Resuming a session (reasonix code) whose persisted assistant message holds a
tool_call without a function — e.g. a streaming delta saved before its function
landed — threw "Cannot read properties of undefined (reading 'arguments')" in
hydrateCardsFromMessages, taking down the whole UI at startup. Skip the partial
tool_call; the orphaned tool-output message already no-ops when its card is
absent.
Follow-up polish to the cache-efficiency guardrails (#2314):
- /status "cache detail" line was hard-coded English; route it through i18n
(statusCacheDetail / statusCacheChurn) so it matches every other status row.
EN + zh-CN translated; ja/de/ru inherit EN like the rest of their
observability block.
- sortToolSpecs used localeCompare, which is locale-sensitive and could let
the host locale reshuffle the serialized tool prefix and reintroduce the
very cache churn the sort is meant to prevent. Switch to a stable
codepoint compare. No change for ASCII tool names (all existing tests pass).
Co-authored-by: yhh <[email protected]>
Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>
#2252 added a 15s AbortSignal.timeout to searchBing; the other engines
(Searxng, Metaso, Baidu, Tavily, Perplexity, Exa, Ollama, Brave) still
relied on opts.signal only and could hang indefinitely.
Extract searchSignal() helper that combines the caller's abort signal with
a per-request SEARCH_TIMEOUT_MS cap, and apply it uniformly.
Bing 搜索缺少 AbortSignal.timeout(),响应慢或被墙时请求会无限挂起,
导致 web search 工具卡死在 research 步骤。添加 15 秒超时并与外层 signal 组合。
fix(web): add 15s timeout to searchBing to prevent infinite hangs
Bing search lacked AbortSignal.timeout(), causing infinite hangs on slow
responses or blocked connections. This left the web search tool stuck in
the research step. Add a 15s timeout combined with the outer signal.
Closes#2241
Co-authored-by: Claude Opus 4.7 <[email protected]>
侧边栏拖拽最小宽度从 160px 调整为 200px,防止拖拽时「新建会话」文字被隐藏(CSS 在 ≤190px 时隐藏文字)。
Increase sidebar minimum drag width from 160px to 200px to prevent the "New Chat" text from being hidden when dragging (CSS hides text at ≤190px container width).
Closes#2166
Co-authored-by: Claude Opus 4.7 <[email protected]>
Co-authored-by: multica-agent <[email protected]>
Users who want a fresh session each time (e.g. agents calling reasonix
in loops) had to manually pass --no-session every invocation. Add:
- config.autoResumeSession (default true = existing behaviour)
- /session-persist on|off slash command to toggle and persist the setting
- resolveSession() respects the new flag: when false, skips the 'default'
session fallback so each launch starts with a new timestamped session
## What
New unified \`PlanPanel\` right-side component replacing the modal-overlay pattern.
Covers five plan states: pending / refining / executing / checkpoint / revising.
Layout changes:
- App.tsx: side-by-side flex layout — left conversation column at 35% width,
right PlanPanel at flexGrow=1 when plan is active
- LiveActivityArea: new \`suppressPlanLiveRow\` prop avoids duplicate plan card
- Refine flow: inline plan body display + text input instead of separate modal
## Why
The current modal-overlay pattern replaces the composer area with plan modals,
hiding the conversation. A persistent right panel keeps the conversation visible
while showing plan detail, and the inline refine flow lets users reference the
plan body while typing feedback instead of switching to a blank text input.
## How to verify
1. Start plan mode, let model submit a plan — panel opens on right
2. Click refine — plan body stays visible, input appears below
3. Click approve — panel persists showing step progress
4. Complete all steps — panel auto-closes
5. Confirm conversation still scrollable, composer accessible at bottom-left
The theme system defines SURFACE.bg and SURFACE.bgInput but no
component applied them — the entire UI rendered on the terminal's
default background, causing:
- Input text invisible when terminal bg differs from theme
- No visual separation between card stream and input area
- Theme surface colors completely unused
Add backgroundColor to three layout containers:
- App root Box → SURFACE.bg (app canvas)
- ComposerArea wrapper → SURFACE.bgInput (input dock)
- PromptInput bordered Box → SURFACE.bgInput (input field)
Co-authored-by: HUQIANTAO <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
Adds a top-level `shellAllowedGlobal` config list, auto-approved across ALL
projects and merged (union) with the per-project allowlist when deciding
whether a shell command needs approval. Manage it via a `--global` (or `-g`)
flag on the existing `/permissions` subcommands:
/permissions add --global <prefix>
/permissions remove --global <prefix-or-N>
/permissions clear --global confirm
/permissions list # now shows a Global section above Project
The flag is parsed as a flag (not a positional keyword), so command prefixes
like `g` or `global` remain manageable from the slash UI.
`shellAllowedGlobal` is registered in `STRING_ARRAY_FIELDS` so a malformed
hand-edited value is sanitized on read instead of crashing the merge in
`code/setup.ts`'s `extraAllowed` getter.
Config accessors (load/add/remove/clearGlobalShellAllowed) mirror the
project ones; EN/zh-CN/ja/de strings added (ru falls back to EN).
The scroll-follow useEffect had no dependency array, so it ran on every
render but did not check atBottomRef — meaning it would try to re-pin
even when the user had scrolled up to read earlier content, and conversely
the missing dep array caused React to skip the effect in some batched
renders during fast streaming.
Add a guard on atBottomRef.current and a proper [messageItems] dependency
so the effect only fires when new messages arrive and only scrolls when
the user is already pinned to the bottom.
Claude Code .mcp.json files commonly use ${TOKEN_NAME} or ${env:TOKEN_NAME}
in header values (e.g. Authorization: Bearer ${API_KEY}). Reasonix was
passing these through as literal strings, making migration from Claude Code
require manual header editing.
Add expandEnvInRecord() which resolves ${VAR} and ${env:VAR} patterns in
header records at normalization time. Unset variables are left as-is.
The two symlinked-skill tests added in #2137 — "loads skills from
symlinked directories (#2104)" and "skips broken symlinks gracefully" —
call symlinkSync with no Windows guard, so `npm run verify` fails with
EPERM for contributors on Windows that lack Developer Mode / admin. CI's
Windows runner has the privilege so it slipped through. Add
`.skipIf(process.platform === "win32")`, matching the #2124 symlink tests
already in this file.
Co-authored-by: yhh <[email protected]>
Skills following the Anthropic Skills spec ship a references/ subdirectory
with depth material. Reasonix only loaded SKILL.md, leaving [[references/...]]
wikilinks as dead text and making the depth content invisible to the model.
Append each references/*.md file to the skill body at load time under a
'## Reference: <slug>' header (sorted alphabetically). This follows Option A
from the issue: zero protocol overhead, all depth material available immediately.
Only dir-layout skills (those with a SKILL.md) can have a sibling references/;
flat <name>.md skills are unaffected.
By default api.deepseek.com is in NO_PROXY so clash/v2ray users avoid 403s
from shared exit IPs. Corporate users whose firewall blocks direct egress get
a silent 'fetch failed' with no guidance.
Add a stderr hint when api.deepseek.com is bypassed, pointing users to
REASONIX_PROXY_DEEPSEEK_DIRECT=0 or bypassDeepSeekDirect:false in config.
When REASONIX.md or a global memory file is edited between sessions, the
system prompt is rebuilt on next launch and the resumed session gets a full
cache miss with no explanation. This adds a one-time warning on resume
when the system prompt fingerprint differs from what was saved.
- session.ts: add hashSystemPrompt(); add systemFingerprint to SessionMeta
- App.tsx: save fingerprint on every turn; compare on resume and warn
- i18n/types.ts + EN + zh-CN: systemPromptChanged + systemPromptChangedDetail
## What
Add abortTurn(tab) in the plan_response cancel handler.
## Why
When the user cancels a plan, the agent loop continues running. The
model receives the cancellation signal via pauseGate but the in-progress
turn is not aborted, causing the model to re-submit the plan or continue
generating output that the user already rejected.
## How to verify
1. Start a session with plan mode enabled
2. Let the model submit a plan via submit_plan
3. Click Cancel in the plan approval
4. Confirm the agent loop stops immediately — no further streaming or
tool calls from the rejected turn
* fix(ink): add dependency arrays to useBoxMetrics and useTerminalViewport to prevent scroll jitter (#2076)
- useBoxMetrics: add [ref.current] deps so measurement only runs when element changes
- useTerminalViewport: add [elementRef.current, terminalSize] deps to skip expensive parent-chain walk on every render
- App: memoize TerminalSizeContext.Provider value to keep reference stable
During rapid mouse wheel scrolling (10-20 events/100ms on Windows), the
missing dependency arrays caused each wheel event to trigger 3-5 cascading
renders (30-80 renders/100ms), producing visible text jitter.
* fix(ink): address PR #2095 review — remove ref.current anti-pattern from hook deps
- useBoxMetrics: remove [ref.current] dep array (React anti-pattern);
add 16ms throttle to limit measurement frequency during rapid scrolling
- useTerminalViewport: remove elementRef.current from deps, keep only
[terminalSize] as the reactive dependency
- Add regression test verifying useBoxMetrics re-measures on parent resize
* feat(prompt): prefer MCP search tools over built-in defaults
Add a `# Tool Selection` section to the default system prompt that
instructs the model to prefer MCP-provided tools (e.g. Exa) over
the built-in web_search/web_fetch. MCP tools typically offer
higher quality — semantic search over keyword matching, date and
domain filtering. The instruction includes a fallback to built-in
tools when MCP tools are unavailable.
This is a low-risk change: one paragraph of prompt text, no
runtime overhead, and fully backward-compatible.
* feat(prompt): prefer MCP search tools over built-in defaults
* revert: cli/index.ts back to upstream original
* feat(prompt): add MCP tool selection guidance to code system prompt
* fix(server): convert sync fs I/O to async across server API layer and session memory
Replace blocking readFileSync/writeFileSync/readdirSync/statSync/existsSync
with non-blocking readFile/writeFile/readdir/stat from node:fs/promises in
all server API handlers and session.ts. This prevents the event loop from
blocking on disk I/O during concurrent HTTP requests.
- assets.ts: async cached reads (resolveAssetDir stays sync for module load)
- skills.ts, memory.ts, hooks.ts, browse.ts, project-tree.ts, files.ts,
checkpoint-diffs.ts, health.ts, sessions.ts: async handlers
- session.ts: added async variants (listSessionsAsync, deleteSessionAsync,
loadSessionMessagesAsync, readTailMessagesAsync, etc.)
- atomic-write.ts: added async atomicWrite alongside sync atomicWriteSync
- index.ts: await renderIndexHtml/serveAsset in dispatch
Co-Authored-By: Claude Opus 4.7 <[email protected]>
* style: fix biome formatting and lint errors
- files.ts: add explicit Stats type annotation (noImplicitAnyLet)
- browse.ts: organize imports
- assets.ts, skills.ts, memory.ts, sessions.ts, session.ts,
atomic-write.ts: biome format (line length, trailing commas)
Co-Authored-By: Claude Opus 4.7 <[email protected]>
* fix(test): await async serveAsset/renderIndexHtml in dashboard smoke tests
These functions now return Promises after the sync→async conversion,
so the test calls must await them.
Co-Authored-By: Claude Opus 4.7 <[email protected]>
* style: remove banner separator comments in session.ts
Co-Authored-By: Claude Opus 4.7 <[email protected]>
* fix: eliminate TOCTOU race in memory file read
Read the file directly instead of stat-then-read to avoid a window
where the file could be deleted between the two calls. CodeQL flagged
this as a potential file system race condition.
Co-Authored-By: Claude Opus 4.7 <[email protected]>
---------
Co-authored-by: HUQIANTAO <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
* fix(theme): meet WCAG AA contrast for fg.faint and fg.meta across all themes
fg.faint failed WCAG on all 4 dark themes (ratios 1.63-2.56:1, need 4.5:1).
fg.meta failed on midnight (2.35-2.91:1) and was borderline on others.
Dark theme bgElev (#151d2f) was too close to bgInput for surface distinction.
