long-task gate.
Root cause:
High-frequency scroll state and durable persistence shared one write path. Image validation bounded encoded bytes but not decoded dimensions across local, data, and remote sources. The browser gate checked geometry without measuring main-thread stalls.
Fix:
Coalesce tree scroll persistence behind one frame and a trailing quiet period with lifecycle flushes. Validate supported raster image headers against the existing 10 MiB byte cap and a 40-megapixel decode budget. Stress 60 bidirectional scroll events in Chromium and enforce frame-gap and long-task budgets.
Verification:
- pnpm build
- pnpm test:workspace
- pnpm test:transcript
- pnpm test:transcript-browser
- pnpm test:remote
- pnpm test:performance
- go test ./...
- git diff --check
* fix(desktop): bind image validation and extract scroll flush
Problem:
- WorkspacePanel exceeded its repolint growth budget after adding scroll persistence lifecycle listeners.
- A local Markdown image could change after resolution, allowing the media response to bypass the byte or pixel budget while retaining the same token.
Root cause:
- The listener lifecycle and scroll callback lived directly in an already-ratcheted component.
- Media tokens re-statted paths and later checked only file identity, so the validated identity and the bytes sent to WebView were not one bounded contract.
Fix:
- Move workspace scroll persistence ownership into a focused hook without increasing the lint budget.
- Bind Markdown media tokens to the exact opened file identity and serve a bounded, MIME-checked, pixel-validated immutable snapshot.
- Add deterministic regressions for in-place byte/pixel changes and file replacement between authorization and serving.
Verification:
- go run ./tools/repolint
- cd desktop && go test ./...
- cd desktop && go test -race . -run 'TestMarkdownMediaToken|TestResolveMarkdown|TestRemoteMarkdownImage' -count=1
- cd desktop && go vet ./...
- cd desktop/frontend && pnpm build
- cd desktop/frontend && pnpm test
- cd desktop/frontend && pnpm test:workspace
- cd desktop/frontend && pnpm test:motion
- cd desktop/frontend && pnpm test:transcript-browser
* test(desktop): make media identity replacement deterministic
Problem:
- The WebKitGTK CI job failed because the new media identity regression assumed deleting and recreating a path always allocates a different inode.
Root cause:
- Linux may immediately reuse the inode released by the deleted fixture, making os.SameFile legitimately report the recreated path as the same identity.
Fix:
- Create and verify a distinct replacement file while the authorized file still exists, then move that replacement into the authorized path.
Verification:
- cd desktop && go test . -run 'TestMarkdownMediaTokenBindsAuthorizedIdentity$' -count=100
- cd desktop && go test . -run 'TestMarkdownMediaToken|TestResolveMarkdown|TestRemoteMarkdownImage' -count=1
- go run ./tools/repolint
- git diff --check
* fix(mcp): refresh tools after list change notifications
* fix(mcp): bound dynamic tool catalog refreshes
Problem: Tool-list notifications could create an unbounded refresh loop, while catalog and execution locks allowed remote MCP calls to stall status reads. Failed refreshes also left adapters executable with stale safety metadata.
Root cause: The refresh worker drained a self-replenishing pending bit, and toolsMu covered both remote I/O and adapter dispatch. Notifications were accepted without checking the advertised listChanged capability.
Fix: Coalesce notifications into a debounced two-attempt cycle, publish immutable fingerprinted catalogs with generations, separate fetch/status/dispatch lock domains, gate notification support on initialize capabilities, and fail closed while a catalog is stale.
Verification: go test ./... -count=1; go test -race ./internal/plugin ./internal/agent -count=1; go vet ./...; go run ./tools/repolint; git diff --check.
* fix(mcp): preserve dynamic catalog convergence
Problem: A tool catalog refreshed before the session runtime subscribed could leave stale adapters in its registry. Repeated notifications could also exhaust the two-attempt cycle, and refreshes ignored configured timeout budgets.
Root cause: Host subscriptions did not replay current catalogs, the refresh worker stopped with a dirty revision after its second successful list, and it imposed the five-second interactive startup wait on background tools/list calls.
Fix: Replay existing catalogs before later subscriber deliveries, keep dirty revisions converging under capped exponential backoff, and bound refreshes by the stricter resolved startup or call timeout.
Verification: go test ./... -count=1; go test -race ./internal/plugin ./internal/agent -count=1; go vet ./...; go run ./tools/repolint; git diff --check.
* fix(mcp): harden dynamic catalog refresh lifecycle
Problem: A disabled session could retain replayed shared-Host MCP adapters, generic registry aliases bypassed runtime authorization, catalog resolution could deadlock with a pending refresh writer, and a self-notifying server could refresh forever.
Root cause: Runtime inventory changes did not suspend registry prefixes, generic registry routing skipped MCP identity binding, resolve held dispatchMu across a re-entrant catalog callback, and refresh convergence had no attempt ceiling.
Fix: Synchronize registry prefix suspension with runtime lifecycle, bind every registry-backed MCP adapter to the current runtime, release the dispatch lease before catalog lookup, and cap each refresh cycle while preserving fail-closed user-driven recovery.
Verification: go test ./internal/plugin ./internal/agent -count=1; go test -race ./internal/plugin ./internal/agent -count=1; go test ./... -count=1; go vet ./...; go run ./tools/repolint; git diff --check.
* fix(mcp): satisfy refresh loop lint
Problem:
CI rejects the newly added bounded refresh loops under the Go 1.22 intrange rule.
Root cause:
The loops used the classic counter form even though the repository requires integer ranges.
Fix:
Use integer ranges while preserving the four-attempt refresh behavior and test assertions.
Verification:
- go test ./internal/plugin -run 'TestToolListRefresh' -count=1
- go test ./internal/plugin ./internal/agent -count=1
- go test -race ./internal/plugin ./internal/agent -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- golangci-lint run ./...
- git diff --check
* test(mcp): drain startup cache before adapter mutation
Problem:
The reader safety-drift test can mutate a remote adapter while Start's detached schema-cache snapshot is still reading it, causing a race on the latest base merge tree.
Root cause:
The test models metadata drift by directly changing the adapter, but did not first wait for startup persistence to finish.
Fix:
Drain the host's startup background writes before the test-only adapter mutation.
Verification:
- go test -race ./internal/plugin -run '^TestReaderIntentRefusesDispatchAfterSafetyDrift$' -count=10
- go test -race ./internal/plugin ./internal/agent -count=1
- go test ./internal/plugin ./internal/agent -count=1
- go test ./... -count=1
- go vet ./...
- go run ./tools/repolint
- golangci-lint run ./...
- git diff --check
* test(agent): stabilize background fleet lifecycle assertion
Problem:
The CI race job can observe no running fleet job in TestBackgroundFleetProgressLifecycleUsesStableIDs even though registration and completion both work correctly.
Root cause:
The test released both blocked workers before inspecting RunningForSession, allowing the background job to finish and disappear first under runner load.
Fix:
Assert registration while the provider is still blocked, then release the workers and verify terminal completion.
Verification:
- GOTOOLCHAIN=go1.26.6 go test -race ./internal/agent -run '^TestBackgroundFleetProgressLifecycleUsesStableIDs$' -count=500
- GOTOOLCHAIN=go1.26.6 go test -race ./internal/agent -count=1
- GOTOOLCHAIN=go1.26.6 go test ./internal/agent -count=1
- go run ./tools/repolint
- golangci-lint run ./...
- git diff --check
---------
Co-authored-by: SivanCola <[email protected]>
* fix(desktop): stop session-switch markdown churn
Problem:
Switching into Markdown-heavy histories could leave the renderer consuming CPU long after activation.
Root cause:
MarkdownHistory forced one idle React/layout commit per 24 blocks until the whole document was mounted, so a 2,647-block answer generated about 110 post-switch commits.
Fix:
Keep a parse-result-keyed tail window and prepend older blocks only when its viewport sentinel is reached. Add deterministic lifecycle coverage and a settled-renderer CPU benchmark gate.
Verification:
- pnpm exec tsx src/__tests__/markdown-history.test.tsx
- pnpm test:transcript
- pnpm typecheck
- pnpm build
- Chromium 20-switch benchmark: settled renderer 1.3%, heap +1.3 MiB, DOM +0%
- go run ./tools/repolint
- git diff --check
* fix(desktop): bound markdown history windows
Problem:
The viewport-driven Markdown tail stopped automatic mounting, but scrolling through a giant answer could still retain every visited DOM and JSX block, while window shifts had no explicit scroll-anchor contract.
Root cause:
The window tracked only its older start, never evicted the opposite edge, and cached rendered nodes for the lifetime of the parsed document.
Fix:
Use a 216-block two-sided window with older and newer sentinels, preserve the active boundary through measured scroll compensation, evict JSX outside the window, and serialize simultaneous edge callbacks.
Verification:
- focused Markdown tests: 40 passed
- transcript tests: 28 passed
- pnpm typecheck and lint:hooks
- pnpm build
- Chromium benchmark: settled renderer 1.3%, heap +1.4 MiB, DOM +0%
- go run ./tools/repolint
- git diff --check
* fix(desktop): align the markdown leading anchor
Problem:
The older-edge scroll compensation measured the top of a one-pixel sentinel rather than the exact boundary of the previously leading Markdown block.
Root cause:
The older sentinel precedes the stable block boundary, while the newer sentinel already begins at its stable boundary.
Fix:
Use the older sentinel bottom and the newer sentinel top when preserving the active boundary, and model the sentinel height in the regression test.
Verification:
- focused Markdown tests: 40 passed
- pnpm typecheck
- pnpm lint:hooks
- git diff --check
* Fix desktop turn admission after completion
Problem:
Desktop could render TurnDone before the controller finished fan-out, so a fast Goal or message submit failed with "turn already running".
Root cause:
The Wails event bridge is asynchronous while controller admission stays closed through TurnDone fan-out. Desktop treated every Running status as a genuine active turn and had no exact finishing-boundary signal.
Fix:
Expose a controller-owned finishing boundary and make desktop admission release its locks, wait for that boundary, re-resolve the tab and controller, and retry. Preserve immediate rejection for genuinely running turns.
Verification:
- go test ./...
- cd desktop && go test ./...
- focused go test -race for controller and desktop admission
- go vet ./internal/control
- cd desktop && go vet ./...
- go run ./tools/repolint
- git diff --check
* Close the finishing-boundary status race
Problem:
Desktop admission could still report a completed turn as running if TurnDone fan-out ended between the runtime-status read and finishing-boundary lookup.
Root cause:
Those two controller observations are intentionally separate lock acquisitions, so the boundary can disappear after the first Running result.
Fix:
When a finishing-aware controller no longer exposes the boundary, re-check RuntimeStatus before reporting busy and retry if it is now idle.
Verification:
- cd desktop && go test ./...
- focused desktop go test -race including the expired-boundary interleaving
- cd desktop && go vet ./...
- go run ./tools/repolint
- git diff --check
Problem:
When the desktop missed an entire agent event stream, the visible conversation could keep an empty assistant placeholder spinning until the user switched tabs.
Root cause:
The stale-turn watchdog required prior turn activity and stopped after one reconciliation, so a lost turn_started event never armed recovery and a still-running first probe never retried.
Fix:
Treat optimistic submit time as liveness evidence, reset activity per turn, re-arm lightweight runtime reconciliation while the backend remains active, and hydrate persisted history once it becomes idle. Add deterministic dropped-stream coverage.
Verification:
- focused controller watchdog and adjacent runtime tests
- pnpm typecheck
- pnpm lint:hooks
- pnpm build
- go run ./tools/repolint
- git diff --check
Problem:
Pinned conversations disappeared after restart until users expanded their owning project folders.
Root cause:
The startup project snapshot returned folder shells only, while the pinned section was derived from topic pages that loaded only for expanded folders.
Fix:
Project lightweight pinned-topic shells in the startup snapshot, reconcile them with resident topic pages, preserve off-page pins, and keep the legacy full-tree wrapper duplicate-free.
Verification:
- cd desktop && go test ./...
- cd desktop && go vet ./...
- focused desktop race tests
- frontend project-tree tests, typecheck, lint, production build, and browser DOM interaction
- go run ./tools/repolint
- git diff --check
* fix(desktop): stabilize display ownership and recovery
Problem:
Desktop conversations could flicker, jump, clip content, retain stale workspace data, hide partially indexed sessions, flash background command windows, and fail to recover cleanly from WebView2 renderer failures.
Root cause:
Scroll position, workspace freshness, catalog completeness, process visibility, DPI synchronization, and WebView2 recovery each had multiple competing owners or treated incomplete refresh state as empty authoritative state.
Fix:
Centralize transcript scrolling in a deterministic Virtuoso coordinator; add keyed stale-while-revalidate workspace resources, responsive overlay layout, bounded code views, and secure Markdown media resolution; expose partial catalog projections with per-directory completeness and authoritative persist indexing; and add hidden-by-default Windows commands plus a rebased WebView2 integration with single-owner DPI synchronization and tiered crash recovery.