Changes per theme:
- dark: meta #778294→#9aa5b5, faint #4d5666→#8791a3, bgElev #151d2f→#1c2844
- light: meta #6b7280→#5c6371, faint #9ca3af→#666d7b
- midnight: meta #565f89→#9da5bb, faint #414868→#8a92a8
- deep-blue: meta #808080→#909090, faint #606060→#8c8c8c
- high-contrast: already passes, no changes
* fix(ui): replace dim with explicit colors in ReasoningCard and ToolCard
- ReasoningCard: replace `dim` prop with explicit `FG.sub` color
- ToolCard: replace conditional `dim` with explicit `FG.faint`/`errColor`
Co-Authored-By: Claude Opus 4.7 <[email protected]>
* fix(ui): replace all remaining ANSI dim with explicit FG.faint colors
Replace every remaining `dim` prop across 22 UI components with explicit
`color={FG.faint}` (or conditional color logic where dim was used as a
boolean toggle). The ANSI `dim` attribute (SGR 2) halves brightness of
the foreground color, causing near-invisible text on dark terminals
where the default foreground is already low-contrast.
Components fixed:
- mcp-browse, AtMentionSuggestions, DiffApp, EditConfirm
- McpBrowser, McpHub, McpMarketplace
- PlanReviseConfirm, PlanStepList
- RecordView, ReplayApp, Select, Setup
- SlashArgPicker, SlashSuggestions, SplitDiff
- StatsPanel, Wizard, char-bar, ctx-breakdown
- markdown-view (SpanText ambientDim), primitives (Bar, ContextCell)
For conditional dim (e.g. `dim={isDone}`), replaced with conditional
color logic (`color={isDone ? FG.faint : originalColor}`). The Bar
component's `dim` prop was removed entirely — callers now pass the
appropriate color directly.
Co-Authored-By: Claude Opus 4.7 <[email protected]>
---------
Co-authored-by: HUQIANTAO <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
- dashboard/src/i18n/ja.ts: rewrite from standalone 1333-line file to spread
pattern with `...en` fallback; keep only 5 translated sections (app, changes,
common, settings, chat), remove ~30 English-copy sections
- desktop/src/i18n/ja.ts: add `...en.sectionName` spreads to all 30+ sections
including nested objects (app.toast, app.cmd, app.skill, app.titlebar, etc.)
- src/i18n/JA.ts: add `import { EN } from "./EN.js"`, `...EN` top-level spread,
and `...EN.sectionName` spreads to all 46+ sections including deeply nested
objects (slash.*, handlers.*, planFlow.*, ui.*, wizard.themeCaption,
modelPicker.effortDesc)
Missing keys now fall back to English instead of returning undefined.
Co-authored-by: HUQIANTAO <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
Replace per-key `new RegExp(\`\\{${k}\\}\`, "g")` with native
`replaceAll(\`{${k}}\`, String(v))` — avoids regex construction overhead
on every translation lookup. ReadConfig cache already merged in #2162.
Co-authored-by: HUQIANTAO <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
- Create desktop/src/i18n/ru.ts and dashboard/src/i18n/ru.ts using the
spread-fallback pattern (...en), so all keys fall back to English
- Register "ru" in both index.ts: Lang type, SUPPORTED_LANGS, LANG_LABELS
("Русский"), dicts, and detectDefault (navigator.language starts with "ru")
Co-authored-by: HUQIANTAO <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
* fix(desktop): resolve FilePill click path against session-tracked files
When clicking a file reference (FilePill) in the desktop chat view, the
path was resolved by blindly joining workspaceDir + displayText. This
fails when the AI writes a short path in conversation (e.g. 'config.yaml')
but the actual file lives in a deeper subdirectory or outside the workspace.
Now resolveAgainstWorkspace first attempts suffix matching against
sessionFiles — paths tracked from actual tool call arguments (read_file,
edit_file, write_file, multi_edit). If a match is found, the tracked path
is used as the base; if absolute it's used directly, if relative it's
resolved against the workspace. Falls back to the old behavior when no
match is found.
Also excludes src-tauri/target/ from Vite's file watcher to prevent
EBUSY crashes on Windows.
* fix(desktop): positional matching for ambiguous file pill resolution
When multiple session files have the same basename (e.g. a/1.yaml and
b/1.yaml), suffix matching alone cannot distinguish them. Add positional
matching: the Nth FilePill in the conversation text maps to the Nth
tool-call path in currentToolPaths (per-message context).
Also pass currentToolPaths through WorkspaceContext so each assistant
message's text segments can resolve file references against the tool
calls that happened in the same message.
`readEntry` used `Dirent.isDirectory()/isFile()` to classify entries, but
both return false for symlinks even when the target is a directory or file
— so a `skills.sh`-style `~/.agents/skills/` layout that symlinks every
skill into a central repo silently saw zero entries with no error or
warning. Resolve symlinks via `statSync` to get the real target type
before branching; a broken symlink is skipped silently instead of
aborting the whole scan.
Add a dirty flag to AppendOnlyLog that tracks mutations (append, extend,
compactInPlace, initWindow). The two expensive full-scan consumers —
healActiveLogBeforeSend() and getLogTokens() — now check+clear this flag
and return a cached result when the log hasn't changed since the last call.
This eliminates 3-4 full array passes with tokenization of every tool-call
argument JSON on every agent-loop iteration when no new messages were
appended — the common case between the model's response and the next
tool-call dispatch.
Changes:
- AppendOnlyLog: add _dirty flag, consumeDirty() method, set on mutations
- CacheFirstLoop: cache healActiveLogBeforeSend() result, skip when clean
- ContextManager: cache getLogTokens() result, skip when clean
Co-authored-by: HUQIANTAO <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
* feat: expand Reasonix theme palettes
* fix: align localized CLI theme choices
Show localized theme labels while preserving stable theme IDs for config and slash commands.
Expose the same public theme list in CLI, dashboard, and desktop, while keeping legacy theme aliases accepted.
* fix: preserve resolved theme picker selection
Use the normalized visible theme as the picker initial value so legacy saved values such as dark select Graphite instead of falling back to auto.
* fix: keep porcelain accent additive
Adds /max-tokens <N|off> slash command and persisted maxOutputTokens config
field so users can limit output tokens per turn, preventing runaway reasoning.
- config: maxOutputTokens field, load/saveMaxOutputTokens accessors
- loop: stored on loop instance, passed as max_tokens to chat and stream calls
- loop/streaming.ts: maxTokens forwarded through StreamModelOptions
- slash: new /max-tokens setup-group command with handler + i18n (EN/zh-CN/de)
- App.tsx: seeded from config on loop construction
Replace hardcoded PILL_SECTION, PILL_PATH, PILL_MODEL constants with
theme-aware functions (pillSection, pillPath, pillModel) that read from
a new `pill` field in ThemeTokens. This ensures Pill components respect
the active theme instead of using static colors that ignore user theme
choices.
Adds `pill()` derivation function in tokens.ts following the existing
CARD proxy pattern, and exports PILL via proxyTokens().
Co-authored-by: HUQIANTAO <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
- auto-git-rollback: write_file output changed from 'wrote N chars' to
'edited ... (M→N chars)' unified-diff format (#2173); update regex.
- slash + ui-slash-suggestions: Telegram /telegram command added by #2168
brings the release command count from 43 to 44; update both assertions.
* perf: eliminate sync I/O from agent loop hot paths
Three independent cache layers that together remove redundant disk reads
and deep-cloning from the per-iteration fast path:
1. readConfig() mtime cache — 37+ calls per session each did readFileSync
+ JSON.parse; now statSync (~0.005ms) short-circuits on mtime hit.
writeConfig() invalidates so writes are immediately visible.
2. ImmutablePrefix.tools() — every loop iteration deep-cloned the full
tool-spec array via structuredClone (~hundreds of KB for 20+ tools).
Now returns a frozen shallow copy, invalidated only by addTool/removeTool.
3. AppendOnlyLog.toFullHistory() — buildMessages() calls this 2-3x per
iteration; when the log window doesn't cover full history, each call
did sync openSync/readSync/closeSync in 64KB chunks. Now caches the
parsed result keyed by totalLength, invalidated by append/compactInPlace.
* fix(config): eliminate TOCTOU race in readConfig via fd-based atomic read
Use openSync → fstatSync(fd) → readFileSync(fd) → closeSync so the
mtime check and content read operate on the same file descriptor,
removing the CodeQL-flagged race window.
Also:
- Add immutability + mtime caveat comments on _configCache
- Type tools() return as readonly ToolSpec[]; widen ChatRequestOptions
and StreamModelOptions to accept readonly arrays
Co-Authored-By: Claude Opus 4.7 <[email protected]>
* fix: use cryptographically random temp file names (CodeQL)
Replace predictable temp file names (based on process.pid, Date.now,
Math.random) with crypto.randomBytes in all 3 atomic-write call sites
to prevent symlink-following attacks on temp files.
Fixes CodeQL "Insecure temporary file" alert on PR #2162.
Co-Authored-By: Claude Opus 4.7 <[email protected]>
---------
Co-authored-by: HUQIANTAO <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
* perf: optimize tokenizer hot paths and prompt builder
Four independent optimizations targeting CPU and allocation pressure in
the token-counting and prompt-formatting pipeline:
1. byteLevelEncode: O(n²) += loop → pre-allocated array + join("")
For a 10KB text chunk this eliminates ~10K intermediate string copies.
2. countTokens: skip number[] allocation — encode(text).length built a
full token-ID array just to read .length. New version counts inline,
saving ~60KB of transient heap per 50KB input string.
3. formatDeepSeekPrompt: += string concatenation → parts[] + join("")
The prompt can be 100K+ chars in long sessions; += copies the entire
accumulator on each iteration, making it O(n²). Array push + join is O(n).
4. cachedBoundedTokens: skip caching strings >10KB in the content-token LRU.
Without this guard, 4096 entries of 50KB+ tool outputs can retain 200MB+
of string keys. Small strings (the common case) still cache normally.
* test(tokenizer): pin countTokens ↔ encode equivalence across a corpus
Add a regression test that asserts countTokens(x) === encode(x).length
for 17 inputs covering: empty string, plain ASCII, CJK, emoji (surrogate
pairs), special/added tokens, code, JSON, repeated text, whitespace, and
a >10KB blob. This is the safety net that makes the countTokens
duplication (which avoids allocating the full number[] array) safe to
live with — any future tokenizer drift will be caught immediately.
Co-Authored-By: Claude Opus 4.7 <[email protected]>
---------
Co-authored-by: HUQIANTAO <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
* fix(desktop): composer inline mentions, command chips, and text highlighting
- Allow @ and / insertion at any cursor position (not just end-of-text)
by replacing $ regex anchor with cursor-position-based active-range
detection via findActiveRange / activeRangeRef.
- Remove redundant chips from non-insertOnly slash commands (they
execute immediately and the chip added confusion).
- Derive mention/command chips from draft text (useMemo) instead of
imperative state; remove X dismiss button so chips are read-only
indicators that always match the text.
- Add textarea overlay (composer-backdrop) for @path / /cmd
highlighting via highlightTokens + transparent textarea technique.
- Add onSelect handler so clicking or arrowing into an existing @word
or /word opens the popup for inline editing.
- Sync backdrop scroll position with textarea via onScroll handler.
* fix(desktop): truncate long chip labels to filename, themed scrollbar
* fix(desktop): hide textarea scrollbar to keep backdrop alignment
* fix(cli): commit settled cards to native scrollback
* fix(cli): freeze verbose state for static history
---------
Co-authored-by: Reasonix Test <[email protected]>
* fix: batch store notifications to prevent React max update depth (#2123)
During rapid streaming, dozens of chunks arrive within a single
event-loop drain. Each dispatch() synchronously notified all
useSyncExternalStore listeners, causing React to re-render on
every single token. When renders couldn't keep up with the
streaming speed, nested updates exceeded React's 50-update limit
and threw 'Maximum update depth exceeded'.
Defer state-listener notification via setTimeout(0) so all
synchronous dispatches within the same tick coalesce into a single
notification burst. Event listeners (non-React) are still notified
synchronously for transcript/logging consumers.
Closes#2123
* fix: correct misleading RAF comment, add store batch-notify test
- Replace 'RAF-batched' with 'Macrotask-batched' in store.ts comment
(code uses setTimeout(0), not requestAnimationFrame)
- Add focused test covering dispatch→stateListeners batching path:
state listeners coalesced to one macrotask, event listeners remain
synchronous per-dispatch
* fix(ink): reduce VS Code terminal lag by throttling drain and debouncing damage (#2080)
- Increase scroll drain interval from 4ms (~250fps) to 16ms (~60fps) to
stop overwhelming xterm.js single-threaded ANSI parser
- Only trigger full-screen damage on selection/highlight TRANSITION frames
(activate/deactivate), not every frame while continuously active, cutting
~50% diff work in VS Code terminal
- Coalesce microtask queueing to prevent leading+trailing throttle edges
from double-firing onRender ~0.1ms apart (acknowledged jank in comments)
* fix(ink): remove no-op selTransition/hlTransition change per review
Keep drain interval fix (4ms→16ms) and microtask coalescing.
Remove selection/highlight transition tracking which was a no-op:
prevFrameContaminated already forces full-screen damage every frame
while selection/highlight is active, making the transition tracking
redundant.
* fix(desktop): auto-switch to new session after deleting active session
When the user deletes the currently-active session via the sidebar,
the UI remained stuck on the now-deleted session. Now the backend
detects when the deleted session is the active one and:
1. Aborts any in-flight turn
2. Mints a fresh session for the workspace (reusing startNewChatInTab)
3. Emits \$session_loaded to the frontend so it navigates to the new session
* fix(desktop): emit ctx_breakdown after deleting active session
Add emitCtxBreakdown(tab) call after $session_loaded in the
session_delete active-session branch, matching the canonical
session_load path. Without it, the frontend context-usage bar
reads 0 until the next turn fires a fresh $ctx_breakdown.
- StatusBar: display cache hit ratio to 2 decimal places (e.g. 72.13%)
- StatusBar: show hit/total token details on hover (tooltip)
- StatusBar: cap displayed value at 99.99% unless truly 100.00%
- UsageFull: update pct() helper to return 2-decimal precision
- MetricStrip: accept pre-formatted string for cacheHit prop
Applies to both desktop/ and dashboard/.
SkillStore.readEntry() used entry.isDirectory() to detect skill
directories, but Node.js Dirent.isDirectory() returns false for
symlinks. This caused symlinked skill directories to be silently
skipped with no error or warning.
Added isSymbolicLink() check with statSync fallback to resolve
symlinks and verify the target is a directory. Broken symlinks
are safely skipped without throwing.
Closes#2104
Add a user-configurable per-model context-window override so third-party
models (e.g. mimo, qwen) no longer fall back to the 131 K default that
triggers premature auto-compact.
- config: new contextTokens field (Record<string, number>)
- stats: new resolveContextTokens(model) — user config > built-in > 131K
- context-manager / observability / ctx-breakdown / StatusRow: use it
- desktop settings: context-window size input below custom model ID
- desktop protocol: contextTokens in SettingsPatch
- i18n: en / zh-CN / ja / de strings
- tests: 4 new loadContextTokens round-trip + validation cases
Commands like \`find / -name "xxx"\` bypassed the sandbox because
path arguments were never checked against the workspace boundary.
Only redirect targets and sensitive-path prefixes were validated.
Add a workspace-escape check in \`isAllowed\`: when \`projectRoot\`
is provided, any non-flag argument that resolves to an absolute
path outside the project root demotes the command back to the
confirm gate (user approval required).
Affected patterns:
- find / —name ...
- tree /etc
- grep foo /etc/passwd
- cat /opt/external/file
Workspace-relative commands (find ., tree src, cat README.md)
remain auto-allowed as before.
Co-authored-by: Yapu <[email protected]>
* feat(desktop): add /retry to QQ remote commands
* feat(desktop): add model and mode QQ commands
* fix(desktop): gate QQ model and plan changes behind busy state
* feat: configurable maxIterPerTurn per-turn iteration cap (#2037)
The main loop had no hard iteration limit — a runaway model could consume unlimited API budget. Added maxIterPerTurn config (default 9) with env override REASONIX_MAX_ITER. Plumbed through all loop construction sites (App, desktop, run, acp). Updated i18n strings.
* fix: address review feedback — default 50, drop per-iter env lookup, add iterLimitReached type
- Change DEFAULT_MAX_ITER_PER_TURN from 9 to 50 (real workloads need 15-30 calls)
- Remove redundant parsePositiveIntEnv() inside the loop; use this.maxIterPerTurn directly
(loadMaxIterPerTurn() already resolves config > env > default at construction time)
- Add iterLimitReached to i18n types (fixes CI build failure)
- Move cap check before model call to avoid wasting an API request on the cap-hit iter
- Add test for custom maxIterPerTurn option
* fix: reconcile field doc default to 50
Commands like \`find / -name "xxx"\` bypassed the sandbox because
path arguments were never checked against the workspace boundary.
Only redirect targets and sensitive-path prefixes were validated.
Add a workspace-escape check in \`isAllowed\`: when \`projectRoot\`
is provided, any non-flag argument that resolves to an absolute
path outside the project root demotes the command back to the
confirm gate (user approval required).
Affected patterns:
- find / —name ...
- tree /etc
- grep foo /etc/passwd
- cat /opt/external/file
Workspace-relative commands (find ., tree src, cat README.md)
remain auto-allowed as before.
Completed tasks were rendered as `[x]` markdown which appears as
strikethrough text — still visible and cluttering the display. Filter
them out so only pending and in_progress items are shown, while the
header line still reports the done count.
Co-authored-by: 王锦坤 <[email protected]>
Dashboard + desktop ja.ts missed webSearchEngineBingIntl from #1990;
root JA.ts missed builtinSkills.qq from #2004. Both broke the
required-key check on the strict TranslationSchema, failing CI
typecheck on main.
* fix(desktop): add DeepSeek API and updater domains to CSP connect-src
The desktop app's Content Security Policy was missing required domains
in the connect-src directive, causing requests to fail:
- https://api.deepseek.com — DeepSeek API calls
- https://pub-147fb53b9c1e4bbf891a257968619ea7.r2.dev — updater R2 CDN
- https://github.com — updater GitHub Releases fallback
Changes:
- Added only essential domains (no wildcards, no dev-only localhost)
- Added regression test to prevent future removal
Comparison with PR #2033:
- More restrictive: uses specific R2 URL instead of *.r2.dev wildcard
- Removes unnecessary domains: *.githubusercontent.com, localhost, ws://
- Better security posture for production builds
Closes#2020
* fix(desktop): change Porcelain theme accent color from orange to purple
The Porcelain (light) theme had --accent set to orange (hue 36) instead
of purple (hue 285), causing buttons to appear orange instead of purple.
Changes:
- Changed --accent from oklch(58% 0.18 36) to oklch(56% 0.12 285)
- Changed --accent-soft and --accent-strong to match purple hue
- Now consistent with Midnight theme which uses purple accent
Closes#2022
---------
Co-authored-by: Bernardxu123 <[email protected]>
The permission approval prompts (ConfirmApprovalCard / PathAccessApprovalCard)
in the desktop and dashboard UIs could previously only be granted by clicking.
Wire the global key handler so Enter grants the pending authorization (run
once) when focus is outside an editable field and no modal is open, mirroring
the TUI where Enter confirms the highlighted choice.
Closes#1962
Subagent child-loop usage (cost, cache hit/miss, completion tokens) was written to the global usage.jsonl log but never folded back into the parent session SessionStats. The TUI stats panel and session meta only saw the parent loop API calls.
Added SessionStats.recordExternal() to fold external usage into carryover without creating a turn entry. Wired it through useSubagent onSubagentEnd callback so subagent completion feeds usage back to the parent stats.
Fixes#2008.
MCP servers default to a 60s per-request timeout. Some servers need more. Added requestTimeoutMs to McpServerConfig, McpServerSpec, and all McpClient construction sites so the timeout is configurable per-server in .reasonix/config.json mcpServers section. Plumbed through: mcp-runtime, run, acp, mcp-inspect, reconnect.
- Desktop now bridges both legacy cfg.mcp and canonical cfg.mcpServers.
- Empty-MCP hint, doctor report, install collision checks, dashboard API
all updated to use normalizeMcpConfig() instead of cfg.mcp directly.
- Add regression tests: desktop-mcp-servers + mcp-tui-survival.
Fixes#1993
Refs #2002
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
The ja locale added in #1915 was missing keys that broke `tsc --noEmit`
in desktop/: app.cmd.skill, the sidebarPanel workspace + session-import
strings, settings.webSearchEngine{Brave,Ollama}, and the matching
webSearchApiKey.{brave,ollama} entries. Backfill them with Japanese
translations so the desktop package typechecks again.
* fix(desktop): protect \[4pt] spacing and replace | with \vert in math
* fix(desktop): protect \[4pt] spacing and replace | with \vert in math to avoid GFM table breakage
---------
Co-authored-by: Xingbo Zhao <[email protected]>
* feat(i18n): add Japanese (ja) locale
- src/i18n/JA.ts: full JA translation for CLI/TUI (~1900 lines)
- desktop/src/i18n/ja.ts: full JA translation for desktop shell (~740 lines)
- dashboard/src/i18n/ja.ts: JA translation for dashboard SPA (~1320 lines)
- All three index.ts: register 'ja' in Lang type, dicts, detection, labels
- Wizard.tsx: add 日本語 to language picker
* chore(i18n-ja): fix registration casing + missing keys + lint
- src/i18n/index.ts: register translations.ja with JA (uppercase
export), not the undefined `ja` identifier
- src/i18n/JA.ts: add braveMissingKey / braveUnauthorized /
braveRateLimit / braveServerError / braveParseError (added on
main in #1916 after this branch forked)
- dashboard/src/i18n/ja.ts: add webSearchEngineBrave /
webSearchEngineOllama (added on main in #1916 / #1900)
- tests/i18n-detect.test.ts: ja-* variants map to ja; allow ja+ru
in the Intl-default-arg check
- biome --write across the new ja files and index registrations
---------
Co-authored-by: reasonix <[email protected]>
useBoxMetrics ran a useEffect with no dependency array and called
setSize inside, so any Box whose content shape depended on its own
measurement (directly, or transitively via a store-reported height)
oscillated within a single React commit batch and crashed with
"Maximum update depth exceeded". The crash surfaced in two stacks:
1. Direct: setSize inside useBoxMetrics' useEffect.
2. Indirect: MeasuredCard.useEffect reports a new height after each
oscillating measurement → chat-scroll-store's debounced
flushShrink fires → set() notifies → React's nestedUpdateCount
overflows on the next forceStoreRerender.
Both point to the same root cause: synchronous setState chains
ratcheting React's depth counter without macrotask separation.
Each measure is now scheduled via setTimeout(0). The store update
that follows starts a fresh root render instead of chaining inside
the depth counter, so oscillating call sites still don't converge to
a single value (the underlying anti-pattern in the caller is unchanged)
but the user no longer sees a crash.
Update the existing oscillator repro test to assert the new property:
no max-depth crash + heights still alternate (proving we haven't
silently converged the anti-pattern, just stopped the crash).
Co-authored-by: reasonix <[email protected]>
Context-guard and stuck-state recovery were calling
ctx.client.chat({ model: "deepseek-v4-flash" }) regardless of what the
user actually configured. Third-party DeepSeek-compatible endpoints
(mimo, self-hosted, Azure forks) that don't expose flash 400 on every
force-summary, the recovery path crashes, and the session looks like
it lost context — the messages are still there, but the user sees an
error and has no way back without /clear.
Pass this.model through summaryContext() and use it for the summary
call. `thinking: "disabled"` still keeps reasoning tokens off the bill
even when the active model is pro.
Add a regression test that asserts the force-summary path hits the
active model, not flash.
Co-authored-by: reasonix <[email protected]>
* feat(desktop): show all currency balances from user/balance API
DeepSeek's /user/balance endpoint returns a balance_infos array with
separate entries per currency (CNY, USD). The desktop client was only
showing the single largest balance (pickPrimaryBalance), hiding the
other currency.
- Add BalanceInfoItem type and balanceInfos array to BalanceEvent protocol
- Pass all currency balances through emitBalance() in the Node child process
- Store multiple balance infos in the frontend Balance type
- Render all balances as a single segment: \$ X.XX / ¥ YY.YY
- Preserve existing single-balance fallback for backward compatibility
* fixup(desktop): restore click-to-toggle on balance segment
The multi-currency rendering dropped onClick={onToggleCurrency}, breaking
the mouse path to flip the cost segment between CNY/USD. Restore it with
the existing switchCurrency tooltip — the balance now shows both, but
the cost figure still tracks the user's chosen currency.
---------
Co-authored-by: reasonix <[email protected]>
Desktop never wired the hook runner — `buildRuntimeFor` constructed
CacheFirstLoop without `hooks`/`hookCwd`, and `runTurn` had no
UserPromptSubmit/Stop dispatch. So hooks defined in
~/.reasonix/settings.json silently no-op'd in the desktop app even
though they fired fine under `reasonix code`.