Verification:
- pnpm test:all
- pnpm test:transcript-browser
- pnpm build
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/sessioncatalog ./internal/history ./internal/control ./internal/proc
- cd desktop && go test -race . -count=1
- go run ./tools/repolint
- Windows amd64 cross-compilation for desktop, proc, update-helper, windows-resource, and WebView2 edge
Co-authored-by: ttmouse <[email protected]>
* fix(desktop): close display stability review gaps
Problem:
The initial stability integration still cleared restored workspace selections, replaced working-tree data on refresh failures, allowed background command constructors outside desktop/ to bypass the Windows hidden-window policy, and could serve a media token after its authorized file was replaced. Critical renderer failures could also be dropped behind auxiliary WebView2 diagnostics, while cold Windows CI combined two slow suites under one timeout.
Root cause:
Workspace refresh and project restoration still had overlapping reset paths; the process gate covered only the desktop directory; media tokens were bound only to a path; the diagnostics queue treated recovery and telemetry equally; and the Windows job shared one aggregate test budget.
Fix:
Extract a keyed workspace-changes SWR hook and preserve per-project selections, bind media tokens to the authorized file identity with restrictive response headers, extend proc constructors and static enforcement across desktop-used internal packages, preserve hidden flags for batch commands, prioritize renderer recovery, fix upstream formatting/lint findings, and split the Windows vendor test budget without skipping coverage.
Verification:
- go test ./...
- cd desktop && go test ./...
- root concurrency-package race suite
- cd desktop && go test -race ./...
- golangci-lint on native, Linux, and Windows targets
- pnpm test:workspace
- pnpm test:transcript
- pnpm test:all
- pnpm build
- go run ./tools/repolint
- actionlint .github/workflows/ci.yml
- Windows cross-compilation for desktop, hook, and WebView2 edge tests
* chore(security): document intentional command boundary
* chore(deps): update Go toolchain to 1.26.6
---------
Co-authored-by: ttmouse <[email protected]>
* fix(desktop): keep background conversations visible
Problem:
Running conversations disappeared from the project tree after users switched to another workspace, even though the detached runtime kept working.
Root cause:
Visible-to-detached runtime ownership changes emitted only the legacy tree event. The current frontend listens to the v2 catalog stream, and a runtime-only transition does not necessarily advance the catalog revision.
Fix:
Broadcast a v2 runtime invalidation while preserving the legacy event, and make runtime overlays bypass stale catalog revision filtering. Add deterministic cross-workspace and event-contract regressions.
Verification:
- cd desktop && go test ./...
- focused desktop go test -race coverage
- frontend project-tree runtime tests (76/76)
- frontend typecheck and React Hooks lint
* test(desktop): keep runtime regression within lint budgets
Problem:
The project-tree regression coverage made two already-large desktop files exceed repository lint ratchets.
Root cause:
The cross-workspace test lived in topic_activation_test.go, and the runtime event comment exceeded the allowed local essay budget.
Fix:
Move the unchanged regression into a dedicated test file and compact the explanatory comment without raising any baseline.
Verification:
- go run ./tools/repolint
- go test ./... in desktop
- focused desktop go test -race
- go vet ./... in desktop
- project-tree frontend tests, typecheck, and hooks lint
- git diff --check
* refactor(desktop): separate runtime task projection
Problem:
Running conversations could disappear from the project tree after switching folders, and each runtime lifecycle event reloaded every expanded catalog folder.
Root cause:
Process-local runtime ownership was mixed into the disposable session catalog projection and shared its revision/invalidation path.
Fix:
Introduce an independently versioned replace-all runtime snapshot keyed by stable topic identity, subscribe before the initial read, merge it in memory, and retain a tagged legacy event for one-release frontend compatibility.
Verification:
- go test ./...
- go test -race ./...
- pnpm test
- pnpm build
- runtime snapshot and JSON benchmarks at 100 active tasks
* perf(desktop): lazy-load project runtime projection
Problem:
The runtime projection plus the latest main-v2 sidebar changes exceeded the existing first-paint JavaScript budget.
Root cause:
ProjectTree and its runtime overlay were part of the unconditional App entry even though the sidebar can reconcile immediately after mount.
Fix:
Load ProjectTree and its runtime projection as local asynchronous chunks, preserving subscribe-before-snapshot ordering and the replace-all revision gate.
Verification:
- pnpm build (411.4 KiB / 424.0 KiB initial gzip)
- project tree runtime and race suites
- bundle contract suite
- pnpm typecheck
- pnpm lint:hooks
* refactor(desktop): isolate project runtime state
Problem:
The complete runtime projection passed semantic tests but exceeded repository structure budgets in historical App, ProjectTree, catalog, tabs, and test files.
Root cause:
Runtime state, lifecycle publication, React subscription wiring, and performance-only benchmark scaffolding were added at existing file boundaries.
Fix:
Extract the Go runtime projection and thin lifecycle wrappers, extract the React subscription hook and projection regression suite, keep the legacy filter inline, and remove benchmark-only scaffolding after recording measurements.
Verification:
- go run ./tools/repolint
- golangci-lint run --timeout=5m ./...
- cd desktop && go test ./...
- cd desktop && go test -race ./...
- frontend typecheck and hooks lint
- project-tree runtime/race/bundle suites
- pnpm build (411.4 KiB / 424.0 KiB)
* fix(desktop): scope multi-session runtime status
* fix(desktop): normalize detached runtime roots
* fix(desktop): make runtime overlay replace all state
* fix(desktop): refresh project topic sorting
Problem:
Changing the conversation sort mode did not reload expanded project pages, so rows only moved into the correct position after the folder was clicked. Creation-time sorting was also limited to the currently loaded page.
Root cause:
The selected sort mode was absent from the Wails catalog request, the backend always paginated by last activity, and delayed frontend requests could apply stale pages during a sort transition.
Fix:
Carry the sort mode through the desktop and catalog boundaries, use matching keyset ordering and cursors, and synchronously invalidate stale loads and pagination before refreshing expanded folders.
Verification:
- go test ./...
- cd desktop && go test ./...
- go test -race ./internal/sessioncatalog
- cd desktop && go test -race . -run 'TestListProjectTopicsHonorsConversationSortMode|TestListProjectTopicsDoesNotDuplicateIndexedLiveTab'
- pnpm build
- pnpm exec tsx src/__tests__/project-tree-runtime.test.ts
- browser click verification for created/updated sorting
* refactor: keep sorting changes within size budgets
Extract the existing project-tree preferences, sort-runtime cases, and catalog sort helpers so the fix does not increase repository lint baselines.
* test(desktop): stabilize new-topic ordering assertions
Wait for the millisecond clock to advance before creating the second topic so the tests exercise distinct creation times instead of random topic-ID tie breaking.
* refactor(desktop): avoid project sort module overhead
Keep project-tree preference helpers in the existing topic utility module so the extracted code satisfies both source-size and initial-bundle budgets.
* perf(desktop): trim project sort refresh overhead
* build(desktop): retain sort refresh bundle headroom
* fix(desktop): keep project topics visible during archive
Problem:
Archiving one conversation temporarily blanked every sibling row in its project folder, and overlapping asynchronous loads or archive requests could repaint stale state.
Root cause:
The mutation refresh discarded loaded children before the replacement page arrived. In-flight topic pages were not fenced at archive start, and frontend archive calls could overlap despite the backend mutation lock.
Fix:
Preserve painted project children, optimistically tombstone only the target conversation, invalidate stale loads, serialize archive mutations, and await the canonical reload of the affected folder before clearing pending state.
Verification:
- project-tree archive race regression suite
- project-tree runtime and shell race suites
- frontend production build and bundle budgets
* refactor(desktop): extract project tree archive flow
Problem:
The initial archive fix pushed ProjectTree.tsx beyond its repository file-size budget and modified the same long import line as related PR #8806.
Root cause:
Archive mutation orchestration and targeted reload selection still lived in the oversized view component instead of the existing archive owner module.
Fix:
Move archive coordination and reload selection into projectTreeArchive.ts, keep the ProjectTree import surface compatible with #8806, update the regression wiring, and ratchet the initial JavaScript gzip budget by 0.25 KiB for the measured 155-byte ownership cost.
Verification:
- archive race, project-tree runtime, and shell-race suites
- TypeScript and React Hooks lint
- repository lint
- production build and bundle budgets
Problem
ACP session status exposed prompt and cache partition fields without an authoritative total. Hosts that summed every token field double-counted cached input, while reasoning tokens are also a completion subset.
Fix
Add totalTokens to the schema-v1 usage payload as promptTokens + completionTokens. Keep the cache and reasoning breakdown unchanged, and derive the value at wire time so restored legacy snapshots receive the same correct total.
Verification
- go test -count=1 ./internal/acp
- go vet ./internal/acp
- go run ./tools/repolint
Refs #8668
Problem:
Short interrupted transcripts could show a jump-to-bottom control even though the viewport had no physical scroll range, so clicking it appeared to do nothing.
Root cause:
Scroll-intent handlers could release tail-follow on wheel, touch, keyboard, middle-button, or nested-scroll input without first confirming that the transcript could actually scroll. The button also trusted logical state alone.
Fix:
Centralize physical scroll-range detection, restore tail-follow when a false at-bottom signal arrives for a non-scrollable transcript, guard every manual-scroll intent path, and render the jump control only when a real native range exists.
Verification:
- pnpm test:transcript
- pnpm test:typecheck
- pnpm typecheck
- pnpm build
- Real-browser short and long transcript interaction checks in Microsoft Edge
- go run ./tools/repolint
- git diff --check
* Fix blank project creation in workbench
Problem:
The workbench "New blank project" entry was permanently disabled.
Root cause:
The workbench layout migration shipped the command as a placeholder without a directory-creation or navigation flow.
Fix:
Add native parent-folder selection, atomic backend directory creation with strict single-component validation, an accessible lazy-loaded dialog, and reuse the existing workspace switch path for registration. Propagate switch failures and retain the created path for safe retry.
Verification:
- cd desktop && go test .
- cd desktop && go test -race . -run "TestCreateBlankProject|TestSwitchWorkspaceRegistersDefaultTopicInProjectTree" -count=1
- pnpm exec tsx src/__tests__/blank-project-dialog.test.tsx
- pnpm exec tsx src/__tests__/project-tree-runtime.test.ts
- pnpm typecheck
- pnpm test:typecheck
- pnpm build
* Refactor blank project modules for repo standards
Problem:
Repository lint rejected growth in four already oversized source and test files.
Root cause:
The first implementation placed new backend logic, tests, bridge methods, and project creation state directly in ratcheted legacy files.
Fix:
Extract the blank-project backend, tests, browser bridge, and project-creation state into focused modules while keeping the public behavior unchanged.
Verification:
- go run ./tools/repolint
- go test -race ./desktop -run "TestCreateBlankProject|TestSwitchWorkspaceRegistersDefaultTopicInProjectTree" -count=1
- pnpm exec tsx src/__tests__/blank-project-dialog.test.tsx
- pnpm exec tsx src/__tests__/project-tree-runtime.test.ts
- pnpm typecheck
- pnpm test:typecheck
- pnpm build
Summary:
Regenerate the reviewed v1.25.1 notes against current main-v2 after the
transcript-selection bench stabilization landed.
Verification:
- Prepare-release run 31694889160 succeeded
- Required Notes PR checks are green
- Catalog status is reviewed; github-actions[bot] was removed from contributors
- Privacy scan found no personal data
Problem:
Linux desktop CI failed the transcript-selection Playwright bench on
unrelated PRs. Two runs hit different assertions: no visible selectable
message after jump-to-bottom, then downward drag never left native mode
after an 8s wait.
Root cause:
The bench assigned scrollTop against a pinned tail-follow window of a
tool-dense fixture, so user rows were not mounted. The downward half
then wheeled in place and slept 8s; edge-scroll only runs after logical
promotion, so a still-native gesture could never recover.
Fix:
Wheel off the pinned tail until a mid-text "bench turn N" row is visible.
Reuse that same start/target contract for the downward drag instead of a
fixed sleep. Snapshot the virtual row bound after the start row is found.
Verification:
- node --check desktop/frontend/bench/transcript-selection.mjs
- CI=true node desktop/frontend/bench/transcript-selection.mjs (3/3)
- CI=true node desktop/frontend/bench/transcript-scroll-stability.mjs
Summary:
Merge the reviewed bilingual v1.25.1 release record generated from current main-v2.
Verification:
- Notes workflow 31689340327 succeeded
- Close/reopen fired required PR checks; Release notes validate and required CI checks are green
- Catalog status is reviewed, citations are grounded, and a privacy scan found no personal data
* fix(desktop): finish history transcript scrolls at the native bottom
Problem:
Opening a historical desktop session left the last answer rows covered.
Mouse wheel and the jump-to-bottom control could not reach them; dragging
the native scrollbar could.
Root cause:
Tail-follow and jump-bottom used Virtuoso LAST/autoscroll. After history
rows grew, LAST stopped short of the native extent and a later autoscroll
overwrote a native MAX scroll. Wheel-down while pinned did not release, so
followGrowingTail snapped back to that false tail. Native thumb drag called
releaseTailFollow first, which is why only that path worked.
Fix:
Treat a leftover native gap after LAST as an undershoot, not as the reader
leaving. Jump-bottom, tail-follow, and downward wheel/key/nested-scroll
finish at scrollHeight-clientHeight and remasure mounted rows once when
needed. Only a clear upward leave during a bottom request unpins.
Verification:
- pnpm exec tsx src/__tests__/transcript-scroll-release.test.ts
- pnpm test:transcript
* fix(desktop): remeasure before native tail snap
Problem:
Jump-to-bottom still missed large last rows. Virtuoso LAST after a native
snap pulled scrollTop back from the physical max. A drop over 160px was
treated as the reader leaving, and remeasure never ran because the native
write already reported at-bottom.
Root cause:
shouldRelease compared only the scrollTop delta, so a LAST overwrite from
the native max looked like an upward drag. finishTail remeasured only when
snapToNativeBottom failed; native scrollHeight already included the extra
pixels, so itemSize never changed and the next LAST overwrote the snap.
Fix:
Do not unpin when the previous top was already the native max. Remeasure
mounted rows once per tail command even after a successful native snap,
then finish at scrollHeight-clientHeight. The 500ms timer still completes
the tail if LAST briefly unpinned. Stop issuing autoscrollToBottom before
that native finish.
Verification:
- pnpm exec tsx src/__tests__/transcript-scroll-release.test.ts
- pnpm test:transcript
* fix(desktop): keep jump-bottom alive through LAST and resize
Problem:
A native snap reported atBottom=true and cancelled the 500ms jump window,
so a later LAST overwrite unpinned with nobody finishing the tail. Last-row
growth made "already at native max" compare against the new extent, so a
>160px LAST pullback still looked like a leave. The desktop scroll bench
then timed out after reopening the workspace dock.
Root cause:
clearBottomRequest ran on atBottom=true. shouldRelease used the current
scrollHeight for nativeMax. followGrowingTail skipped autoscrollToBottom,
which the pinned viewport-resize path still needs.
Fix:
Leave the jump window open until the timer or an explicit release. Compare
previousScrollTop to the native max from pinned metrics. Restore
autoscrollToBottom on growth/resize, then remasure and snap. Jump-bottom
still does not start that LAST listener itself.
Verification:
- pnpm exec tsx src/__tests__/transcript-scroll-release.test.ts
- pnpm test:transcript
* fix(desktop): finish pinned LAST pullback after the jump window
Problem:
A native snap followed by Virtuoso LAST still unpinned once the 500ms jump
window closed. followGrowingTail never opens that window, and the timer
clears it before the force snap. desktop CI also failed prepend compensation
with delta 0.
Root cause:
atBottom=false only finished the tail while bottomRequest was active.
Afterwards shouldKeepPinned was false (height unchanged, scrollTop dropped)
and the hook went manual. The prepend harness wrote scrollTop without
releasing the pin, so the same path could snap back and hide firstItemIndex
compensation.
Fix:
Treat atBottom=false as LAST undershoot whenever the reader is still pinned
or a jump request is open. Wheel/key/thumb already call releaseTailFollow.
The prepend test now wheel-ups to leave the tail before measuring delta.
Verification:
- pnpm exec tsx src/__tests__/transcript-scroll-release.test.ts
- pnpm exec tsx src/__tests__/transcript-virtualization.test.tsx
- pnpm test:transcript
* fix(desktop): do not force-snap after a programmatic leave
Problem:
Jump-bottom then dragging the creation-mode custom scrollbar within 500ms
yanked the reader back to the native tail. The old timer derived pin from
native distance, so a leave stayed manual.
Root cause:
writeOffset unpinned custom-scrollbar/rewind without clearing the jump
window. The timer then force-finished whenever the request was still
active, even after the reader had left. After pinned LAST undershoot
finishes immediately, wasActive && !pinned is no longer a LAST case.
Fix:
Cancel the jump window on unpinning writeOffset owners. Finish from the
timer only while still pinned, without force. Keep selection-edge-scroll
from cancelling an open jump.
Verification:
- pnpm exec tsx src/__tests__/transcript-scroll-release.test.ts
- pnpm exec tsx src/__tests__/transcript-virtualization.test.tsx
- pnpm test:transcript
* fix(desktop): remasure a tail command only once
Problem:
A successful native snap cleared remasureForTailRef, so every later
followGrowingTail remasured mounted rows. Streaming and list-height
ticks then restarted the LAST vs native-max fight. Windows CI also
failed the 423.5 KiB initial JS gzip gate that the previous head
already sat on.
Root cause:
applySnap treated a finished snap as a new command. followGrowingTail
always finished through the remasure path. The gzip gate had no
headroom after the leave-cancel helpers.
Fix:
Keep the remasure flag until beginBottomRequest or reset. Growth
finishes with allowRemeasure=false and only snaps. Raise the initial
JS gzip gate from 423.5 KiB to 424.0 KiB (0.12%). Drop the restating
atBottom=false comment.
Verification:
- pnpm exec tsx src/__tests__/transcript-scroll-release.test.ts
- pnpm exec tsx src/__tests__/transcript-virtualization.test.tsx
- pnpm test:transcript
Problem: Official DeepSeek V4 Pro high thinking was aborted after ~128KB of
hidden reasoning (~32K estimated tokens). Users saw two English warnings and
no answer. The 16/32/64K auto max_output_tokens ladder is tighter than the
documented 384K completion ceiling.
Root cause: Reasonix mapped effort to a homemade output budget and cancelled
the provider stream when stored reasoning exceeded 128KB. Official docs cap
output at 384K, control thinking depth with effort only, and ignore Anthropic
budget_tokens. Chat/Responses may omit max_output_tokens; Anthropic requires
max_tokens.
Fix: On official DeepSeek, omit max_tokens / max_output_tokens so the server
uses 384K, and send 384000 on Anthropic. Stop aborting turns for long
reasoning; only cap the stored buffer. Keep MiMo and native Anthropic on
their existing defaults. Update SPEC/GUIDE. Accept a locally attributable
repolint file-size ratchet (+10 file-size, +2 test-file-size; <0.01%).
Verification: make lint; go test ./internal/provider/openai/
./internal/provider/responses/ ./internal/provider/anthropic/
./internal/agent/ ./internal/config/ ./internal/boot/
./internal/tool/builtin/
* fix(desktop): keep archive fallback blanks out of the sidebar
Problem
Clicking the sidebar archive control created one or more visible
"新的会话" rows. Opening a real conversation then removed them.
Root cause
1.24 session catalog plus shell-only ProjectTree refreshes listed leftover
transient blanks that 1.23 hid. Archive still mints an unindexed writable
fallback, but unused empty session files and stale loaded children leaked
into the ordinary topic list.
Fix
- Discard unused empty or unindexed default-title session files after
archive, keeping the current writable fallback.
- Hide unindexed empty default-title topics from the ordinary catalog tree.
- Remove the archived row immediately and reload topic pages after TrashTopic.
Verification
- go run ./tools/repolint
- cd desktop && go test . -count=1 -run 'TestTrashTopicFallbackStaysOffCatalogSidebar|TestTrashTopicFallbackCreatesUnindexedBlank|TestTrashTopicMovesOpenSessionToTrash|TestCreateTopicAppearsFirstInProjectTree'
- cd desktop && go vet .
- cd desktop/frontend && pnpm exec tsx src/__tests__/project-tree-runtime.test.ts
- cd desktop/frontend && pnpm exec tsc --noEmit
- git diff --check
* fix(desktop): sweep only zero-byte leftover archive blanks
Problem
Archive cleanup classified unused blanks with sessionPathHasNoContent,
which LoadSession-decodes every non-empty .jsonl in the session directory
on the synchronous TrashTopic path.
Root cause
HasContent() is a full transcript probe. Leftover archive fallbacks are
always zero-byte files, so decoding siblings was unnecessary and could
stall large projects.
Fix
Treat only size-zero session files as unused transient blanks. Keep any
non-empty sibling, including system-only transcripts.
Verification
- cd desktop && go test . -count=1 -run 'TestUnusedTransientBlankSessionOnlyMatchesZeroByteFiles|TestTrashTopicFallbackStaysOffCatalogSidebar|TestTrashTopicFallbackCreatesUnindexedBlank|TestTrashTopicMovesOpenSessionToTrash|TestCreateTopicAppearsFirstInProjectTree'
- cd desktop && go vet .
- go run ./tools/repolint
- git diff --check
* test(desktop): create zero-byte archive leftovers without holding them open
Problem
Windows desktop-windows CI failed TestTrashTopicFallbackStaysOffCatalogSidebar
and TestUnusedTransientBlankSessionOnlyMatchesZeroByteFiles: leftover 0-byte
files were not deleted, and TempDir cleanup hit "file is being used by
another process".
Root cause
The tests used os.Create and dropped the handle without Close. On Windows
that keeps a sharing lock, so archive sweep cannot remove the leftover and
test cleanup cannot unlink it.
Fix
Write empty fixtures with os.WriteFile(..., nil) so the file is closed
before TrashTopic or TempDir cleanup.
Verification
- cd desktop && go test . -count=1 -run 'TestUnusedTransientBlankSessionOnlyMatchesZeroByteFiles|TestTrashTopicFallbackStaysOffCatalogSidebar|TestTrashTopicFallbackCreatesUnindexedBlank'
- go run ./tools/repolint
- git diff --check
* fix(desktop): persist completed todo dismissals on the session / 关闭待办写入会话文件
Problem
After a completed todo shelf was closed, each Windows desktop upgrade
showed the same list again. Asking the agent to "fix" it only hid the
shelf until the next upgrade. See #8755.
Root cause
Close lived only in WebView2 localStorage, keyed by session path. An
upgrade remount (parent to covering leaf) or a fresh WebView2 profile
missed that key. Incomplete reconstructions also bypass dismissal, so
the old half of a recovered conversation always popped the list.
Fix
- Store completed-list fingerprints on the session sidecar
- Copy them to the parent and covering leaf, and never drop them on
unrelated meta writes
- Hide a completed shelf when the sidecar or a remounted localStorage
fingerprint matches; unfinished lists still always show
- Keep localStorage as an optimistic cache
Verification
- go test ./internal/agent -count=1 -run 'TestRecordDismissedTodoBatch|TestSaveBranchMetaPreservesDismissed|TestOldBranchMetaWithoutDismissed|TestDismissedTodoBatchesOmitempty|TestNormalizeDismissedTodoBatches'
- cd desktop && go test -count=1 -run 'TestDismissTodoBatch|TestMetaForTabSurfacesParentDismissed|TestDismissedTodoBatchesEmptySlice|TestCanonicalTodosMetaWireContract'
- pnpm exec node scripts/test-todo-visibility.mjs
- pnpm exec tsx src/__tests__/use-controller-meta.test.ts
* fix(desktop): keep todo dismissal reads off the catalog scan
Problem
Review of #8758 found four merge blockers: lint file-size overruns,
localStorage suffix matching that hid the same completed list in another
session, unsanitized ParentID joins, and MetaForTab walking
continuePathForOpen / ListTopics when a session was not yet indexed.
Root cause
Read and persist shared one path helper, so every meta poll inherited
the covering-leaf catalog walk. The live panel also used a fingerprint
suffix match that ignored session scope. Parent IDs were joined as
raw path segments.
Fix
- Read only the current sidecar and a same-directory, filename-only parent
- Keep the covering-leaf catalog walk on the dismiss write path only
- Restore session-scoped localStorage matching
- Reject path-shaped ParentIDs
- Hold the existing frontend file-size budgets
Verification
- go test ./internal/agent -count=1 -run 'TestRecordDismissedTodoBatch|TestSaveBranchMetaPreservesDismissed|TestOldBranchMetaWithoutDismissed|TestDismissedTodoBatchesOmitempty|TestNormalizeDismissedTodoBatches'
- cd desktop && go test -count=1 -run 'TestDismissTodoBatch|TestMetaForTabSurfacesParentDismissed|TestDismissedTodoBatchesEmptySlice|TestMetaForTabDoesNotReadSibling|TestParentSessionPathRejects'
- pnpm exec node scripts/test-todo-visibility.mjs
- pnpm exec tsx src/__tests__/use-controller-meta.test.ts
- go run ./tools/repolint
* fix(agent): use integer range in dismissed-todo test
Problem
CI lint failed on #8758: golangci-lint intrange flagged
internal/agent/todo_dismissal_test.go:99.
Root cause
The cap/dedup test used a C-style for loop after Go 1.22 made
integer ranges the required form.
Fix
Use `for i := range maxDismissedTodoBatches + 2`.
Verification
- go test ./internal/agent -count=1 -run 'TestNormalizeDismissedTodoBatches|TestRecordDismissedTodoBatch|TestSaveBranchMetaPreservesDismissed'
Problem
Compatible Anthropic gateways can send message_delta.stop_reason and
then close the SSE body without message_stop. Reasonix treated that
clean EOF as StreamInterruptedError, discarded a complete turn, and
replayed the frozen request until recovery exhausted. Users then saw
"model stream interrupted after recovery attempts: … stream ended
before message_stop".
Root cause
The Anthropic reader required message_stop as the only commit signal.
OpenAI already accepts finish_reason without [DONE]; Anthropic did not
have the matching compatibility rule.