Load hooks per tab from `tab.rootDir`'s project scope + global,
thread them into the loop (covers Pre/PostToolUse via the loop's own
trigger), fire UserPromptSubmit before `loop.step` and Stop in the
turn-complete tail, and re-load on workspace switch so project hooks
follow the new root. Non-pass outcomes surface via $error; a blocking
UserPromptSubmit aborts the turn before the prompt reaches the model.
Closes#1942
Co-authored-by: reasonix <[email protected]>
When the SSE stream terminates mid-turn (proxy/LB idle drop, undici
`Error("terminated")`), the loop yields a role:"error" event and
returns. The reducer flips `busy:false` and appends the error card,
but the in-progress assistant message keeps `pending:true` — so the
UI shows a "thinking" spinner above the red error box and looks stuck.
Reported as "对话卡死" in #1660.
Loop has already returned by the time we receive the error, so any
streaming assistant message is no longer streaming. Settle it.
Co-authored-by: reasonix <[email protected]>
Reported: user installed via npx, ran setup, then switched to the
desktop app. Saving a fresh key from the desktop UI updated
config.json but every request still 401'd with the old key as the
masked tail in the error message.
Root cause: loadEndpoint's fallback (no custom baseUrl on either
side) prefers process.env.DEEPSEEK_API_KEY over cfg.apiKey on the
read path — a 12-factor convention. A stale env (User-level Windows
env var, ~/.env, shell rc) then shadowed the just-saved config
forever inside the running Node sidecar.
Fix: have saveApiKey mirror the new value into process.env so the
explicit UI save wins inside the current process. Read precedence is
unchanged — env still beats config for users who deliberately set
DEEPSEEK_API_KEY to override.
Co-authored-by: reasonix <[email protected]>
Context-guard and stuck-state recovery were calling
ctx.client.chat({ model: "deepseek-v4-flash" }) regardless of what the
user actually configured. Third-party DeepSeek-compatible endpoints
(mimo, self-hosted, Azure forks) that don't expose flash 400 on every
force-summary, the recovery path crashes, and the session looks like
it lost context — the messages are still there, but the user sees an
error and has no way back without /clear.
Pass this.model through summaryContext() and use it for the summary
call. `thinking: "disabled"` still keeps reasoning tokens off the bill
even when the active model is pro.
Add a regression test that asserts the force-summary path hits the
active model, not flash.
Co-authored-by: reasonix <[email protected]>
Desktop palette had no /skill entry, so typing /skill (which works in
the CLI) showed "no matches". Add /skill + /skills as palette commands
that open Settings → Skills, and handle the same names on submit so
pressing Enter goes there too (mirrors the /search-engine special case).
Co-authored-by: reasonix <[email protected]>
When launched with cwd=/ (e.g. some daemon/IDE contexts), saveTruncatedResult
joined the project root to .reasonix and tried to mkdir /.reasonix/truncated-results,
which fails with ENOENT and crashes run_skill on oversized results.
Treat fs-root rootDir the same as empty and write under the user's home dir
instead. Closes#1959.
Co-authored-by: reasonix <[email protected]>
`truncateForModel` and `truncateForModelByTokens` slice on UTF-16 code
units. When the cut lands inside a surrogate pair (emoji, supplementary
CJK) the resulting head ends with a lone high surrogate / tail starts
with a lone low surrogate. The lone-surrogate sanitizer in `client.ts`
catches one downstream layer, but the safer fix is to never produce
the malformed slice in the first place — keeps tool results clean even
on the disk transcript path that bypasses the client sanitizer.
Reported: HTML file full of emoji caused DeepSeek to reject the chat
request with `serde_json: unexpected end of hex escape at line 1
column 38621` once the file content was sliced to fit the result-token
budget.
Co-authored-by: reasonix <[email protected]>
* fix(web_fetch): fall back to DoH when system DNS returns fake internal IPs
TUN mode proxies (Clash Meta, Sing-box, etc.) use Fake-IP DNS strategy,
returning reserved addresses (e.g. 198.18.0.0/15) for all domain lookups.
The SSRF check in assertPublicHttpUrl treats these as internal hosts and
rejects legitimate public domains like github.com.
Add dohResolve() that queries Cloudflare 1.1.1.1 DNS-over-HTTPS to get
real public IPs. When system DNS returns any internal/reserved address,
fall back to DoH and only reject if the DoH results are also internal.
This preserves SSRF protection while correctly handling DNS pollution
from TUN/mitm proxies.
* test(web_fetch): update SSRF test to account for DoH fallback
The old test asserted that globalThis.fetch was never called when DNS
returned internal addresses. After adding the DoH fallback in the
previous commit, the code now makes a single DoH query to verify.
Update the test to stub fetch with a rejected promise and assert it
calls the correct Cloudflare DoH endpoint.
* fixup(web_fetch): compress dohResolve JSDoc to one line (comment-policy)
---------
Co-authored-by: reasonix <[email protected]>
* fix(desktop): support \[ \] and \( \) math delimiters in markdown
* fix(desktop): protect \[4pt] LaTeX line-break spacing from math delimiter normalization
---------
Co-authored-by: Xingbo Zhao <[email protected]>
Follow-up on #1918 — strip the four loose joints that surfaced in review:
- Replace `(err as any).code` / `(err as any).phase` casts with a small
`errorMeta(err)` narrowing helper in `loop/errors.ts`. Same payload,
no escape hatch.
- Extract `is4xxError` alongside `is5xxError` so the loop's "client
error → not retryable" branch reads like the existing 5xx code path
instead of an inline regex.
- Decouple `recoverable` from `retryable` in the loop's API-failure
yield. `recoverable` is the historical "agent can keep going" flag
(consumed by event listing), `retryable` is the new external retry
hint; conflating them changed event-listing output silently.
- Carry `name` through `ErrorEvent` + eventize so the ACP dispatcher
surfaces the real error name instead of `ev.message.split(":")[0]`.
Co-authored-by: reasonix <[email protected]>
* fix(tui): break CardStream measure→render→measure loop (#1955)
CardStream measured the inner scroll Box via `useBoxMetrics`, derived
maxScroll from `inner.height - outer.height`, then pinned-mode wrote
that back to scrollRows — which feeds into `marginTop` and items
composition, which feeds back into inner.height. Several edit_file
results streaming in one turn was enough to stack the cascade past
React's nested-update limit (50).
Inner height is already known per-card in the chat-scroll store —
the per-card `useBoxMetrics` in MeasuredCard reports it. Summing the
store gives the same total without ever measuring inner, so scrollRows
can no longer feed back into the value used to compute maxScroll.
- ink-update-depth-repro.test.tsx: pins down the underlying pattern
(a component that decides its own render from its own useBoxMetrics
reading trips Max update depth).
- cardstream-architecture.test.tsx: side-by-side pre/post-fix harness
proving the post-fix path stays linear and converges on the right
maxScroll.
Closes#1955
* test(tui): assert oscillation by render count, not Max-depth firing
CI hit a flaky failure: Linux + Windows runners didn't trip React's
nested-update guard within 80ms while local Windows did. The guard
firing is timing-dependent (depends on how the event loop happens to
interleave commits and setInterval) — what's deterministic is that the
broken pattern keeps re-measuring forever. Assert that instead: stable
layouts converge in a few renders, the bad pattern compounds without
bound.
* test(tui): loosen oscillation count threshold for slow CI runners
Windows CI cleared 22-26 renders in 80ms versus hundreds locally;
the 10× multiplier kept tripping. Switch to an absolute floor of 15
— still far above the stable-layout converge (≤ 3) and proves the
"doesn't converge" property without coupling to runner speed.
---------
Co-authored-by: reasonix <[email protected]>
When a proxy/LB idle timeout cuts an SSE stream, undici throws "terminated" as a bare string and ACP headless clients lose the context needed to decide whether to retry. Thread structured `errorDetail` ({name, message, code, phase, retryable, recoverable}) through client → loop → kernel events → transcript → ACP so the failure cause survives every hop.
All changes are additive: `LoopEvent.errorDetail`, `TranscriptRecord.errorDetail`, `SessionPromptResult.transcriptPath`, and `SessionUpdate.metadata.error` are all optional, so existing clients that ignore unknown fields keep working.
Closes#1884.
Replace any with named response shapes (ServerSessionsResponse /
ServerOverviewResponse) so mapSessionItem / emitSessionsSnapshot /
emitOverviewSnapshot read off real fields instead of structural any.
Callers still get any from apiFetch — narrowing happens at the boundary.
Co-authored-by: reasonix <[email protected]>
* fix(desktop): normalize path separators for Windows file opening
Markdown file references and context panel paths use forward slashes from AI output, causing cmd.exe to fail on Windows. Normalize to backslash when the workspace path indicates Windows.
Closes#1869
* chore: retrigger CI
---------
Co-authored-by: Bernardxu123 <[email protected]>
Was a stub `src/vendor/ink/index.d.ts` plus an empty `index.js` (the
real runtime arrived obfuscated, source unreachable). Moving the
source into `packages/ink` as a workspace dep gives consumers real
types and makes the runtime editable in-repo.
API migrations forced by the new stricter types:
- Text/Box `color` is a typed union now (`ansi:<name>` | `#hex` |
`rgb()` | `ansi256()`); bare ansi names get the `ansi:` prefix
- `dimColor` → `dim`; Text's bold/dim discriminated union relaxed
so the two can coexist (terminals collapse them anyway)
- `ThemeTokens` fields typed as `Color` so theme-derived values flow
through helpers / props without manual casts
Markdown OSC 8 hyperlinks switch from `<Transform>` (a shim that
silently ignored the `transform` prop, breaking Ctrl+click hyperlinks)
to `<Link url>`, which uses ink's existing `ink-link` plumbing.
Dropped dead shims: `Transform`, `useAnimation` (zero callers after
the markdown rewrite).
Comment-policy pass on the new package: stripped 638 multi-line
essay block comments to 1-line summaries to match the repo rules.
Co-authored-by: reasonix <[email protected]>
* fix(desktop): separate ctx scrollbar from resize handle
* fix(desktop): add gap beside context scrollbar
* fix(desktop): push thread scrollbar away from right edge (#1695#1793)
* fix(desktop): push thread scrollbar away from right edge
* thread scrollbar hover: thumb expands from 4px to 8px on hover
* fix(desktop): un-pin during scrollbar drag to stop rubber-banding
Three small improvements on top of #1889:
- JS: read the clipboard Blob with file.arrayBuffer() and pass the
ArrayBuffer straight through invoke(). Drops the FileReader → data URL
→ atob → Uint8Array → number[] chain, which inflated the IPC payload
by ~5x on every paste.
- Rust: tighten extension validation. sanitize_image_extension now
requires the post-trim/lowercase value to be 1–8 ASCII alphanumeric
chars, otherwise falls back to "png". Belts-and-braces vs a renderer
passing "png/../../escape".
- Rust: spawn a startup thread that removes files older than 24h from
the pasted-images temp dir so it doesn't grow unbounded between OS
temp wipes.
Includes Rust unit tests for the extension sanitizer.
Co-authored-by: reasonix <[email protected]>
* i18n: add Russian (ru) language pack
* fix(i18n): apply biome format, add ru wizard label + slash.language description
- biome format wrapped long ru.ts lines (CI was red on format).
- LANGUAGE_LABELS in Wizard.tsx now includes ru ("Русский"), restoring the Record<LanguageCode, string> exhaustiveness.
- slash.language entry needs an explicit description override since the spread doesn't carry it through TypeScript's narrowing.
---------
Co-authored-by: reasonix <[email protected]>
Inlining the size/background ternary into JSX made the render branch
hard to read. Move it back into dotProps() — same matrix:
hover/near > active > base, hover transition-delay only when hovered.
Co-authored-by: reasonix <[email protected]>
- Capitalize 30 German sentence starts per orthographic rules
('noch keine ...' -> 'Noch keine ...', etc.)
- Fix terminology: Systemeingabeaufforderung -> System-Prompt,
Denkaufwand -> Reasoning-Effort, Veranstaltungstyp -> Ereignistyp,
Tree-Kill -> Prozessbaum
- Translate ratelimited -> Rate-Limit erreicht across all 6 search engines
- Add missing ui.yoloHint translation (was falling back to English)
- Plural format {e}/{en} -> (e)/(en) for i18n compatibility
- Fix typo: fortgesetzen -> fortgesetzt, awd -> CWD, du -> Du
- Tighten descriptions: zwangsweise/Stelle diesen String vor -> Praefix fuer
- Add German slash-command description coverage test
- Use z.B. consistently instead of z. B.
(42 insertions, 38 deletions)
Co-authored-by: hermitokatt <[email protected]>
Users running an internal Nginx proxy in front of api.deepseek.com pick
the env name from the OPENAI_BASE_URL convention and try
DEEPSEEK_API_BASE_URL. We only read DEEPSEEK_BASE_URL, so the proxy
silently isn't used. Accept the alias (canonical name still wins on
conflict) so the obvious env name works.
Co-authored-by: reasonix <[email protected]>
Desktop and GUI users on Windows often can't reliably set HTTPS_PROXY
for the spawned Reasonix process — env vars set in Clash, system
settings, or PowerShell profiles don't always reach a Tauri-launched
child. The proxy plumbing is in place; only the env-var source path
was wired.
Add cfg.proxy.url as a first-class source: it wins over HTTPS_PROXY /
HTTP_PROXY / ALL_PROXY when set, normalizes bare host:port like the env
path, and tags the install result with source: "config" | "env" so
/doctor can show which one is active.
Closes#1868
Co-authored-by: reasonix <[email protected]>
The drag-path direct DOM writes for --thread-max-width and --composer-max-width
were unitless strings, so the consumer max-width var() fell back to its default
for one frame per mousemove until React's render caught up — a visible flicker
that cancels the perf win.
- Suffix both writes with `px`
- Replace the duplicated formula with the existing getThreadMaxWidth helper
- contain-intrinsic-size: 1px 100px → auto 100px, so the browser remembers
the actual rendered size instead of pinning offscreen messages to 1px wide
Co-authored-by: reasonix <[email protected]>
The web client was POSTing to /api/modal with {id, response}, but
the server expects /api/modal/resolve with {kind, choice, text?},
so every web confirmation returned 405 and the TUI's pauseGate
stayed open. The reverse direction was broken too: the tauri-bridge
SSE handler ignored modal-down, leaving the web modal up after the
terminal user resolved it.
- bridge confirm/choice/plan/checkpoint/revision RPCs through the
real /modal/resolve endpoint with the right body shape
- carry "shell" vs "path" on confirm_response so the server can
route to the matching TUI handler
- emit \$modal_dismissed from modal-down so the web reducer clears
pending lists when another surface resolves first
Co-authored-by: reasonix <[email protected]>
The update notice rendered at the top of the thread scroll area, so a
restored session with messages would scroll the banner out of view and
the user had to open a new tab to see it. Lift it out of `thread-inner`
into a fixed-position overlay anchored to the viewport, rendered once at
the App root instead of per tab.
Co-authored-by: reasonix <[email protected]>
The desktop client had no UI for filling in API keys for web search
engines that require them (metaso, tavily, perplexity, exa) or for the
SearXNG endpoint. The `/search-engine` slash command also fell through
to the chat input instead of being handled locally.
- General settings page now renders a credentials row below the engine
selector that adapts to the chosen engine: a URL input for searxng,
a password input + signup link + clear button for the API-keyed
engines. Existing keys show a masked prefix.
- Server-side `settings_save` accepts `webSearchEndpoint`,
`metasoApiKey`, `tavilyApiKey`, `perplexityApiKey`, `exaApiKey`
(with `null` to clear); `$settings` reports the masked prefix for
each so the UI can render a "set" indicator without leaking the key.
- `/search-engine` and `/se` now open the general settings page
instead of being forwarded as user text.
Closes#1844
Co-authored-by: reasonix <[email protected]>
- Reset activeIdx to 0 on popup.kind switch (slash <-> at) instead of
clamping into the new popup's range, which left users on an arbitrary
row after switching.
- Drop the lastActiveRef guard in Popup — useEffect([activeIdx]) already
reruns only on change.
- Move the conditional class join out of a template literal so the
non-at branch doesn't leave a trailing space.
- Remove unused EditMode / ReasoningEffort type imports from the test.
Co-authored-by: reasonix <[email protected]>
Follow-up to #1857. The argsHint values are BNF over English command
keywords (`connect [appId appSecret [sandbox]] | status | disconnect`)
— there's nothing to translate. The merged zh-CN override dropped the
sub-argument structure and inlined an EN+CN gloss (`connect连接`)
that read awkwardly.
Removing the key lets zh-CN fall back to spec.argsHint, so users see
the same syntax as English and don't lose the appId/appSecret hint.
Co-authored-by: reasonix <[email protected]>
`rootUri` and `workspaceFolders` are LSP concepts, not part of the MCP
2024-11-05 `initialize` schema. Strict servers (e.g. ida-pro-mcp on the
official Python SDK with pydantic) reject the request with
`Invalid params: unexpected parameters: ['workspaceFolders', 'rootUri']`.
Workspace roots are already exchanged the correct way: the client
advertises the `roots` capability, and the server requests them via
`roots/list` (already wired up).
Co-authored-by: reasonix <[email protected]>
The test was the only consumer routing through useEditHistory.ts —
import undo-context.ts directly. Six re-exports gone, no behavior
change.
Co-authored-by: reasonix <[email protected]>
Stage 1 of #1829: ship the renderer as a separate private package
instead of vendoring at src/ink/. Picks up the tui-polish work that
landed alongside it (visuals, pulse animations, ghosting fix).
## Renderer extraction
- src/ink/ removed; renderer lives in esengine/reasonix-ink (private)
- package.json: ink dep points at @esengine/ink (file: tarball for
local dev; swap to npm: alias post-publish); react-reconciler and
yoga-layout added as direct deps so they hoist to a single top-level
instance (single React dispatcher, single reconciler instance);
17 transitive runtime deps and 3 @types removed
- tsconfig: ink path-map removed
- vitest.config: ink alias removed
- tests/helpers/ink-stdio.ts: text() uses strip-ansi + restores
CSI N C cursor-forward back to literal spaces
- tests/helpers/ink-test.ts (new): replaces ink-testing-library;
lastFrame() joins all chunks instead of returning only the most
recent write() — required because the diff-based renderer emits
multi-chunk frames per commit
- 15 test files migrated; 13 obsolete UI snapshot tests removed
(5 files)
## Visual alignment
- UserCard: single full-row backgroundColor=MESSAGE_BG.user fill
- ApprovalCard: round border with borderLeft/borderRight=false
- PromptInput: round border (top + bottom only) + borderText with
plan / history / mode / model
- ReasoningCard: italic + dim header; collapsed state appends
(ctrl-o to expand) hint
- theme/tokens: new MESSAGE_BG section (user/bash/selected) for all
5 themes
- CardHeader: glyph prop accepts string | ReactElement
## Pulse animation system
- Pulse primitive: generic frame cycler with DIAMOND/SQUARE/
TRIANGLE/CIRCLE/HEX presets aligned to existing brand glyphs
- Wired into 7 cards + 4 LiveRows components
- ThinkingRow + OngoingToolRow: live elapsed time + output token
count + t/s rate
- ticker.tsx: useTick / useSlowTick switched from
useAnimationTimer (keepAlive=false) to useAnimationFrame
(keepAlive=true) so the shared clock actually starts
## Bug fixes
- PromptInput: removed systemCursorSync — the out-of-band CSI CUP
write desynced the renderer's screen model under sync-output mode,
causing residual glyphs starting at the 3rd typed character
- Wizard: TextInput now sourced from ink (drop-in TextInput exposed
by the package); ink-text-input dep removed
## Tests
279 files, 3722 passed, 11 skipped, 0 failed.
Refs #1829 (Stage 1).
Co-authored-by: reasonix <[email protected]>
State requires `memoryDetail` since #1779 added it; test initial-state
builder and ContextPanel render fixture were missing the field. Root
`verify` doesn't run desktop tsc, so this surfaced only in the desktop
release matrix build for desktop-v0.51.0.
Ink 7.0.3 (Static stale-output fix, useBoxMetrics ref) and 7.0.4
(shared resize listener, useEffectEvent dependency fix) ship upstream
fixes worth picking up. None of them include the overflow-frame
flicker reduction from #1791, so dropping the patch reverts that
optimisation — accepting the regression in exchange for not carrying
a local fork of ink's render path.
- bump `ink` ^7.0.2 -> ^7.0.4 in package.json + lockfile
- delete `patches/ink+7.0.2.patch`
- drop `patch-package` from dependencies (and its transitive tree)
- remove the patch-package execSync from scripts/postinstall.mjs
Co-authored-by: reasonix <[email protected]>
advanceActivePlanSteps marks the next non-settled step as `running`
whenever a step completes, but nothing demotes it when the agent stops
calling mark_step_complete mid-plan. The card then displays "step N in
progress" indefinitely even though the turn has ended.
Dispatch a new plan.idle event from the App.tsx turn-end finally; the
reducer maps running→queued on active plans. Multi-turn flows are
unaffected — the next mark_step_complete re-advances the marker via
advanceActivePlanSteps.
Closes#1784
Co-authored-by: reasonix <[email protected]>
`search_content` was dispatching every pattern that parsed as a valid
RegExp — including plain literals like `new ToolRegistry` — to the
worker thread, paying full postMessage round-trip per file. On
multi-file scans this dominates wall time; one report hit the 120s
walk deadline on a query grep finished in 0.72s.
Detect patterns with no regex metacharacters and route them to the
existing main-thread `text.includes` branch. Also short-circuit
files whose buffer doesn't contain the substring so we skip the
line-split for misses.
Local bench (full repo, ~20K walkable files): root no-glob literal
2255 ms → 809 ms (2.8x); src/ *.ts literal 132 ms → 74 ms (1.8x).
Regex patterns still take the worker path; all 3731 tests pass.
Closes#1748
Co-authored-by: reasonix <[email protected]>
Typing or pasting tokens like `[DEBUG]` was being parsed as a stripped
left-arrow (`[D`) plus the leftover `EBUG]`. The ConPTY ESC-strip rescue
now only fires when the matched tail ends the chunk or chains into
another control byte; printable letters/digits after the tail mark the
input as user text.
Closes#1771
Co-authored-by: reasonix <[email protected]>
#1657 dropped the preset abstraction and exposed reasoning effort
directly, keeping `max` as a DeepSeek-only extension that users opt
into knowing standard OpenAI / vLLM / Azure reject it with 400. The
TUI still advertised `max` everywhere — `/effort` argsHint, slash-arg
picker, ModelPicker effort rows, /effort handler — even when the
active endpoint was a third-party host that can't accept it. Users
on those endpoints saw `max` in every suggestion and reported it as
a preset-era leftover (#1794).
Endpoint-aware filter: when `loop.client.baseUrl` is not api.deepseek.com,
drop `max` from the choices the TUI surfaces:
- `/effort` argsHint and argCompleter (autocomplete + arg picker)
- ModelPicker effort rows
- /effort handler's accept list + status / usage message
- new `effortUsageNoMax` i18n key (EN / zh-CN / de) so the error
on bad input doesn't itself name `max` as an option
`max` stays available on DeepSeek endpoints — that's the design from
#1657, just no longer visible where it would 400.
Fixes#1794.
Co-authored-by: reasonix <[email protected]>
- /language de: add 'de' to argCompleter and argsHint in commands.ts
- Capitalization: fix ~90 lowercase German sentence starts throughout de.ts
- Backfill: add ~95 new translations for CLI hints, slash command
descriptions, MCP marketplace text, and UI labels previously falling
back to English via ...EN spreads
- Native-speaker review: multiple rounds of corrections to word choice,
terminology consistency, and formatting
- Preserve T1anjiu's existing translations and the ...EN fallback pattern
Co-authored-by: hermitokatt <[email protected]>
Windows cmd.exe rings the system bell when stdout receives a bare BEL
byte (0x07). Third-party libraries (ansi-escapes, terminal-link, ink's
own deps) embed BEL as an OSC sequence terminator — perfectly valid VT
syntax that Windows Terminal, ConEmu, and every *nix terminal handle
silently — but cmd treats the unrecognized OSC start as junk and beeps
on the BEL byte. Visible on #1786 as the system bell ringing on every
assistant response chunk.
Patching every emitter individually doesn't scale (the constants are
scattered across several deps). Instead wrap process.stdout/stderr on
Windows and rewrite `\x07` → `\x1b\` at the boundary. ST and BEL are
both valid OSC terminators per VT 510, so legitimate OSC sequences keep
working (Windows Terminal / ConEmu / conhost-with-VT accept either);
stray BEL outside an OSC turns into ESC backslash which cmd treats as
junk text instead of a bell.