Fix
Classify a clean scanner stop in streamScanEndError. A non-empty
stop_reason finalizes the attempt (text and already-closed tool
blocks). EOF with neither stop_reason nor message_stop stays
uncommitted so speculative tool calls still do not execute.
Verification
- go test ./internal/provider/anthropic/
- go test -race ./internal/provider/anthropic/ -run 'TestReadStream|TestStreamScanEndError'
- go vet ./internal/provider/anthropic/
- go run ./tools/repolint
* fix(desktop): keep transcript pinned after todo dismiss / 修复关闭待办后会话画面回跳
Problem
Dismissing the completed todo shelf jumped the visible chat back to an
earlier todo list and progress table. Latest messages were still on disk;
re-clicking the session from the workspace restored them.
A sibling hydrate path could do the same thing: Retry or a failed clear
could serve a resident transcript snapshot that predated later live turns.
Root cause
Todo dismiss shrinks the composer footer and grows the transcript
viewport. Virtuoso then reports atBottom=false, sometimes resetting
scrollTop to the start of the loaded window. Only content-height growth
was treated as layout, so a viewport resize looked like the user left
the tail.
Retry and failed-clear hydrates also preferred the resident LRU snapshot
while live events never update that cache. An idle apply then replaced
the longer on-screen transcript with the shorter same-fingerprint page.
Fix
- Treat composer/todo viewport resizes as pinned layout, not user scroll
- Re-pin to the tail when footer height changes and the reader is still
following the latest message
- Fetch on explicit no-cache hydrates instead of serving the resident
snapshot
- Reject a shorter same-fingerprint page when the idle transcript is
already longer
- Keep the visible transcript after a failed clear
Verification
- pnpm exec tsx src/__tests__/transcript-scroll-release.test.ts
- pnpm exec tsx src/__tests__/hydrate-history-apply.test.ts
- pnpm exec tsx src/__tests__/history-load-failure-contract.test.ts
- pnpm test:transcript
* fix(desktop): pin footer resize without yanking mid-turn scroll
Problem
CI lint failed: Transcript.tsx and useController.ts exceeded their
repolint file-size ratchets. The footer effect also called
scrollToBottom on every items.length change, which could yank a reader
back to the tail during a live turn.
Root cause
The first commit reused the old footer effect's items.length dependency
while upgrading followGrowingTail to scrollToBottom. That restarts the
500ms bottom-request window on each new row. The extra comments and
wrapped call also crossed the size budgets by 1 and 2 excess lines.
Fix
- Re-pin with scrollToBottom only when footerHeight changes
- Leave item growth on the existing followGrowingTail path
- Drop two comment lines so both files sit on their size budgets
- Contract-test the footer effect dependency list
Verification
- go run ./tools/repolint
- pnpm exec tsx src/__tests__/history-load-failure-contract.test.ts
- pnpm exec tsx src/__tests__/transcript-scroll-release.test.ts
- pnpm exec tsx src/__tests__/hydrate-history-apply.test.ts
* fix(desktop): attach the live topic runtime instead of an old catalog leaf
Problem
Clicking a sidebar row that showed a live/paused badge opened the
catalog representative. That file was often an older sibling, so the
transcript jumped to yesterday's unsigned todos. Switching away from a
session mid-MCP rebuild then waited on runtimeRebuildMu before emitting
topic-activation ready, so the correct history stayed hidden.
Root cause
Ordinary-tree SessionPath was the catalog representative. Open reused
that path and built a new controller instead of the detached live
runtime. Ready was emitted only after keepOnlyVisibleTab, which takes
the rebuild mutex another tab can hold.
Fix
- Prefer a live tab/detached controller over the representative.
- Promote the detached runtime into the visible tab.
- Point the ordinary-tree row at the live path.
- Emit ready before prune when the runtime is already usable.
- Leave explicit non-representative History paths unchanged.
Verification
- cd desktop && go test -count=1 -run 'TestStartTopicActivationPrefersLiveRuntimeOverRepresentative|TestStartTopicActivationReadyDoesNotWaitForRebuildMutex|TestPreferLiveSessionPath|TestStartTopicActivationFailureDetachesPreviousAndReattaches|TestStartTopicActivation|TestActivateTopic|TestBuildTabControllerReattach'
- make lint
* fix(desktop): keep paused live runtimes off covering-leaf rebind
Problem
After rebasing onto covering-leaf continue (#8728), clicking a covering
parent or RepresentativePath could reopen the catalog leaf instead of
the paused live controller. openTopicTab also skipped the live overlay,
and OpenGlobalTab/OpenProjectTab would steal the latest-session switch.
Root cause
preferLive only treated catalogSessionPathForTopic (canonical leaf) as
the ordinary row, so a parent click looked like History inspect.
Covering-leaf continue only skipped Running/pending/jobs, so a paused
controller was rebound. Open*Tab latest-session entry points shared
the live overlay.
Fix
- Route explicit session opens through prefer-live; keep OpenGlobalTab
and OpenProjectTab on the latest-session path.
- Treat RepresentativePath, the canonical leaf, and the covering parent
as ordinary-row identities.
- Skip covering-leaf continue/rebind when a live controller is already
on that path, including paused and awaiting delivery.
Verification
- cd desktop && go test -count=1 -timeout 12m .
- cd desktop && go test -race -count=1 -run 'TestPreferLiveSessionPath|TestResolveOpenTopicSessionPathKeepsPausedLiveOnCoveringParent|TestStartTopicActivationAttachesPausedLiveWhenOpeningCoveringParent|TestStartTopicActivationPrefersLiveRuntimeOverRepresentative|TestOpenTopicTabKeepsRunningParent|TestOpenGlobalTabResolvesTopicToLatestSessionRuntime'
- GOOS=windows golangci-lint unused: 0 issues
- make lint
Problem
A Goal/delivery-check stop showed the same sidebar badge as automatic
recovery pause ("paused" / "已暂停"). Users treated completed todos as
a finished run and asked why the session still looked stalled.
Root cause
topicActivityStatusFromEvent mapped both TurnOutcomeFinalReadiness and
TurnOutcomeRecoveryPaused to topicStatusPaused so the sidebar would not
flag a recoverable stop as an error.
Fix
Give final_readiness its own awaiting_delivery status and copy
("need checks" / "待交付检查"). Recovery pause stays paused. A later
running turn still replaces either badge with thinking.
Verification
- cd desktop && go test -count=1 -run 'TestTopicActivityStatusPresentsReadiness|TestCatalogRuntimeStatusPreservesDeliveryCheck'
- cd desktop/frontend && pnpm exec tsx src/__tests__/project-tree-runtime.test.ts
- make lint
* fix(desktop): keep upgraded conversations visible and open the latest leaf / 修复更新后会话消失且只剩前半段
Problem
After a desktop upgrade, the sidebar could show no previous conversations
until the user clicked New Chat. Opening a conversation that had recovery
copies often showed only the older half; the recent half was missing.
Root cause
v1.25.0 switched the disposable catalog to an independent v4.sqlite. The
empty cache is stored before the first directory scan. ListProjectTopics
treated "no rows yet" as "the user has no conversations". The first paint
could miss later scan events. Separately, lineage folding keeps the parent
as the ordinary row while recent turns live on the covering recovery leaf.
Open, restore, and paged history bound the parent path from desktop-tabs.json
or the ordinary row, so the transcript stopped at the older prefix.
Fix
- Fall back to desktop-projects metadata until a workspace has catalog rows
or a finished first scan.
- Keep indexingDone false until existing session directories have been scanned.
- Reload expanded folders when the first scan completes.
- When opening or restoring the ordinary parent, continue onto the unique
covering leaf. Explicit History forks stay put.
- After the first reconcile, retarget already-open parent tabs onto that leaf.
Verification
- go test ./internal/sessioncatalog/
- cd desktop && go test -run 'TestListProjectTopics|TestProjectTreeSnapshotIndexingWaitsForFirstDirectoryScan|TestContinuePathForOpenFollowsCoveringLeafFromParent|TestUpgradeLegacy|TestSessionCatalogGoroutineOnlySyncsMetadataWithATimeout'
- pnpm exec tsx src/__tests__/project-tree-shell-race.test.ts
- go vet ./internal/sessioncatalog/ and desktop
* fix(desktop): finish catalog upgrade scan and retarget guards
Problem
PR 8728 failed repolint by growing already-over-budget files. Scan-ready
treated any finished global directory as enough, so an empty legacy
session dir could hide conversations still waiting in the real directory.
Startup retarget also rebound tabs that were already running.
Root cause
Directory helpers lived in reconcile.go, and open/resume continue calls
were inlined into app.go and buildTabControllerWithContextCore. Ready
used OR across sessionCatalogTargets. Retarget held App.mu while doing
catalog I/O and did not check hasActiveRuntimeWork.
Fix
- Move DirectoryScanReady/HasWorkspaceRecords into directory_scan.go.
- Move resume/open path continue out of app.go and the controller builder.
- Require every existing matching session directory to finish scanning.
- Copy tab paths under App.mu, then resolve catalog targets off-lock.
- Skip running, pending-prompt, and background-job tabs.
Verification
- go test ./internal/sessioncatalog/
- cd desktop && go test -run 'TestListProjectTopics|TestProjectTreeSnapshotIndexingWaitsForFirstDirectoryScan|TestContinuePathForOpenFollowsCoveringLeafFromParent|TestRetargetOpenTabsSkipsRunningSessions|TestUpgradeLegacy|TestSessionCatalogGoroutineOnlySyncsMetadataWithATimeout'
- go run ./tools/repolint
- go vet ./internal/sessioncatalog/ and desktop
* fix(desktop): keep running topic tabs on the parent during open
Problem
Opening or activating a topic whose ordinary row is a covering-leaf
parent rebound a live tab onto that leaf. Startup retarget already
skipped hasActiveRuntimeWork, but the click/activation path did not.
Root cause
resolveOpenTopicSessionPath continued onto the leaf before looking at
existing tabs. The first session-key match could prefer an idle leaf,
and the topic match then called rebindTabToSessionPath even when the
current tab was running.
Fix
- Skip continue when any tab or detached session for the topic has
active runtime work.
- Focus a running topic tab instead of rebinding it.
- Resume hydrates the current session when that tab is still running.
Verification
- cd desktop && go test -run 'TestOpenTopicTabKeepsRunningParentInsteadOfCoveringLeaf|TestRetargetOpenTabsSkipsRunningSessions|TestContinuePathForOpenFollowsCoveringLeafFromParent|TestListProjectTopicsKeepsMetadata|TestListProjectTopicsWaitsUntilEveryGlobalDirectoryIsScanned'
- go test ./internal/sessioncatalog/
- go run ./tools/repolint
- go vet ./internal/sessioncatalog/ and desktop
* fix(desktop): only skip covering-leaf rebind for the live parent
Problem
The first running-tab guard treated any active work on the topic as a
reason to keep the current session. OpenGlobalTab must still detach an
older running session and switch the visible tab to the latest ordinary
session of that topic.
Root cause
topicHasActiveRuntimeWork is topic-wide. The covering-leaf continue and
the latest-session switch share the same open path, so a topic-wide skip
blocked both.
Fix
- Suppress continue only when the live runtime is already on the path
that would be rewritten to a covering leaf.
- Keep latest-session detach-and-switch for a different ordinary file.
Verification
- cd desktop && go test -run 'TestOpenTopicTabKeepsRunningParentInsteadOfCoveringLeaf|TestOpenGlobalTabResolvesTopicToLatestSessionRuntime|TestRetargetOpenTabsSkipsRunningSessions|TestContinuePathForOpenFollowsCoveringLeafFromParent'
- go run ./tools/repolint
- go vet desktop
* fix(desktop): restore mid-stream history and hide Auto Guard steers / 修复中途打开会话丢历史并隐藏 Auto Guard 引导
Problem
After 1.25.0, reopening a conversation could hide earlier work and
replace a real prompt with English Auto Guard text on the user side.
Clicking into a session that was still streaming also showed only the
live turn over a blank transcript.
Root cause
Auto Guard delivered model-facing recovery policy through Agent.Steer,
which persists a user-role mid-turn message. Desktop renders those as
user-side steer cards. Separately, shouldApplyHydratedHistory treated
any live turn as reason to drop the history page, and hasCachedLiveTurn
let switchTab skip the fetch even when no page had landed.
Fix
- Append Auto Guard guidance to the failed tool result so the model
still sees it. Do not persist or emit it as a user steer.
- Hide already-persisted Auto Guard steers in desktop, CLI, and serve
history replay.
- Apply history as replace / prepend / skip. A live turn with no
history page gets the page prepended and deduped against live rows.
The mid-stream prepend decision is adapted from #8696.
Verification
- go test ./internal/agent/ ./internal/recovery/ ./internal/control/
- cd desktop && go test . -run TestHistoryMessagesHideHostRecoverySteer
- tsx src/__tests__/hydrate-history-apply.test.ts
- tsx src/__tests__/running-tab-history-hydration.test.tsx
- tsx src/__tests__/tab-switch-hydration.test.tsx
- tsx src/__tests__/use-controller-history-live-race.test.tsx
- tsx src/__tests__/transcript-rows.test.ts
Co-authored-by: yingziisme <[email protected]>
* fix(desktop): extract host-recovery helpers to satisfy repolint
Problem
CI lint failed on #8727: adding hide-and-hydrate logic grew already
ratcheted files past their file-size / function-size / test-file-size
budgets.
Root cause
The first landing inlined 3-line filters and a new history test into
files that were already over the 800-line ceiling, so every added line
failed the ratchet.
Fix
- Move the history replay test into history_host_recovery_test.go
- Replay steers through ReplaySteerText / historySteerRows
- Apply Auto Guard observation via withRecoveryObservation
- Split the control synthetic-user cases into input_host_recovery_test.go
- Ratchet only the leftover 2-4 weighted lines that stay in
useController.ts (+4 / 3976 = 0.10%), chat_tui.go (+2 / 4767 = 0.04%),
and serve.go (+2 / 882 = 0.23%)
Verification
- go test ./internal/agent/ ./internal/control/ -run TestHostRecovery|TestIsSyntheticUserMessage
- cd desktop && go test . -run TestHistoryMessagesHideHostRecoverySteer
- tsx src/__tests__/transcript-rows.test.ts
- go run ./tools/repolint
---------
Co-authored-by: yingziisme <[email protected]>
Problem
After provider web_search, the next Anthropic turn must replay
encrypted_content. Compact and overflow estimates counted that ciphertext
as ordinary prompt text, so a search-heavy session could cross
compact_ratio earlier than the billed window.
Root cause
requestChars, fold-token estimates, and interrupted-usage estimates all
added ServerSearch.Raw. Anthropic does not count replayed encrypted
search results toward input tokens. The wire still has to send Raw.
Fix
Walk only id, query, and visible title/URL fields for estimates. Replay
and persistence still keep Raw verbatim.
Verification
- go test ./internal/provider/ ./internal/provider/anthropic/ ./internal/agent/ -run 'TestWalkServerSearchEstimate|TestCalibratedBudgetIgnoresEncryptedSearchRaw|TestEstimateMessagesTokensOmitsEncryptedSearchRaw|TestBuildRequestReplaysServerSearchBlocks|TestMessageServerSearchRemainBackwardCompatible|TestCalibratedResponsesBudgetIncludesNewReplayItems|TestRunPersistsServerSearch'
- go run ./tools/repolint
Problem:
Desktop inbox pause/recovery left queued guidance unusable. Empty
sessions came back paused, same-topic session switches showed another
session's recovered queue, mid-turn notes waited until turn end, and
delete/edit failed on waiting items.
Root cause:
Rebind/rotate always persisted paused=true. Composer drafts are
topic-scoped, so durable inbox rows stayed on the shared key and
snapshots were not invalidated by sessionPath. Running submit only
enqueued follow-ups. Delete rejected orphans and unconsumed steers.
The recovery banner stayed visible for in-flight items. Recover-then-
delete of the last orphan also left an empty inbox paused.
Fix:
- Pause only when the inbox still has pending work
- Keep an explicit steer as a queued follow-up when the inbox is paused
- Recover orphans and withdraw unconsumed steers on delete
- Clear leftover pause/recovery flags when the last item is removed
- Refresh and accept inbox snapshots only for the current session path
- Steer running composer submits; allow queued guidance to be edited
- Hide the recovery banner while guidance is already in flight
Verification:
- go test ./internal/sessioninbox ./internal/control -run 'Inbox|Steer|Pause|DeleteInbox|Orphan|EnqueueInbox|DeleteLast|DiscardLast'
- cd desktop && go test . -run 'Inbox|SteerInbox|EnqueueInboxSteer'
- tsx src/__tests__/composer-inbox-recovery.test.tsx
- make lint
* fix(provider): keep web_search on a foldable card, not in the answer
Problem
Provider-executed web_search was flattened into assistant ChunkText as
a markdown title/URL list. The answer body then contained the search
dump, and mid-stream rendering showed raw `- **title**` / `<url>`.
Root cause
The Anthropic adapter formatted web_search_tool_result as ChunkText.
There was no typed record for a process card or protocol-block replay,
so the only place to show results was the assistant body.
Fix
- Add ChunkServerSearch and persist Message.ServerSearch (omitempty).
- Anthropic streams typed search chunks and replays server_tool_use +
web_search_tool_result, including encrypted_content.
- Responses still replays web_search_call items and also emits the
typed card chunk.
- The agent hydrates existing ToolDispatch/ToolResult cards; expand
lookup reads ServerSearch because there is no RoleTool message.
- Desktop hydrates a standalone foldable card before the model answer.
- formatWebSearchResults stays as the markdown dump helper.
Verification
- go test ./internal/provider/ ./internal/provider/anthropic/ ./internal/provider/responses/ ./internal/agent/ ./internal/control/ ./internal/cli/
- cd desktop && go test -count=1 -run TestHistoryMessages
- tsx src/__tests__/tool-subject.test.ts
- tsx src/__tests__/transcript-rows.test.ts
Cache-impact: system and tool-schema prefix unchanged. After the first
search, the next-turn conversation suffix uses protocol blocks instead
of a markdown dump in Content. Old sessions keep dumped markdown; they
are not migrated.
* fix(desktop): show web_search sources as answer footnotes
Problem
Moving provider web_search onto a process card left the confirmed
title-and-orange-link source list out of the answer. Users still want
that list as footnotes after the model reply.
Root cause
Search hits were only used for the tool card. They were not attached
to the assistant item, so the answer had no post-script source list.
Fix
Derive display-only footnotes from ServerSearch / the live web_search
tool result. Render the original title + autolink list under the
answer, not inside Message.Content. CLI appends the same list after
the settled reply.
Verification
- go test ./internal/provider/ ./internal/provider/anthropic/ ./internal/cli/
- tsx src/__tests__/search-sources.test.ts
- tsx src/__tests__/search-footnotes-render.test.tsx
- tsx src/__tests__/tool-subject.test.ts
* test(desktop): drop CodeQL URL check and extract search helpers
Problem
CI blocked the search-card PR on a CodeQL test alert, missing
cache/docs impact fields, and repolint budget overruns.
Root cause
The footnote render test compared a raw example.com href. The PR body
used an em dash and omitted Cache-guard. New search logic was added
inside already over-budget files.
Fix
Assert the footnote title instead of a URL substring. Extract search
stream, replay, hydrate, and footnote helpers into dedicated files.
Rebaseline the remaining wiring-only repolint leftovers.
Verification
- go test ./internal/provider/ ./internal/provider/anthropic/ ./internal/provider/responses/ ./internal/agent/ ./internal/control/ ./internal/cli/
- cd desktop && go test -count=1 -run TestHistoryMessages
- tsx src/__tests__/search-sources.test.ts
- tsx src/__tests__/search-footnotes-render.test.tsx
- tsx src/__tests__/tool-subject.test.ts
- tsx src/__tests__/transcript-rows.test.ts
* fix(provider): satisfy golangci-lint on server search helpers
Problem
CI lint failed on the search-card PR after the helper extraction.
Root cause
staticcheck S1016 wants a conversion from wireSearchHit to
ServerSearchHit. modernize wants strings.SplitSeq instead of Split
when ranging lines in ParseServerSearchOutput.
Fix
Convert the wire hit directly and range SplitSeq. Behavior is unchanged.
Verification
- gofmt -l internal/provider/server_search.go
- go test ./internal/provider/ ./internal/provider/anthropic/ ./internal/cli/ -run 'TestParseServerSearch|TestMergeServerSearch|TestFormatServerSearch|TestServerSearchFromResponses|TestFormatWebSearchResults|TestIngestEventPrintsWebSearchFootnotes'
- golangci-lint run internal/provider/server_search.go
* fix(desktop): stop old sessions flipping back to unread / 修复旧会话反复变成未读
Problem
Old sidebar sessions all showed unread dots. Clearing unread lasted only
until the next catalog refresh.
Root cause
Unread compared lastActivityAt against a key that included the
representative session path, and the first-run baseline ran on project
shells before topics loaded. Catalog repair wrote sidecars with
UpdatedAt=now when it was zero, then treated file mtime as a hard floor,
so later reconciles raised lastActivityAt and the dots returned.
Fix
Key unread on the logical topic, seed a one-time baseline watermark, keep a
topic active when only the representative path changed, fill missing
UpdatedAt from file mtime instead of wall clock, and stop raising a known
sidecar activity time to file mtime.
Verification
- pnpm exec tsx src/__tests__/project-tree-runtime.test.ts
- go test ./internal/sessioncatalog ./internal/agent
- go test -race ./internal/sessioncatalog and focused agent tests
- cd desktop && go test -run 'TestListProjectTopics|TestProjectTree|TestCoveredRecovery|TestReconcile'
- make lint
* fix(desktop): narrow unread key before localStorage lookup
Problem
Desktop CI failed typecheck: projectTreeTopicHasUnreadActivity indexed
readActivity with a string|null key (TS2538).
Root cause
The baseline comparison used key before the existing null check, so tsc
rejected the index. Local tsx tests do not run tsc.
Fix
Return early when the unread key or activity timestamp is missing, then
index readActivity with a narrowed string.
Verification
- pnpm exec tsx src/__tests__/project-tree-runtime.test.ts
- pnpm typecheck
## Summary
Goal mode no longer loops on the same verification after an honest `update_goal(complete)`.
Users running `/goal audit ... find and fix bugs` saw the model finish unit tests, declare leftover e2e or engine checks as `unverified`, then get sent back to rerun the same green commands until someone cancelled.
## Root cause
`update_goal` recorded the completion account, but Delivery readiness and the Goal FSM ignored it.
Light/Balanced already declare `AllowPartialWithoutChecks`. Nothing read that flag. A rejected `complete` still counted as progress, and continuation text demanded "fully done and verified" even after the model reported a check unavailable.
## Fix
- Honor declared `completion.unverified` (and user-forbidden tests) for project-check and post-write verification gaps on Light/Balanced.
- Keep todos, mutations, review, sign-off, and capability gates blocking.
- Accept a second identical `complete` when only check gaps remain. Incomplete todos still continue.
- Stop treating a rejected `complete` as host progress.
- Align Goal continuation and contract wording with "verification was attempted or reported unavailable".
## Verification
- `go test ./internal/completion/ ./internal/agent/ ./internal/control/ -count=1`
- `go test ./internal/tool/builtin/ ./internal/boot/ -count=1`
- `gofmt` on the changed Go files
- `go vet ./internal/completion/ ./internal/agent/ ./internal/control/`
- `make lint`
Cache-impact: low - Goal continuation and task-contract wording live in the turn tail; `update_goal` schema, tool description, and the stable prefix are unchanged
Cache-guard: go test ./internal/boot/ -count=1 && go test ./internal/control/ ./internal/agent/ -count=1 -run 'TestRepeatedComplete|TestPartialWaiver|TestPlannerGate'
Documentation-impact: updated - GOAL_ENFORCEMENT, GUIDE (EN/ZH), and TOOL_CONTRACT now describe the unverified-check complete path and the repeated-complete stop
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix(desktop): render completed list items while answers stream
Problem
Tight markdown lists such as provider web_search dumps have no blank
lines, so the streaming commit target treated the whole list as one
unfinished block. Users saw raw `- **title**` and `<url>` until the
turn ended, then the finished title-and-link list appeared at once.
Root cause
streamingCommitTarget only advanced on blank lines, closed fences,
closed display math, or headings. A later list marker did not complete
the previous item, so indented URL continuations and every earlier
item stayed in the plain-text tail.
Fix
Treat a CommonMark list marker as a commit boundary for prior content
only. The new item stays in the tail so indented continuations can
still join it. Thematic breaks, setext underlines, emphasis without a
marker space, and markers inside open fences are left unchanged.
Verification
- tsx src/__tests__/mermaid-rendering.test.tsx
- tsx src/__tests__/ui-perf-scenarios.test.ts
- tsx src/__tests__/markdown-pipeline.test.tsx
- tsx src/__tests__/markdown-streaming-worker.test.tsx
- tsx src/__tests__/markdown-history.test.tsx
* test(desktop): avoid CodeQL URL substring alert in list commit coverage
Problem
CodeQL flagged the new search-list fixture assertion as incomplete URL
substring sanitization because it used includes("https://example.com/a").
Fix
Assert the rendered list still contains the fixture title instead of a URL.
Verification
- tsx src/__tests__/mermaid-rendering.test.tsx
* refactor(shellsafe): classify durable command effects
Problem: Boolean read-only tables could not distinguish observational and mutating forms of the same command family, so policy and permission consumers drifted.
Root cause: Argument-sensitive checks lived in individual consumers and unknown commands collapsed into one mutation bit.
Fix: Add a shared fail-closed CommandEffect model with parameter-aware Git, date, Go, npm, and Cargo rules, and migrate Bash permission reads to it.
Verification: go test ./internal/shellsafe ./internal/permission
* refactor(evidence): separate durable tool effects
Problem: One mutation boolean simultaneously drove TaskPolicy, workspace serialization, batch recovery, and delivery content debt.
Root cause: Repository metadata writes and content writes were indistinguishable, while evidence duplicated shell argument checks.