Installed via side-effect import at the very top of src/cli/index.ts,
after node-version-guard and heap-limit-launch (which may re-exec) so
the wrap is in the process that actually runs the CLI.
Fixes#1786.
Co-authored-by: reasonix <[email protected]>
* fix(ui): patch Ink to reduce terminal flicker on overflow frames
* fix: move patch-package to dependencies for global install
---------
Co-authored-by: Bernardxu123 <[email protected]>
When the assistant triggered a `run_command` shell confirmation in the
web dashboard, the tool card stayed on "running" indefinitely with no
Approve / Deny button. CLI and Tauri desktop worked fine.
Root cause: `modal-up` is broadcast at the moment the gate opens. If the
dashboard tab wasn't already connected to /api/events at that instant,
the event went out to zero subscribers and the dashboard never learned a
modal was up. The SSE handler already snapshotted `busy-change` for this
exact "client connects mid-state" reason; `getActiveModal` existed on
DashboardContext for the same purpose ("Snapshot of any modal currently
up (for SSE clients that connect mid-modal)") but was never wired into
the SSE stream.
Send the modal snapshot alongside `busy-change` on every new SSE
connection. Verified the new regression test fails on main (the read
times out at 5s — no modal-up ever arrives) and passes with the snapshot.
Fixes#1770.
Co-authored-by: reasonix <[email protected]>
Remove the duplicated Download item from the top nav while keeping the desktop download CTA, and add priority-based nav tiers so lower-value anchor links progressively disappear at narrower widths.
Tighten layout details across the landing page: prevent nav/version/language text wrapping, clean up hero metric alignment, and normalize spacing in feature cards, roadmap columns, and config bullet rows.
PR #1766 reshaped MemoryEntryInfo to include `kind`/`path`/`type` and
added a `memory_read` RPC for the detail view, but only wired the
Tauri-desktop emit path. The web dashboard still mapped the old
response shape via #1775's loader, so:
- frontend uses `m.path` as React key + onClick arg → undefined keys,
duplicate-key warnings
- clicking a memory row dispatches `memory_read` with undefined path →
bridge default case warns, nothing happens
Plug the gap:
- new GET /api/memory/entries → MemoryEntryInfo[] via the shared
collectMemoryEntriesForWorkspace, identical to desktop's $memory shape
- new GET /api/memory/read?path=... → MemoryEntryDetail via
readMemoryEntryDetail
- bridge: loadAndEmitMemory hits /memory/entries and emits entries
verbatim; new memory_read RPC handler fetches /memory/read and emits
$memory_detail
Co-authored-by: reasonix <[email protected]>
* fix(desktop): keep ctx resize handle off scrollbar
* feat(i18n): add German locale support
* feat(i18n): complete German translation for all three UI layers
Translate every untranslated key in src/i18n/de.ts (CLI/TUI),
dashboard/src/i18n/de.ts (web dashboard), and desktop/src/i18n/de.ts
(desktop app) — ~3,200 new lines of native German strings.
Covers all sections: common, cli/commands, ui, slash (all 42
commands), wizard, planFlow, errors, handlers, statusBar, editMode,
composer, path/shell/edit confirm, pickers, webErrors (all search
engines), marketplace, cards, labels, skills help, shortcuts, and
every other i18n namespace.
Terminology is consistent across all three layers. Translations
follow German typographic conventions (guillemets for quotation,
correct apostrophes, natural compound nouns).
writeConfig and rewriteSession used renameSync for the final atomic swap.
On Windows, when ~/.reasonix sits inside a OneDrive-managed folder or
crosses a junction / reparse-point boundary, rename refuses with EXDEV
(-4037) even though the tmp file and destination are siblings. The CLI
then crashed on every launch trying to mint the dashboard token (#1738).
Extract a shared atomicWriteSync helper that catches EXDEV from rename
and falls back to copyFileSync + unlink. Atomicity is lost on that path
(no other safe option on Windows), but a working write beats the
launch-blocking error.
Fixes#1738.
Co-authored-by: reasonix <[email protected]>
The CLI-hosted web dashboard's `serverInit()` only fetched settings,
sessions, and overview on mount — it never called `/api/mcp`,
`/api/skills`, or `/api/memory`. The reducer waits for `$mcp_specs`,
`$skills`, `$memory` events that the bridge had no path to emit, so
those three panels rendered empty and stayed empty until the user
triggered settings_save or restarted. Desktop (Tauri) shipped a
matching emit triple in desktop.ts on tab open — web mode regressed
on the equivalent.
Add three loaders that GET the REST endpoints and map their response
shape onto the dashboard event shape (`McpSpecInfo` / `SkillInfo` /
`MemoryEntryInfo`), fire them from `serverInit()`, and wire the
`mcp_specs_get` / `skills_get` / `memory_get` RPC commands so the
panels' refresh buttons also work. `mcp_specs_add` / `_remove` now
also re-emit the live list after the POST.
Fixes#1715.
Co-authored-by: reasonix <[email protected]>
clearLog() and switchWorkspace() left _steerQueue untouched. If the user
had typed a steer mid-turn in the prior session and the queue still held
text at the time of /new, the very next step() would pop it, wrap it in
the steer scaffolding, and ship it to DeepSeek as a user message — the
first prompt after /new would silently carry a fragment of the previous
conversation's intent.
Fixes#1707.
Co-authored-by: reasonix <[email protected]>
The scrollbar in the context panel was being overlapped by the resize
handle when the window was resized to trigger responsive breakpoints.
- Added padding-right: 20px to .ctx-body to create space for scrollbar
- Increased scrollbar width from 4px to 8px for better usability
Fixes#1695
Co-authored-by: Bernardxu123 <[email protected]>
Three hot-path fixes in the cards reducer measured to cut per-event
cost dramatically on long sessions:
- mutateCard now does a Map<CardId, number> lookup instead of a full
state.cards.findIndex scan. Each streaming/reasoning/tool chunk used
to walk the whole transcript; on a 2000-card session that cost
~12.7ms per 1000 chunks, now ~1.7ms (86% faster).
- plan.drop replaces a .map() containing a .slice(i+1).some() with a
single backward scan to find the last active plan, then one in-place
patch. 1000-card session: ~65ms -> ~0.34ms per drop (99.5% faster).
- elideOldCardContent now starts from a persistent elideCursor that
advances past stubbed and immutable-kind cards, so repeated appends
no longer re-scan all prior elision-zone cards. 500 appends on a
1000-card session: ~3.1ms -> ~1.6ms (48% faster).
The cardIndex map is mutated in place on append; structural changes
(session.fork, session.reset) rebuild it. tools/bench-reducer-hotpath.mjs
keeps the inlined old vs new comparison as a regression check.
All 3694 existing reducer / memory-budget / hydrate tests pass.
Co-authored-by: reasonix <[email protected]>
* feat(ui): configurable cost display currency with click-to-toggle
Add a costCurrency config option and a clickable status bar that
lets users toggle between USD and CNY display on the fly.
- costCurrency config field seeds the display preference on startup
- costDisplayCurrency state field drives reactive re-rendering
- mouse click on bottom status bar toggles USD/CNY instantly
- Wallet balance always stays in its own currency unaffected
- Module-level fallback ensures formatCost works without state
- All existing tests pass unchanged
* feat(ui): toast notification on cost-currency toggle
When clicking the status bar to swap display currency, a brief
toast confirms the change: 'Costs: $USD' or 'Costs: ¥CNY'.
* feat(ui): reactive UsageCard follows live cost currency toggle
* feat(ui): visual click hint on cost pill
Replace the generic '▸' arrow with '↻' (cycle arrow) on the
turn-cost pill to hint the display currency is clickable/togglable.
* style: trim comments to comply with comment policy
* refactor(ui): drop click-to-toggle, keep config-only cost currency
Per PR review feedback:
- Remove click-to-toggle interaction (hit-area too broad)
- Remove toast notification on toggle
- Remove module-level _defaultCostCurrency global (redundant with session state)
- Revert ↻ → ▸ glyph
- Keep costCurrency config field + costDisplayCurrency state plumbing
- Keep reactive UsageCard via useAgentState
- Keep precedence chain costDisplayCurrency ?? balanceCurrency in callers
---------
Co-authored-by: annon <[email protected]>
Session restore on a 1000-turn workspace was committing every card to
ink's <Static> in one synchronous render — measured 4.5s of frozen
terminal. The cards array can't shrink (Static is append-only by
design), but it can grow incrementally.
useProgressiveBacklog snapshots the initial cards.length on first
non-empty render, releases the first INITIAL_BATCH (30) immediately,
then drains the rest in PROGRESSIVE_BATCH-sized chunks via setImmediate.
Each batch yields back to the event loop between renders so keystroke
input stays responsive during the catch-up.
Cards added AFTER the snapshot bypass the gate — new live turns
(streaming responses, mid-turn tool output) appear instantly even when
the historical backlog is still draining.
Cards added DURING the drain (rare — user typing during restore) are
deferred until the snapshot drains. This trades a small UX hiccup
(brief delay before a new card appears) for Static's append-only
contract — out-of-order commits would re-render history in the wrong
chronological order.
Measured (probe-render-large-session.mts, heavy 1KB card bodies):
backlog | before | after | speedup
--------+-----------+-----------+--------
100 | 738 ms | 399 ms | 1.9x
250 | 1440 ms | 419 ms | 3.4x
500 | 2520 ms | 411 ms | 6.1x
1000 | 4520 ms | 429 ms | 10.5x
First paint is now ~constant regardless of backlog size. Total mount
time is unchanged (the rest still has to render), but the user sees
the most-recent context immediately and can type while the rest
catches up.
Tests cover three invariants:
- small backlog (<= INITIAL_BATCH) releases everything immediately
- large backlog releases initial batch first, drains the rest in
batches across setImmediate ticks
- chronological order is preserved across the drain (no card index
reorder when more batches release)
Co-authored-by: reasonix <[email protected]>
Add CLAUDE.md and .claude/CLAUDE.md to the project memory file search order (after REASONIX.md, before AGENTS.md) and read ~/.claude/CLAUDE.md as a global memory source alongside ~/.reasonix/REASONIX.md.
Changes:
- src/memory/project.ts: PROJECT_MEMORY_FILES now includes .claude/CLAUDE.md and CLAUDE.md
- src/memory/user.ts: add readGlobalClaudeMemory() and applyGlobalClaudeMemory() for ~/.claude/CLAUDE.md
- src/memory/user.ts: wire applyGlobalClaudeMemory into applyMemoryStack
- tests/project-memory.test.ts: add tests for CLAUDE.md priority and fallback
* feat: preserve full tool results when truncated (#1615)
When a tool result exceeds the per-call token cap, auto-save the full
content to .reasonix/truncated-results/ and embed the file path in the
truncation marker so the model can read_file the complete result.
Changes:
- src/tools/truncated-result-saver.ts — new file: save + cleanup + skip
- src/mcp/registry.ts — truncateForModel/truncateForModelByTokens gain
optional extraNote param appended to marker when truncated
- src/tools.ts — ToolDefinition.skipTruncationSave; dispatch save logic
- src/loop.ts — pass hookCwd as rootDir to dispatch
- src/tools/filesystem.ts — skipTruncationSave on read-only fs tools
- .gitignore — ignore .reasonix/truncated-results/
- tests/truncated-result-saver.test.ts — coverage for all paths
* fix: fix truncated-result-saver for CI + review — double .reasonix, Windows paths, comment policy, cleanup wiring, drop RFC doc
- Fix double .reasonix in fallback path (TRUNCATED_DIR had prefix, storageDir added it again)
- Normalize returned paths to forward slashes for cross-platform consistency
- Shrink multi-line block comments to one line (comment policy violation)
- Export storageDir for test consumption
- Align test file-creation patterns with project conventions (mkdtempSync, HOME redirect, top-level imports)
- Strengthen cleanupOldResults assertions to actually verify file removal
- Call cleanupOldResults(rootDir) at start of saveTruncatedResult so old files don't accumulate
- Drop .reasonix/rfc-1615.md — design docs don't belong in source tree
Windows hosts without Developer Mode (or non-elevated shells) can't
create symlinks via fs.symlinkSync — the call throws EPERM. The new
symlink-preservation test added in b40a569 didn't guard for this and
failed for any contributor running `npm test` on a default Windows
setup.
Match the pattern already used in tests/at-mentions.test.ts: probe
symlinkSync once, set symlinksWorked = false on throw, return early
so the test passes vacuously on hosts that lack the capability.