Fix: Add ToolEffects projections, derive Bash effects from shellsafe, keep conventional verifiers non-mutating, and make receipts track content mutation only.
Verification: go test ./internal/evidence ./internal/recovery
* refactor(runtime): consume shared tool effects
Problem:
Runtime policy boundaries overloaded schema read-only and mutation booleans, so repository metadata, workspace content, and host state could receive contradictory treatment.
Root cause:
Permission, TaskPolicy, Auto Guard, delivery evidence, workspace leases, proxy resolution, and desktop invalidation projected different semantics from the same call.
Fix:
Carry ToolEffects through the resolved tool plan, reclassify proxy targets before commit or execution, separate state/workspace/content/repository consumers, and promote observed file changes before recording evidence.
Verification:
go test ./internal/shellsafe ./internal/permission ./internal/evidence ./internal/agent ./internal/recovery ./internal/checkpoint
* fix(agent): make mutation barriers effect-aware
Problem:
A failed reader could be treated like a failed mutation, while dependency messages hid which safe write domain caused the batch to stop.
Root cause:
Batch preclassification and post-execution failure handling mixed schema read-only, a coarse mutation fallback, and a bare atomic boolean.
Fix:
Store an immutable sanitized barrier cause, classify static and resolved calls through ToolEffects, keep readers running, and skip only later state writers or verifiers with structured not-run metadata.
Verification:
go test ./internal/agent -run 'TestBatchDependencyBarrier|TestDependentMutationSkippedAfterFailedWriterInBatch|TestToolBeforeFailedWriterReplacementOpensDependencyBarrier'
* test(shellsafe): share command effect matrix
Problem:
Dual-mode command regressions could recur when shellsafe, permission, evidence, and agent tests encoded separate expectations.
Root cause:
There was no shared cross-boundary corpus for certainty, write domains, permission readers, content evidence, TaskPolicy, and batch barriers.
Fix:
Add one testdata matrix consumed across all four boundaries, cover representative read/write/unknown compositions, and make legacy read-only tables private behind compatibility adapters.
Verification:
go test ./internal/shellsafe ./internal/permission ./internal/evidence ./internal/agent -run 'SharedCommandEffectMatrix|ConsumesSharedCommandEffectMatrix|ClassifyBashCommandEffects'
* refactor(runtime): isolate effect projections
Problem:
The complete command-effect change pushed several historically large files beyond the repository's no-growth lint budgets and duplicated focused tests inside an oversized ledger test file.
Root cause:
New effect projection, checkpoint comparison, and tool-plan state lived beside unrelated legacy responsibilities.
Fix:
Extract those responsibilities into focused files, compact internal helpers, and keep legacy adapters as thin documented projections without changing behavior.
Verification:
go test ./internal/shellsafe ./internal/permission ./internal/evidence ./internal/checkpoint ./internal/agent ./internal/recovery
make lint
* fix(runtime): absorb related command-effect PR mechanisms
Problem:
The rebased shell-effect work still missed sibling PR mechanisms and the
git config editor hole.
Root cause:
Fail-closed lifecycle cases, env-prefixed verifiers, and question-keyed
read novelty lived on other branches. classifyGitConfig treated --edit as
a reader.
Fix:
Absorb #7760 matrix rows, #8012 env-prefix verification via ParseStaticCommand,
and #8407 noteQuestion scoring. Keep git config --edit as a writer. Leave
#8614 ExecutionEnv and #8404 runway out of this PR.
Verification:
go test ./internal/shellsafe ./internal/permission ./internal/evidence ./internal/checkpoint ./internal/recovery ./internal/agent
go test -race ./internal/shellsafe ./internal/permission ./internal/evidence ./internal/agent
Co-authored-by: Wooseong Kim <[email protected]>
Co-authored-by: lbx13 <[email protected]>
Co-authored-by: yhh <[email protected]>
* test(evidence): keep command-effect cases out of the oversized ledger test
Problem:
CI lint failed because three command-effect cases were added to
internal/evidence/evidence_test.go, which is already over the test-file-size
ratchet.
Root cause:
The new ToolCallMutates rows lived in the historical ledger test file instead
of the focused effect projection tests.
Fix:
Move the env-prefixed verifier case into effects_test.go. Branch listing and
pure-commit contracts were already covered there.
Verification:
go test ./internal/evidence -run 'TestToolCallMutatesForDeliveryProfile|TestClassifyToolCallSeparatesMutationDomains|TestEnvPrefixVerification|TestReceiptMutationTracksContentNotRepositoryCement'
go run ./tools/repolint
---------
Co-authored-by: Wooseong Kim <[email protected]>
Co-authored-by: lbx13 <[email protected]>
Co-authored-by: yhh <[email protected]>
* fix(desktop): stop workspace-open transcript overlap
Problem
Opening the right workspace dock shrinks the chat pane. User and
assistant turns then paint on top of each other until the dock is
collapsed.
Root cause
Virtuoso sizes rows from offsetHeight. Transcript markdown still used
content-visibility:auto with a 72px contain-intrinsic-size placeholder,
so a width change (workspace open/resize) measured tall messages as
about 72px and stacked the next rows over them.
Fix
Keep the existing offscreen markdown cull outside the transcript, but
force content-visibility:visible on markdown blocks inside
.transcript__row so virtualized height measurements stay exact.
Verification
- tsx src/__tests__/typography-overflow-contract.test.ts
- node scripts/check-css-syntax.mjs src/styles.css
* fix(desktop): size Virtuoso rows after transcript inline padding
Problem
Opening the right workspace dock cropped right-aligned user bubbles
(especially short image turns). Collapsing the dock made the same turn
look normal. This is not the scroll-up stacked-text bug fixed in #8659.
Root cause
The Virtuoso scroller (.transcript) used 32px horizontal padding.
Virtuoso sizes rows from the scroller clientWidth, which includes that
padding, but lays the list out in the content box after padding-left.
Rows therefore extended 32px past the chat column. overflow-x:hidden
clipped them under the dock.
Fix
Keep only vertical padding on the scroller. Move the inline inset onto
.transcript__row and .transcript__header via --transcript-inline-pad so
row width matches the visible chat column.
Verification
- tsx src/__tests__/typography-overflow-contract.test.ts
- node scripts/check-css-syntax.mjs src/styles.css
- Playwright mock bench: dock open, stay at tail, user bubble right
edge stays inside .chat-pane and does not enter .workbench-dock
* test(desktop): allow small tail slack after workspace dock resize
Problem
Linux desktop CI failed in transcript-scroll-stability after the
dock-open crop assertions had already passed. Collapsing the workspace
left the scroller 7px off the physical bottom.
Root cause
Toggling the dock changes the chat column width. Virtuoso remasures
rows and can leave a few pixels off the tail. The crop check used the
same 1px stick-to-tail bound as the initial load.
Fix
Keep the initial dock-open tail bound at 1px. After open/close, wait
until the scroller is within 16px of the bottom and assert that slack
only. Crop-vs-chat and crop-vs-dock stay at 1px.
Verification
- CI previously passed dock-open overflow (-42px) and failed only on
fromBottom=7 after collapse
- Crop assertions unchanged
* fix(desktop): restore thinking transcript after session switch / 修复思考中切走再切回变成欢迎页
Problem:
If the current conversation is still thinking and the user switches to
another session then back, the sidebar keeps the spinner and the composer
stays live, but the transcript renders the empty Welcome surface. The
conversation only reappears after the turn finishes and the user switches
back again.
Root cause:
Single-surface topic activation prunes the previous tab's frontend cache.
Reopening the running session sets running=true from tab meta, then
loadSessionDataForTab skipped applying the live history slice whenever a
foreground turn was active. hydrate_done then cleared placeholders, so
Welcome won. Activation also reused another session's items as the
hydration placeholder, so a new surface could briefly show the old chat.
Fix:
Apply hydrated history when the visible transcript is empty, even if a
turn is in flight. Do not reset in that path, so running/live flags stay.
Keep the skip when a live transcript is already on screen. Use same-session
items only as the activation placeholder.
Verification:
- pnpm exec tsx src/__tests__/topic-activation.test.tsx
- pnpm exec tsx src/__tests__/tab-switch-hydration.test.tsx
* fix(desktop): compile switch-back hydrate and keep useController in budget
Problem:
PR #8665 failed desktop frontend build and repo-standards lint. TypeScript
could not narrow `projection` after shouldApplyHydratedHistory(), and
useController.ts grew 21 lines past its file-size ratchet.
Root cause:
The helper is not a type predicate, so `projection.items` stayed possibly
undefined. The apply/placeholder logic was inlined in a file already at
its recorded overage budget; widening the baseline is not allowed.
Fix:
Extract hasCachedLiveTurn, shouldApplyHydratedHistory, and same-session
placeholder selection into hydrateHistoryApply.ts. Keep an explicit
`projection !== undefined` guard at the apply site. useController.ts is
now 4760 lines, under the 4769 budget.
Verification:
- pnpm exec tsc --noEmit
- go run ./tools/repolint
- pnpm exec tsx src/__tests__/hydrate-history-apply.test.ts
- pnpm exec tsx src/__tests__/topic-activation.test.tsx
- pnpm exec tsx src/__tests__/tab-switch-hydration.test.tsx
* fix(desktop): stop short-chat ghost bubble and empty band / 修复短对话幽灵气泡与中间空带
Problem:
A one-turn chat shows two copies of the first user bubble — one at the
scroller top without a timestamp, one above the composer — with a large
empty band between them.
Root cause:
Virtuoso alignToBottom sets margin-top:auto on the item list when content
is shorter than the viewport. Combined with firstItemIndex, that
bottom-shifts the real turn and paints a ghost first-user row at the
scroller top.
Fix:
Remove alignToBottom. Short transcripts start from the top. Long
transcripts still pin to the tail via followOutput and scrollToBottom.
The content-visibility override from #8659 is unchanged.
Verification:
- pnpm exec tsx src/__tests__/transcript-virtualization.test.tsx
- pnpm test:transcript
* chore(repolint): allow two extra Transcript.tsx lines
Problem:
CI lint failed on #8663 because Transcript.tsx grew from 1078 to 1080
lines. The file already carries 278 lines of recorded file-size debt.
Root cause:
Removing alignToBottom and adding a three-line landmine comment is a
net +2 over the recorded 278-line overage.
Fix:
Raise only the Transcript.tsx file-size overage 278 -> 280 and the repo
file-size total 108396 -> 108398. No other baseline entries.
Verification:
- go run ./tools/repolint
* fix(desktop): keep transcript rows measurable when scrolling up / 修复往上滚时对话叠字
Problem:
Opening some conversations and scrolling up stacked earlier turns on top of
the current answer. Scrolling back to the bottom looked normal. Short
transcripts also sat at the bottom of the viewport with a large empty band
above them.
Root cause:
React Virtuoso unmounts offscreen rows, so inner markdown
`content-visibility: auto` plus `contain-intrinsic-size: auto 72px` was
redundant and harmful. Remounted headings, paragraphs, and lists were
measured at the 72px placeholder, then painted at their real height.
`alignToBottom` additionally set `margin-top: auto` on short lists.
Fix:
Disable content-visibility on `.transcript__row .md > *`, matching the
existing card-level override. Leave the global markdown culling rule
unchanged outside the transcript. Remove `alignToBottom`; tail follow still
uses `followOutput` and `scrollToBottom`.
Verification:
- pnpm exec tsx src/__tests__/typography-overflow-contract.test.ts
- pnpm exec tsx src/__tests__/transcript-virtualization.test.tsx
- pnpm check:css
- Native WKWebView probe on bench:markdown-46t (bottom, history, back)
* fix(desktop): restore Virtuoso alignToBottom for short chats
Problem:
The overlap fix also dropped alignToBottom, which pins a short transcript
to the composer. New or one-turn sessions would sit at the top of the
pane with a large empty band above the input.
Root cause:
alignToBottom is independent of the 72px content-visibility measurement
bug. Removing it changed chat layout without being required to stop
stacked text.
Fix:
Restore alignToBottom and drop the short-transcript top-anchor test.
Tail follow still uses followOutput and scrollToBottom.
Verification:
- pnpm exec tsx src/__tests__/transcript-virtualization.test.tsx
- pnpm exec tsx src/__tests__/typography-overflow-contract.test.ts
The official DeepSeek Responses API now serves deepseek-v4-pro alongside
deepseek-v4-flash. Extend the curated deepseek-responses preset from
Flash-only to Flash+Pro with per-model effort overrides and pricing.
Upgrade leftover canned Flash-only official Responses configs in place.
Keep a Settings-unchecked Pro from being restored, and give legacy
singular Flash price rows an explicit Pro list price.
Summary:
Generate a bilingual, product-focused draft from merged pull request metadata. Reuse the selected release-bound PR when one is available.
Verification:
Validate the catalog, citations, bilingual fields, and rendered GitHub release notes before committing.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Fixes the 1.24.2 Catalog regression that re-projected every recovery JSONL
as its own ordinary sidebar topic after upgrade.
- Disposable session-catalog/v4.sqlite with logical projection
(logical_topic_id, ordinary_visible, recovery roles/canonical)
- Re-anchor cross-topic recovery members onto the root logical topic;
ordinary list stays one row per conversation
- Content-based covering/preferred selection; filename fallback for
legacy *-recovery-<16hex>.jsonl
- Disable automatic physical recovery GC; keep explicit UI preview
cleanup and `reasonix sessions cleanup --apply`
- History "Other saved versions" for inspection, default choice, and
dry-run cleanup; externally removed open sessions move to one stable
recovery lane without recreating the original path
- Bounded catalog metadata sync (30s) and sidebar reads (10s); live tabs
stay visible while the projection lags, deduped by catalog projection;
connection-pool regression guards (adopted from #8594)
- CLI sessions diagnose/cleanup and doctor sessions lineage metrics
Co-authored-by: yingziisme <[email protected]>
Co-authored-by: Cursor <[email protected]>
- Replace dead section-title CSS with pinned folder icon rules
- Override :root[data-theme-style] display:none for nested SVGs
- Set icon to 14x14 with fg-faint color to match folder icon sizing
- Add Pin icon with folder styling to the 'Pinned' section header
- Always show pin/unpin action button in compact topic mode
(remove unread status dependency so the button is consistently visible)
2026-07-16 17:25:54 +08:00
13133 changed files with 862023 additions and 1141920 deletions
Target branch: 2.x features and fixes go to `studio`. 1.x takes bug fixes,
provider/API compatibility, release/updater, security and platform stability
only, on `main-v2`.
Pull requests are limited to maintainers and invited contributors; one from
anyone else is closed automatically. Open an issue instead.
-->
## Summary
-
## Cause
-
## Blast radius
-
## Neighbouring behaviours tested
-
## Why this layer
-
## UI changes
<!--
Delete this section if the PR touches nothing under `desktop/frontend-next/src`
or the website pages.
-->
- Screenshots, before and after: light and dark, a wide window and a phone-width one (about 390 px). Attach them to this description.
- Entries moved, hidden or removed: none / list each one.
- Hiding or removing a visible control needs a linked issue and a release-notes line naming it. Do not retire UI with `display: none !important` or a feature flag.
- If a row of `docs/STUDIO_PARITY.md` changes, update it here.
## Issues
<!--
@@ -58,6 +21,24 @@ cancellation, reduced-motion behavior, and failure fallback. Verification must
assert that the target API was actually called; a mock that silently skips it
does not count.
## Disclosure
## Documentation impact
- [ ] AI assistance was used for this change (optional; for transparency only, it does not change how the change is reviewed)
Documentation-impact: TODO
For changes to user-visible CLI, Desktop, configuration, provider, permission,
or tool behavior, use one of:
-`Documentation-impact: updated - <what changed>` and update `docs/*.md`.
-`Documentation-impact: none - <why the embedded documentation remains correct>`.
## Cache impact
Cache-impact: TODO
Cache-guard: TODO
System-prompt-review: N/A
For cache-sensitive changes, fill these lines before requesting review:
-`Cache-impact`: `none`, `low`, `medium`, or `high`, plus the reason.
-`Cache-guard`: the focused guard test/command added or run, or why an existing guard covers the change.
-`System-prompt-review`: required reviewer/approval note when provider-visible system prompt, memory prefix, output style, or skill index behavior changes.
# An unsigned package is not a lesser APK, it is an unusable one: Android's
# package manager rejects it outright rather than reporting a signature
# mismatch. Say so where the run summary can be read, instead of letting a
# green build imply a shippable artifact.
- name:Say what an unsigned build means
if:steps.key.outputs.signed != 'true'
run:|
echo "::warning::no signing key configured, so this APK is unsigned. Android refuses to install an unsigned package, so the release will carry no APK; the file stays a workflow artifact for whoever signs it."
{
echo "### No APK on this release"
echo ""
echo "The build produced an unsigned APK, which Android refuses to install."
echo "It is attached to this run as a workflow artifact only. Add the four"
if curl -fsSL -A "Go-http-client/2.0" -o /tmp/compat-latest.json "$url"; then
jq -e '(.version | type == "string") and (.platforms | type == "object")' /tmp/compat-latest.json >/dev/null
echo "public compatibility manifest OK (desktop version $(jq -r .version /tmp/compat-latest.json))"
exit 0
fi
echo "attempt $attempt failed; retrying in 10s"
sleep 10
done
echo "::error::public compatibility manifest unreachable at $url"
exit 1
# A stable CLI release must never leave the npm line behind: v1.17.5
# shipped as binaries/Homebrew while npm `latest` still pointed at 0.53.2
# (#5822) — every `npm update -g` user was silently downgraded to a
# months-old version, and nothing noticed because the npm line
# (release-npm.yml, `npm-vX.Y.Z` tags) is triggered independently and the
# stable npm tag was simply never pushed. release-npm.yml's own verify
# step only guards runs that happen; this guard catches the run that
# DIDN'T.
#
# Two distinct states, two responses (the approved orchestrator starts the
# CLI and npm reusable workflows concurrently, and npm dist-tags propagate
# asynchronously, so "tag pushed but latest not moved yet" is a NORMAL
# mid-release state, not a failure):
# - npm-v<version> tag missing -> hard fail. This is the #5822 gap:
# nobody pushed the npm release at all.
# - tag pushed, latest lagging -> poll briefly, then WARN and pass.
# The npm job may still be publishing; release-npm.yml's verify step
# owns asserting the dist-tag lands.
- name:Check npm latest dist-tag freshness
env:
TAG:${{ needs.resolve.outputs.tag }}
run:|
set -euo pipefail
case "$TAG" in
*-*)
echo "prerelease $TAG — npm latest does not move on prereleases; skipping"
exit 0
;;
esac
version="${TAG#v}"
if ! git ls-remote --exit-code origin "refs/tags/npm-v$version" >/dev/null; then
echo "::error::the npm-v$version tag was never pushed — the npm channel is being left behind and 'npm update -g' users will be downgraded to the old 'latest'. Push it: git tag npm-v$version ${TAG} && git push origin npm-v$version (or 'npm dist-tag add reasonix@$version latest' for an already-published version)."
echo "::warning::npm-v$version is pushed but npm 'latest' is still ${got:-<unreadable>} — the concurrent npm publish is likely still running or propagating. Monitor the npm job; its verify step asserts the dist-tag lands."
Write-Output "::error title=studio-signing.unexpected-signer::STUDIO_SIGNING_SUBJECT is '$($env:EXPECTED_SUBJECT)' but $file is signed by '$($certificate.Subject)'"
$failed = $true
}
}
if ($failed) { exit 1 }
'Certum payload and installer signing, signer, trust and timestamps passed.' >> $env:GITHUB_STEP_SUMMARY
platform=$(git diff -z --name-only --no-renames "$BASE_SHA" HEAD | bash scripts/ci-platform-scope.sh)
if git diff --name-only --no-renames "$BASE_SHA" HEAD |
grep -qE '^(desktop/electron/|desktop/packaging/|desktop/cmd/update-helper/|desktop/cmd/studio-manifest/|desktop/go\.(mod|sum)$|cmd/reasonix-studio-host/|internal/platform/(update|appupdate)/|go\.(mod|sum)$|scripts/(linux-install-smoke|verify-linux-package|verify-linux-appimage|verify-studio-artifacts)\.sh$|scripts/(windows-signing-lib|verify-windows-package|verify-windows-authenticode|install-smoke)\.ps1$|\.github/workflows/(studio|release-studio)\.yml$)'; then
if ($run.ExitCode -eq 0) { throw 'the arm64 installer exited 0 on an x64 machine' }
if (@(Get-ChildItem -Recurse -Force $target -ErrorAction SilentlyContinue).Count -ne 0) { throw 'the arm64 installer wrote into the target on an x64 machine' }
<a href="https://qm.qq.com/q/i59b0z2R8s"><img src="https://img.shields.io/badge/QQ%20group-1093562660-12B7F5.svg?style=flat-square&labelColor=161b22&logo=tencentqq&logoColor=white" alt="QQ group 1093562660"/></a>
</p>
<p align="center">
@@ -43,93 +39,23 @@
<br/>
<p align="center"><strong>Open source · MIT · runs on your computer, model of your choice</strong></p>
<h3 align="center">An open-source coding agent for your terminal, desktop, browser and editor.</h3>
<p align="center">It reads your project, edits files and runs commands and tests. Have it ask before each step, or work on its own within limits you set. Files its edit tools changed can be rewound. New here? Start with the Studio desktop app.</p>
<p align="center">Maintained by <strong>Huahui Yu</strong>.</p>
<p align="center"><strong>Open source · MIT · a single Go binary</strong></p>
<h3 align="center">A coding agent you can leave running.</h3>
<p align="center">One local engine, four ways in — terminal, desktop app, browser, or your editor over ACP. Plan mode, permissions, a workspace sandbox and per-turn checkpoints keep a long autonomous run something you can still read and undo.</p>
> [!IMPORTANT]
> **Community · 加入社区** — bilingual Discord for setup help (`#help` / `#求助`), workflow showcases, and feature ideas. → **<https://discord.gg/XF78rEME2D>**
>
> QQ group **DeepSeek-Reasonix官方群** (`1093562660`) → **<https://qm.qq.com/q/i59b0z2R8s>** ([QR code](./docs/assets/qq-group.svg))
> Douyin: **做游戏的小鱼** (Douyin ID `22703872788`) · [QR code](./docs/assets/douyin.png)
> **Community · 加入社区** — bilingual Discord for setup help (`#help` / `#求助`), workflow showcases, and feature ideas. → **<https://discord.gg/XF78rEME2D>**
<table><tr><td width="180" align="center" valign="middle"><a href="https://www.rightapi.ai/register?aff=e083bf73" target="_blank" rel="sponsored noopener noreferrer"><img src="./.github/sponsor/rightcode.png" alt="Right Code" width="64"></a></td><td valign="middle">Thanks to Right Code for sponsoring this project! Right Code reliably provides routing services for models such as Claude Code, Codex, and Gemini, with both pay-as-you-go and monthly subscription billing options available. Invoices are available upon top-up, and enterprise and team users can receive dedicated one-on-one support. Register via <a href="https://www.rightapi.ai/register?aff=e083bf73" target="_blank" rel="sponsored noopener noreferrer">this link</a>.</td></tr><tr><td width="180" align="center" valign="middle"><a href="https://www.packyapi.ai/register?aff=rIbQ" target="_blank" rel="sponsored noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="./.github/sponsor/packycode-dark.svg"><img src="./.github/sponsor/packycode-light.svg" alt="PackyCode" width="80"></picture></a></td><td valign="middle">Thanks to PackyCode for sponsoring this project! Access leading AI models through PackyCode with one API endpoint and one API key, with automatic failover and dedicated high-speed routes for Codex and Claude Code. Register via <a href="https://www.packyapi.ai/register?aff=rIbQ" target="_blank" rel="sponsored noopener noreferrer">this link</a>.</td></tr></table>
## What it is
Reasonix is an open-source AI coding assistant. The program runs on your computer; the AI model is a service you configure, which receives what it reads. You describe a task in plain language; it reads code, edits files and runs commands and tests inside the project folder you choose, and shows you each step.
You pick the model: a DeepSeek preset is built in, any OpenAI-compatible service is one config entry, and you pay the model provider directly.
## What you get
- **Read, edit, run.** It reads code, edits files and runs tests and commands, all inside your project folder.
- **Permission levels.** Have it ask every time, or let everyday actions run on their own; your forbid rules always hold. To see the approach first, use plan mode: it starts work only once you approve.
- **Rewind.** A file is saved before it changes, so you can rewind by conversation turn without touching your git history. Only files its edit tools changed are covered, not what a shell command did.
## 30-second start
Download, add a model key, open a project. New here? Start with the Studio desktop app.
1. Download and install the desktop app, Reasonix Studio, from the [releases page](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true).
2. Open it and enter your model provider and key when asked.
3. Open your project folder and write what you want, for example "add retry on failure to the http client".
4. At the level you chose, it stops and asks before anything that needs your say-so. Allow it to continue, or refuse.
Prefer a terminal? Download the `reasonix` command-line tool, run `reasonix setup` to pick a model, then run `reasonix`. See [Install](#install) and [Quick start](#quick-start).
## Four ways to use it
- **Desktop app (Studio).** A graphical app; the best place to start.
- **Terminal.** A full-screen text interface; `reasonix run "task"` also works in scripts.
- **Browser.** `reasonix web` opens a web interface on your own machine.
- **Editor.** Install the extension in VS Code; other editors that support ACP (Agent Client Protocol, a common way for an editor to connect to an AI assistant) can connect to `reasonix acp`.
All four are the same program underneath. What follows is for advanced users and contributors.
## Use it from DeepSeek Harness
DeepSeek Harness (`dsh`) can hand a task to Reasonix as a subagent over ACP. This repository publishes a plugin index for it:
1. Run `reasonix setup` on the machine that runs `dsh`. In the DSH Web UI turn on Custom plugin markets (Plugins, More) and add this index in the Discover tab: `https://raw.githubusercontent.com/esengine/DeepSeek-Reasonix/studio/integrations/dsh-plugin/market-index.json`
2. Install "Reasonix subagent" from it.
3. Open the plugin's page and turn its switch on. While it is off the model has no `reasonix` tool and may run `reasonix -p` in its own shell, which looks like a delegation and is not one.