Co-authored-by: reasonix <[email protected]>
Extend src/cli/ui/render-trace.ts:
- readRenderTraceStats(): snapshot the counters directly instead of
scraping stderr. Lets probes report numbers in their own format and
decide when to read.
- resetRenderTraceStats(): clear between scenarios.
scripts/probe-render-large-session.mts runs two scenarios:
- (a) Mount of N cards via ink-testing-library — proxies session-restore
paint cost. Real Ink reconciliation + yoga layout.
- (b) K parent-state ticks via react-test-renderer (which fires effects;
ink-testing-library does not) — measures whether memo'd children
actually skip work when an unrelated parent state changes.
Numbers from this probe answer the App.tsx-split debate:
cards | (a) mount | per-card | (b) StaticCardStream re-renders / 200 ticks
------+------------+-----------+--------------------------------------------
100 | 738 ms | 7.38 ms | 1
250 | 1441 ms | 5.76 ms | 1
500 | 2521 ms | 5.04 ms | 1
1000 | 4517 ms | 4.52 ms | 1
Memo holds — parent re-rendering 200x cascades to ZERO StaticCardStream
re-renders. The "log append re-renders the whole App" hypothesis is
disproved. The real perceived cost is the ~5 ms/card initial-paint
hit on session restore (4.5 s freeze for a 1000-turn resume), which an
App.tsx structural split would not fix — that's a Static-priming /
progressive-render problem, not a memo problem.
react-test-renderer added to devDependencies for the probe (ink-testing-
library doesn't fire useEffect, so it can't be used to count renders).
Co-authored-by: reasonix <[email protected]>
Before further App.tsx-shaped optimization (the "split into InputArea /
MessageList / Sidebar" advice), wire in cheap measurement so we cut
where the cost actually is, not where intuition points.
src/cli/ui/render-trace.ts
- useRenderTrace(name): noop when the flag is off (hooks still called
unconditionally for rules-of-hooks compliance). When on, records
count + avg/max ms per name and prints a one-line summary per second
per traced component to stderr.
Wired into the four components most likely to dominate:
- AppInner — confirms whether App is actually re-rendering per keystroke
- ComposerArea — the input region; expected to re-render on every char
- StaticCardStream — the message list; should stay flat once history is
in <Static>
- LiveActivityArea — the activity row; expected to tick on busy state
Usage:
REASONIX_TRACE_RENDERS=1 reasonix code
# then type — see lines like:
# [render-trace] AppInner 42 renders · 7.0/s · avg 0.84ms · max 3.2ms
# [render-trace] ComposerArea 42 renders · 7.0/s · avg 0.43ms · max 1.8ms
The existing memo boundaries (ComposerArea, StaticCardStream,
LiveActivityArea, CardRenderer all React.memo'd) make the obvious
optimization moves already in place. This lets a future PR target the
component whose number is actually too high, rather than splitting
App.tsx on principle and hoping.
Co-authored-by: reasonix <[email protected]>
Five hot-path call sites had grown the same patterns inline — Map +
delete-on-hit + size-cap eviction (tokenizer BPE + content caches),
and `await import()` scattered through tool handler bodies. Collapse
into three primitives.
src/core/lru.ts
- LruCache<K,V>: insertion-ordered Map with promote-on-hit + oldest-out.
- TtlLruCache<K,V>: LruCache wrapping {value, expiresAt}; stale read
is a miss. One place owns the eviction rules.
src/core/lazy.ts
- lazy<T>(loader): memoize the loader's promise. First call starts the
work, every later call returns the same pending/resolved promise.
Failures stay sticky — the caller sees the same error on retry.
Call-site simplification
- src/tokenizer.ts — bpeCache + contentTokenCache: 14-line ad-hoc LRU
→ `cache.get/set`. Also exposes `warmupTokenizer()` so callers don't
have to know how to trigger the gunzip + Map build.
- src/gitignore.ts — adds 5s TTL cache around loadGitignoreAt /
loadGitignoreAtSync. Per-keystroke @-pickers walk every ancestor
.gitignore; cached lookups inside the same tick are now free.
- src/at-mentions.ts — listDirectory result cached with 5s TTL, 64-entry
cap. Same-tick keystroke bursts collapse to one readdir.
- src/tools/code-query.ts — `await import()` inside the fn bodies
replaced with module-level `lazy(() => import(...))` factories.
Lazy intent is declared at top of file; the handler body just awaits.
Sessions that never call code_query no longer pay the multi-MB
web-tree-sitter Emscripten runtime.
- src/code-query/grammar-map.ts (new) — extension→language detection
as pure data, no web-tree-sitter dependency. parser.ts re-exports for
back-compat.
- src/cli/ui/App.tsx — `setTimeout(warmupTokenizer, 0)` after first
paint, amortizing the ~100ms / 35MB cold load while the user reads
the banner.
Tests: tests/lru.test.ts (10 cases covering LRU promotion, eviction,
clear, TTL fresh/stale/refresh) and tests/lazy.test.ts (single-load,
identity, sticky rejection). All 3653 existing tests still pass.
Co-authored-by: reasonix <[email protected]>
* feat(acp): support REASONIX_ACP_SYSTEM_APPEND env var for system prompt injection
* fix(tui): show plan mode badge in input bar footer
The ModeStatusBar component was imported but never rendered after the
ComposerArea extraction (#565 Phase 2), making plan mode invisible to
users running editMode=yolo + plan=on.
Fix: render the plan mode indicator as a localized [PLAN]/[计划] badge
directly inside the input bar's footer, to the right of the mode label.
No extra row, no layout shift — uses the existing i18n key
statsPanel.modePlan for automatic Chinese/English display.
Closes#1502
---------
Co-authored-by: Bernardxu123 <[email protected]>
The Delete key was treated identically to Backspace (both deleted the
character before the cursor). Split the handling so Delete removes the
character at the cursor position (forward-delete) while Backspace
continues to remove the character before the cursor.
Fixes#1728
cli-highlight's tokenization ran on every CodeBlock render — multi-block
assistant replies were re-highlighting on every parent re-render
(slow-tick during streaming, theme change, terminal resize). Wrap the
highlight + entity decode in useMemo keyed on the token text and lang
so it only fires when the block content actually changes.
Settled cards already render via Static and skip re-render entirely;
this matters for the live streaming card where the parent re-renders
on every chunk while the code block content is stable.
Co-authored-by: reasonix <[email protected]>
Three changes that together cut per-turn CPU ~57% and steady-state RSS
~22% in the 200-turn fakeFetch probe (rss=256MB→181MB at log.len=800).
- bpeEncode: in-place splice instead of slice/spread rebuild on every
merge, plus 8K-entry LRU cache. Repetitive tool output (padded
payloads, identifiers in code) re-encodes the same byte-level chunks
thousands of times per session; the cache caps that at ~400KB.
- estimateConversationTokens: drop the full formatDeepSeekPrompt
rebuild + single bounded tokenize. Sum per-message bounded counts
with a fixed template overhead, gated by a content-string-keyed
4K-entry LRU. Same entry tokenizes once over its lifetime instead of
once per turn. The estimate drives fold thresholds (50%/75% of ctx)
where ±5% slop is harmless.
- truncateForModelByTokens: sample-based fast path. For inputs in the
[maxTokens, maxTokens*4] range the old code unconditionally tokenized
the full string (37% total CPU on the 200-turn probe). Now we use a
2KB-sample estimate with a 1.15x safety margin; only borderline cases
fall through to a precise tokenize.
Regression origin: #1642/#1646 collapsed the conditional preflight into
an unconditional estimateTurnStart that runs every turn, surfacing the
underlying tokenizer cost. The tokenizer itself has always been a
pure-TS BPE port without caching — fine when called rarely, expensive
when called on every turn against growing logs.
Also adds three probes that reproduce + measure:
- scripts/probe-mem-leak.mts — drives CacheFirstLoop through N turns
with fakeFetch, samples RSS/heap/log
- scripts/probe-jobs-leak.mts — confirms JobRegistry's MAX_COMPLETED_JOBS
cap actually evicts
- scripts/analyze-cpuprofile.mjs — flat self/total roll-up for any
.cpuprofile produced by --cpu-prof or `reasonix code --profile`
Co-authored-by: reasonix <[email protected]>
step() was a ~560-line method doing model streaming, repair, context
decisions, and tool dispatch in one body. Pull two independent pieces
into their own files so future edits to either don't risk the other.
- src/loop/streaming.ts — async generator that owns the chunk loop,
toolCallDelta buffering, and readiness counting. Caller uses yield*
to splice events and capture {content, reasoning, toolCalls, usage}.
- src/loop/dispatch.ts — chunked parallel dispatch with per-call
inflight tracking, tool_start/tool yields, and rate-limit warning.
Env reads (REASONIX_TOOL_DISPATCH, REASONIX_PARALLEL_MAX) move with
the dispatch logic.
loop.ts: 1174 -> 1022 lines. Public API of CacheFirstLoop unchanged.
Full test suite green (3625 / 12 skipped).
Co-authored-by: reasonix <[email protected]>
Floating right-edge dock that surfaces the last 10 user messages as
horizontal bars: hover to magnify + preview text, click to scroll the
thread to that turn. Bar widths step 32 / 20 / 14 / 12 px around the
hover point with staggered cubic-bezier transitions for the wave feel.
Adds data-turn on each user message in the thread so JumpBar can
querySelector the scroll target.
Thanks @CVEngineer66 for the original idea and the polished landing.
#1637 handled the canonical ESC [ M ... legacy mouse form, but Windows
ConPTY can strip the leading ESC, leaving a bare [M... that fell back to
the printable-text path. A burst of these (e.g. holding the mouse over
the terminal) would keep growing composer state — residual of #1598.
Add tryEscapelessLegacyMouse() parallel to the existing escapeless SGR
mouse path: recognize [M + 3 payload bytes as a fixed 5-byte packet,
consume it, surface no input event. Wire it into both the main parse
loop and the printable-run terminator so a stray [M mid-typing breaks
the run instead of swallowing the report into text.
Tests cover: single packet dropped, 1000-packet flood produces no
events, printable text either side of a report stays intact.
Trade-off: literal user input of "[M" followed by exactly 3 chars is
also swallowed — but [M is not a realistic typing pattern and the
flood-protection win is worth it.
Thanks @GTC2080 for tracking down the residual case.
applyEditBlock previously truncated the target file in-place before
writing the new bytes. A crash between truncate and writeAll could leave
the file empty, partially rewritten, or NUL-padded — high blast radius
since model-generated edits all flow through this path.
Switch to the standard atomic-replace pattern:
1. Resolve realpath so edits through a symlink modify the referent.
2. Write the new bytes to a sibling .tmp file with wx (exclusive create).
3. chmod to preserve the original mode under umask.
4. fsync the temp fd, close, then rename onto the target.
5. Best-effort fsync the parent directory.
6. On any error, unlink the temp file so we don't leak .tmp clutter.
Also fixes a latent short-write bug in the previous loop: `if (n <= 0)
break;` would silently truncate on a partial write. The new writeAllSync
throws instead.
One semantic change worth noting: atomic-rename breaks hardlinks. The
edited path now points at the new file while any other hardlink to the
old inode is left pointing at the pre-edit content. Industry-standard
tradeoff (same as the editor in your shell does), but a behavior change
versus the old in-place truncate.
New test covers the symlink-preservation case (edit through link →
link still exists → referent file has new content).
Thanks @YoungDan-hero for the careful patch.
Three stale-doc fixes:
- ARCHITECTURE.md §4.3 — replace removed /pro single-turn arming with the
current /model flash|pro + settings.json model selection. Note the
removal in 0.50.0 (#1657, #1630).
- ARCHITECTURE.md §4.4 — replace the never-existed FAILURE_ESCALATION_THRESHOLD
counter with the actual <<<NEEDS_PRO>>> model self-report mechanism. No
failure-counter; purely LLM-initiated, no-op on pro tier.
- benchmarks/real-world-cache/README.md — fix 10× pricing error in
v4-flash cache-hit ($0.028 → $0.0028) and entirely wrong v4-pro pricing
($0.139/1.667/3.333 → $0.003625/0.435/0.87). Recalculated cost tables;
headline 99.82% hit ratio unchanged, savings now correctly show ~97.7%
(flash) / ~98.9% (pro).
Thanks @FriendsHL for catching this — the benchmark pricing in particular
is the public cache-first defense link, the old numbers would have been
embarrassing.