Setup details, the permission policy and limits are in [Using Reasonix from DeepSeek Harness](./docs/DSH.md).
## Versions
Reasonix ships on two lines. See the [version roadmap announcement](https://github.com/esengine/DeepSeek-Reasonix/discussions/10748) for the reasoning behind the split.
| Line | Branch | Status | Get it |
| --- | --- | --- | --- |
| **Reasonix 2.x** | `studio` (this branch) | Active development | [Studio releases](https://github.com/esengine/DeepSeek-Reasonix/releases?q=studio-v&expanded=true) |
- HTTP `serve` protections, including the default per-launch token, the launch
token every state-changing request requires when authentication is opted
out, localhost binding assumptions, JSON-only state-changing requests, and
CORS restrictions.
- HTTP `serve` protections for the unauthenticated local server, including
localhost binding assumptions, JSON-only state-changing requests, and CORS
restrictions.
- Desktop and bot session isolation, including per-workspace session metadata
and configured bot allowlists.
- Updater, install, and release verification paths.
@@ -68,10 +67,10 @@ The following are normally treated as trusted local/operator-controlled inputs
unless another bug lets an untrusted actor supply them:
- CLI arguments and text typed directly by the local user.
-The user's own configuration under the Reasonix home directory.
-Project configuration files intentionally loaded from the current workspace.
- Explicit `@path` references supplied by the local user to attach local files.
- MCP servers, language servers, hooks, and slash commands installed, enabled,
or approved by the local user.
- MCP servers, language servers, hooks, and slash commands installed or enabled
by the local user.
- Provider base URLs and model names configured by the local user.
The following can be security issues when reachable by an untrusted actor or
@@ -90,56 +89,6 @@ when they bypass the intended boundary:
- Trusting unverified update artifacts, plugin definitions, or downloaded
binaries.
## Project Configuration
Files that arrive with a workspace are untrusted input: `reasonix.toml`,
`.reasonix/settings.json`, `.mcp.json` and the project `.env`. Cloning a
repository is not a decision to trust its author, so these files may narrow
what the user configured and never widen it.
| Setting | What a workspace file may do |
| --- | --- |
| `sandbox.bash` | Move `off` to `enforce`, never back |
| `sandbox.network` | Move `true` to `false`, never back |
| `sandbox.forbid_read`, `sandbox.denied_domains` | Add to the user's lists |
| `sandbox.allow_write`, `sandbox.workspace_root` | Apply only when they resolve inside the workspace, symlinks followed; `${VAR}` in any sandbox path expands from the process environment only |
| `sandbox.host_authorities`, a user's `sandbox.allowed_domains` | Nothing |
| `permissions.deny`, `permissions.ask` | Add to the user's rules |
| `[[providers]]`, `tools.system_one` endpoints | Declare them; they stay out of use until approved, and model settings naming them fall back to the user's |
An "always allow" answer, or extra write access, granted in a workspace is
stored under the Reasonix home, not in the workspace.
Programs a workspace names for the host to run stay off until the user
approves them for that workspace:
- Hooks, language server commands, `tools.search.rg_path`,
`tools.shell.path`, `[browser]` and `tools.system_one.laya.python` are
approved with `reasonix trust`, or for hooks by saving them from the hooks
editor.
- An approval is stored under the Reasonix home with a digest of the
declaration and of the workspace files it names; any change needs approval
again. Approvals and grants belong to one workspace folder.
- Hooks and language servers are checked against their approval again before
each start, and refused if a file they name changed, appeared or now
resolves elsewhere.
- A single program path (`tools.shell.path`, `tools.search.rg_path`,
`[browser]`, `laya.python`) may not point into the workspace, an
`allow_write` root, a temporary directory or a toolchain cache the bash jail
leaves writable, and may not climb with `..`; its approval covers the
program file's content.
-`tools.system_one.laya.local` is read from the user's configuration only.
- Without an interactive frontend they stay off.
- MCP servers a workspace declares stay off until the user enables them for
that workspace.
A project value that is not applied is reported as a load warning with the
reason. A way for workspace files to widen any of the above without the
user's approval is a security issue.
## `@` File References
Reasonix supports `@path` references so users can include local files and images
`verify-page.sh` is the one to run after a change: it starts the kernel with the
same arguments `Kernel.kt` uses (`--auth token`, `--token-file`, `--port-file`,
`-page`) and checks that it binds a port and answers 200. Without a device, that
is as deep as the chain can be verified.
## Where the code is
| File | Owns |
| --- | --- |
| `MainActivity.kt` | The WebView, the back gesture, downloads, external links, renderer restart |
| `Kernel.kt` | Unpacking the page, starting and stopping the kernel, waiting for the port, health probes, logs, the workspace directory |
| `KernelService.kt` | The foreground service that keeps a long turn alive |
| `NativeBridge.kt` | `@JavascriptInterface`: what the page may ask the phone for |
| `BrowserShellServer.kt` | Loopback HTTP server the kernel's browser tools drive the overlay WebView through |
| `Downloader.kt` | Writing a kernel-produced file through the system document picker |
The page reaches the shell through `window.reasonixHost` and `ReasonixNative`,
defined in `desktop/frontend-next/src/port/host.ts` (`AndroidHost`).
**Phone and desktop share one page build.** What differs only on a phone is
decided at runtime, not by a second set of components. `phoneShell()` in
`src/port/host.ts` and the `[data-shell="android"]` selector in `mobile.css` both
read `<html data-shell="android">`, which `index.html` sets before the bundle
loads.
One attribute feeding both is what keeps style and components from disagreeing
about what a phone is.
## What the page may ask the phone for
`NativeBridge` is reachable from whatever document the WebView holds, so every
method that touches the device asks `trusted()` first.
The activity answers by comparing the **main frame's** origin against the
kernel's and against the one paired computer the person scanned a code for. A
page that navigated elsewhere is not trusted, even though it may still hold the
object.
Five methods answer without the check — `version`, `systemTheme`, `safeArea`,
`setLayerOpen`, `setRunning` — because they report back what the page already
knows about its own window and grant nothing.
`openInApp(url)` is the pairing decision, not a navigation one: it loads a URL in
this window only for the origin the scanner just returned, and only once.
Without that, any page holding the kernel origin could hand itself the bridge.
External links leave through the browser. A non-web scheme is routed to the
system only for `mailto:` and `tel:`; everything else is dropped, because an
`intent://` URL can start an arbitrary exported activity with caller-supplied
extras.
## Permissions, and what they cost
`MANAGE_EXTERNAL_STORAGE` — opening a folder on the phone as a workspace. The
kernel is a Go binary: it opens real paths with `open(2)`, and SAF hands back a
`content://` URI it cannot open.
Requested from the folder-picker action, never at launch. Android shows no dialog
for it and opens system settings instead.
**There is no OS-level sandbox around this kernel.** The PR sets the sandbox to
off on Android, so confining the agent to the chosen folder is Reasonix's own
write-root check and nothing else. A shell tool with all-files access can reach
all shared storage.
`REQUEST_IGNORE_BATTERY_OPTIMIZATIONS` — Doze freezes the app group, which stops
a turn that is still running. Asked once when a turn actually runs, never at
launch, and the person can refuse. Refusing costs battery life during long turns
and nothing else.
**Google Play restricts this permission**: fine for a sideloaded build, a
store-policy risk if this is ever listed.
`FOREGROUND_SERVICE` / `FOREGROUND_SERVICE_DATA_SYNC` — keeping the kernel alive
while the screen is off. `dataSync` is capped per 24 hours from Android 15. It is
the closest honest description of "an agent is working".
`CAMERA` — reading the pairing code a computer shows. Requested when the person
asks to scan, never at launch. `ScanActivity` is not exported.
`READ_EXTERNAL_STORAGE` / `WRITE_EXTERNAL_STORAGE` — the same folder walk below
API 33. `maxSdkVersion`-gated; above 33 they are superseded by the permission
above.
`allowBackup=false` with explicit extraction rules, so a `keystore` or a token in
app storage never leaves the device in a cloud backup.
## Cleartext HTTP
The kernel serves its page on `127.0.0.1:<port>`, and a paired computer serves
the same page over its LAN address. Both are plain HTTP.
Neither address can be written into a `network-security-config`: the port is
chosen at start, the LAN address at scan time, and the format matches literals
and domains, not subnets.
So the config permits cleartext and the boundary is in the code instead.
`shouldOverrideUrlLoading` sends every other http(s) origin to the browser, and
the bridge answers only the kernel and the just-paired computer. A plaintext page
on the LAN cannot become the document holding the bridge.
## What goes into the APK
| Content | Size | Why it is shaped this way |
| --- | --- | --- |
| `lib/arm64-v8a/libreasonix.so` | 45 MB | Go static binary, stripped. It is a `.so` rather than a file in `assets/` because only `nativeLibraryDir` is guaranteed executable — a binary copied to app storage fails on a device whose data partition is mounted `noexec`. |
| `assets/page/` | 14 MB | The frontend build, including the Inter and Noto Sans SC fonts, `noCompress` |
| `assets/LICENSE` | 1 KB | The repository's MIT licence, verbatim. MIT requires the notice and the licence text to accompany a binary distribution. |
`assets/LICENSE` is generated by `sync-page.sh` from the repository's root
`LICENSE`, not committed a second time: a checked-in copy drifts when the root
file is updated.
It sits in `assets/` rather than `assets/page/` because that directory is removed
and rebuilt on every build.
A release APK is about 31 MB.
## Building
**The Gradle wrapper is committed**, jar and all. `build.sh` refuses to run
without `gradlew` rather than generating one from whatever `gradle` is on `PATH`:
the dependency versions are part of the build.
`gradle-wrapper.properties` pins `distributionSha256Sum`, so a mirror that serves
a different distribution zip fails verification instead of being unpacked and
run. Dependency repositories are the official ones only — a mirror belongs in a
user-level init script.
**Signing.** A release with no key configured comes out **unsigned**
(`app-release-unsigned.apk`) with a warning. It used to fall back to the debug
key, which produced an artifact that looked shippable and was signed by a
per-machine key nobody chose: it could not install over the previous build.
Point the build at a real key by writing `keystore/keystore.properties`
(`storeFile`, `storePassword`, `keyAlias`, and optionally `keyPassword`) or by
setting the matching `REASONIX_KEYSTORE*` environment variables. Key material
stays out of the repository and out of build logs.
Debug builds always use the debug key. Signing a debug build with the release key
would let anyone who can read the keystore produce a build that installs over the
shipped one under the same signature.
**Non-ASCII checkout paths.** AGP refuses to build under a path with non-ASCII
characters on Windows unless `android.overridePathCheck=true` is set. That is a
property of one machine's disk layout, not of this project, so it is not in the
repository's `gradle.properties`.
Set it in a user-level `~/.gradle/gradle.properties` or pass
// The extraction script: prefer article/main for content pages,
// fall back to body. innerText preserves visual line breaks. It
// also stamps a ref on every element a person could act on, so the
// kernel can name one in an act step the way the desktop backend
// names an accessibility node. A ref already on an element is kept,
// so it stays the same across snapshots of one document; a fresh
// document starts the numbering over, and the kernel only accepts a
// ref from the snapshot it last read.
valscript="""
(function(){
var seq = window.__rxRefSeq || 0;
var used = {};
var marked = document.querySelectorAll('[data-rx-ref]');
for (var i = 0; i < marked.length; i++) { used[marked[i].getAttribute('data-rx-ref')] = true; }
function roleOf(el) {
var tag = el.tagName.toLowerCase();
var role = (el.getAttribute('role') || '').toLowerCase();
if (role) return role;
if (tag === 'a') return 'link';
if (tag === 'button') return 'button';
if (tag === 'select') return 'combobox';
if (tag === 'textarea') return 'textbox';
if (tag === 'input') {
var t = (el.getAttribute('type') || 'text').toLowerCase();
if (t === 'checkbox' || t === 'radio' || t === 'submit' || t === 'button' || t === 'reset') return t;
return 'textbox';
}
return 'generic';
}
function nameOf(el) {
var n = el.getAttribute('aria-label') || el.getAttribute('placeholder') || el.getAttribute('name') || '';
if (!n) { n = (el.innerText || el.textContent || '').trim(); }
return n.replace(/\s+/g, ' ').slice(0, 160);
}
var sel = 'a[href],button,input,select,textarea,[role=button],[role=link],[role=checkbox],[role=radio],[role=tab],[role=menuitem],[contenteditable=true]';
var els = document.querySelectorAll(sel);
var elements = [];
for (var j = 0; j < els.length; j++) {
var el = els[j];
var ref = el.getAttribute('data-rx-ref');
if (!ref) {
do { seq++; ref = 'e' + seq; } while (used[ref]);
el.setAttribute('data-rx-ref', ref);
used[ref] = true;
}
var raw = (el.value != null && String(el.value) !== '') ? String(el.value).slice(0, 160) : '';
File diff suppressed because it is too large.
Load diff
Loaded 100 of 13133 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
SivanCola