.devenv/ and .direnv/ in Nix/devenv-based projects hold cargo registries,
uv caches, and Nix store symlinks — easily 1.5 GB and tens of thousands of
files. A bare glob("**/package.json") would stat every entry under those
trees before matching. Add them to DEFAULT_INDEX_EXCLUDES.dirs alongside
node_modules / .git / target / etc; include_deps:true still lets users
opt in.
Thanks @bluedevil947 for the patch.
On session resume, if a stored plan has every step completed, archive it
and skip restoration so users don't see a stale "resumed plan" card on
every open. Same archive-instead-of-persist behavior triggers mid-session
when the final step completes.
Thanks @paradoxSCH for the patch + tests.
Closes#1355
A user on a corporate intranet running a local model saw "DeepSeek 服务不可用 …
查看状态页 https://status.deepseek.com" after their local model returned a 500.
Three hardcoded assumptions stacked up: the client error prefix is always
"DeepSeek N:", is5xxError matched it regardless of provider, and the probe
hit /user/balance (a DS-only endpoint that 404s on ollama/vLLM/etc.), so the
unreachable branch fired and pointed users at DeepSeek's status page for an
outage that didn't exist.
Allow-list api.deepseek.com explicitly. For any other host, skip the
/user/balance probe and use provider-neutral wording that surfaces the
configured host instead of "DeepSeek".
Co-authored-by: reasonix <[email protected]>
* fix(api): self-heal stale model id in settings GET
#1663 added `loadModel()` which maps unsupported model ids (e.g. v3
`deepseek-chat` / `deepseek-reasoner` left over in a user's config)
to `DEFAULT_MODEL` when no custom endpoint is set. The CLI uses it,
but the dashboard/desktop `/settings` GET endpoint still returned the
raw `cfg.model`, so users upgrading from a pre-v4 config saw their
desktop landing on the stale id and the model picker rendering it as
"custom" — looks like the app forgot which model it's on.
Route the GET through `loadModel(ctx.configPath)` so the same
self-heal applies on the wire. Custom-baseUrl users still keep their
custom ids unchanged (`loadModel` trusts non-empty `baseUrl`).
* feat(plan): expose plan as a 4th editMode in API + desktop + dashboard UIs
#1681 wired `editMode === "plan"` into the ToolRegistry dispatch gate
so plan mode is now a persisted state, not a slash-only toggle. The
desktop and dashboard surfaces never grew a control to set it though —
the settings API + edit-mode API still rejected "plan" with a 400, the
composer's ModeSwitch hardcoded review/auto/yolo, and the settings
page tri-state only listed the same three. Net: plan mode was
reachable from the CLI's `/plan` slash and direct config edits, but
not from either GUI surface.
Admit "plan" in both validation sets (`src/server/api/settings.ts`,
`src/server/api/edit-mode.ts`) and the `/mode` slash completer
(`src/cli/ui/slash/commands.ts`). Add a "plan" entry to MODE_INFO in
both composers with `I.list` and a planHint string. Add "plan" to the
settings page button maps. Extend the local `EditMode` string unions
in `desktop/src/{protocol,App,ui/composer}.tsx` and the dashboard
equivalents so TS accepts it everywhere.
i18n: add `editMode.plan` + `editMode.planHint` (and `planDesc` on
desktop) in both en + zh-CN for each surface.
---------
Co-authored-by: reasonix <[email protected]>
Node 18+ refuses to execFile `npm.cmd` directly on Windows
(CVE-2024-27980 mitigation), throwing `spawnSync npm.cmd EINVAL`.
Failed every Windows CI matrix entry on main after 0.50.1.
`execSync` routes through cmd.exe / sh, matching what the original
inline `&&`-chained postinstall did before #1584's regression.
End-user installs of [email protected].1 are unaffected: postinstall
short-circuits via the `dashboard/package.json` existence check before
reaching the broken execFile call. Only repo checkouts at tag v0.50.1
hit the bug, which is dev-side only.
#1584 wired `npm --prefix dashboard ci && npm --prefix desktop ci` into
root `postinstall` to fix CI's missing workspace deps. But the
published tarball ships only build artifacts under `dashboard/`
(index.html, app.css, dist/) and no `desktop/` at all, so end-user
`npx [email protected].0 code` failed during the dashboard `npm ci` and
the bin never ran — the only visible output was npm's cleanup
warnings on the half-extracted tree.
Move the workspace install into `scripts/postinstall.mjs`, which
exits 0 when `dashboard/package.json` is absent (i.e. when running
from the tarball, not the repo). Ship the script via `files:`.
Deprecate 0.50.0 on npm so existing installers see the warning.
Dashboard smoke tests added in #1418 read `dashboard/dist/app.js` and
`app.css` at filesystem level. They pass under `npm run verify` (which
builds first) but fail under `npm publish`, whose `prepublishOnly` ran
in `lint → typecheck → test → build` order — tests fire before the
artifacts they need exist.
Reorder to `lint → typecheck → build → test` so the publish-time gate
matches the verify-time gate. Caught when the v0.50.0 publish-npm.yml
run failed before reaching `npm publish`.
Two bugs in the same `Cell` body (#1671):
- truncation used `raw.length > inner`, which undercounts wide chars —
a CJK row that was visually too wide for the column slipped past the
check and overflowed into the gutter
- padding used `padEnd(inner)`, which counts string length not cells —
short CJK content got padded as if each wide char were 1 cell, so the
background-color stripe ran past the column edge
Repo already has a cell-aware clipper (`clipToCells`) for the cut and
a private `padToCells` in `markdown.tsx` for the pad. Promote
`padToCells` to `text-width.ts` so SplitDiff can use both — collapses
the original four lines (slice + ternary + padEnd + ascii comment) to
a single `padToCells(clipToCells(raw, inner), inner)` and drops the
duplicate definition from `markdown.tsx`.
Supersedes #1683, which fixed the detection half but left the slice +
padEnd in place — for CJK content the truncated string ended up wider
than `inner` and short rows still over-padded.
Co-authored-by: reasonix <[email protected]>
Co-authored-by: Bernardxu123 <[email protected]>
#1661 fixed the lang-detection bug for desktop only. Dashboard's pre
handler has the same `c.type === "code"` check that fails when
react-markdown's component override replaces `code` — the element's
type is the override function, not the string "code". For dashboard
this didn't just mislabel the language; the fallback returned a vanilla
`<pre>` and skipped CodeBlock entirely, so syntax highlighting and the
copy button were missing for every fenced code block.
Extracted the lang lookup into `extractFencedLang` in both files so it
can be unit-tested without rendering CodeView (prism-react-renderer
pulls in each package's own React copy under vitest, which breaks
full-render tests across desktop/dashboard).
Co-authored-by: reasonix <[email protected]>
overflow-wrap is an inherited property; .msg-text already declares it,
so the duplicate declarations on .msg-text .markdown and .msg-text p
are noise. The combined `.msg-text X, .markdown X` selectors keep their
declarations because the standalone .markdown case (cards) has no
ancestor setting overflow-wrap.
Co-authored-by: reasonix <[email protected]>
Two related papercuts in the desktop client:
1. Esc during streaming with a modal (settings / about / jobs popover /
workdir popover) open used to fire `abort()` and leave the modal
sitting on screen. Now the global Esc handler bails out when any of
those flags is set; settings/about modals each install their own
`keydown` listener that calls `onClose()`. JobsPop and WorkdirPop
already had their own handlers, so this just rounds out the set.
2. Clicking (or Enter-ing) the already-active session in the sidebar
used to round-trip a session_load and clear live in-turn state
(issue #1653). Skip when `s.name === activeName`.
Co-authored-by: reasonix <[email protected]>
Co-authored-by: CVEngineer <[email protected]>
`ToolRegistry.setPlanMode(true)` (src/tools.ts:86) already blocks every
non-readonly tool at dispatch — but the only path that ever turned it
on was the `/plan` slash command. Persisted `editMode = "plan"` (set via
config edit or a settings UI that surfaces it) was previously inert:
the registry's `_planMode` stayed false across boots, so the model
could still call `write_file` etc.
Extend `EditMode` to include "plan", and have `buildCodeToolset` mirror
the loaded mode into the registry on construction. Desktop host calls
the new `applyPlanMode` helper in three places: on `emitSettings`, on
every `buildRuntimeFor`, and inside the `settings_save` handler when
the user toggles edit mode — so live changes take effect without a
rebuild. CLI's `/plan` slash continues to work as the direct toggle.
This is the minimal foundation needed before a settings UI in desktop
or dashboard can offer "plan" as a 4th edit-mode option.
Co-authored-by: reasonix <[email protected]>
Co-authored-by: T1anjiu <[email protected]>
#1667 added totalCompletionTokens to SessionMeta and wrote it after every
turn via patchSessionMeta, but the carryover plumbing in SessionStats
was incomplete:
- seedCarryover didn't read meta.totalCompletionTokens
- SessionStats had no _carryoverCompletion field
- the write call summed only this.turns (no carryover), and trimOldTurns
dropped completion tokens into the void
Net effect: on every resume, the first turn's patchSessionMeta call
overwrote the previously-saved totalCompletionTokens with just the new
turn's tally — counter reset to ~0 across restarts. (Cost / cache hit /
miss don't have this problem because they each have proper carryover
plumbing.)
Currently zero user-visible impact since no UI reads the field yet, but
the data was already flowing through UsageStats in both dashboard and
desktop, so the next surface that exposes it would inherit the bug.
Fix mirrors the cacheHit/Miss pattern: new _carryoverCompletion field
seeded from meta, a cumulativeCompletionTokens getter, trimOldTurns
folds completion tokens into carryover like the other counters, and
loop.ts switches the write to use the new getter.
Co-authored-by: reasonix <[email protected]>
#1666 renamed/dropped themes (tokyo-night → midnight, removed
default/github-dark/github-light, added deep-blue) but missed three
surfaces:
- `/theme` slash command's `argsHint` and `argCompleter` still advertised
the removed names and were missing `midnight` / `deep-blue`
- i18n `themeCaption` dicts in EN.ts and zh-CN.ts still held the removed
entries and had no labels for the new themes, so the picker would
render the literal i18n key (e.g. `wizard.themeCaption.midnight`)
next to the new theme names
Drop the stale entries from both locales, add captions for `midnight`
and `deep-blue`, and trim the slash command lists to the actual theme
set. The "default" caption is gone because the theme itself was removed.
Co-authored-by: reasonix <[email protected]>
- Simplify themes from 7 to 5 (dark, light, midnight, deep-blue, high-contrast)
- Add new deep-blue theme with #0153e5 brand color
- Rename tokyo-night to midnight (remove geographic name)
- Fix input text color to follow theme changes (add FG.body)
- Add history mode indicator (↑ history) when viewing past inputs
- Optimize bgInput color values for better contrast
Closes#1665
Co-authored-by: Bernardxu123 <[email protected]>
`loopEventToDashboard` was generating dashboard event ids as
`${assistantId}-${role}-${Date.now()}` for both tool_start and tool
events. Different role string and different timestamp → completely
different ids. The SSE bridge passes that id through as the segment
callId, and the dashboard reducer keys segments by it — so tool.result
never matched the segment created by tool.intent, segment.result
stayed undefined, and the card sat in `running` state forever
(its only "done" trigger is `result !== undefined`).
LoopEvent already carries a stable `callId` for this exact purpose
(see `src/loop/types.ts:40-41`: "UI uses this as the card id"). Use
it for both tool_start and tool so they share an id and the reducer
can pair them.
Regression-tested in `tests/loop-to-dashboard.test.ts`.
Co-authored-by: reasonix <[email protected]>
The composer's "N queued" label called `t("composer.queueCount", { n })`
but the i18n templates use `{count}` — variable mismatch left the
placeholder un-interpolated, so the UI rendered the literal string
`{count} 个排队` whenever a message was queued while busy.
Co-authored-by: reasonix <[email protected]>
The SSE bridge was reading the loop's `assistant_final` event as a
turn-end signal and synthesizing `$turn_complete`, but loop emits
`assistant_final` after EVERY model iteration — including mid-turn
iterations whose response carries tool_calls. So once the model said
"I'll run the test", busy flipped to false and the composer swapped
the stop button for send while npm test was still spawning.
The bridge also reset `sseTurnStarted` on that same event, which then
suppressed the real turn-end synthesis when `busy-change` (busy=false)
arrived later from the CLI's `handleSubmit` finally block. Drop both
the synthesized event and the flag reset; `busy-change` is the
authoritative turn-end signal and already drives `$turn_complete`
correctly via the case below it.
Co-authored-by: reasonix <[email protected]>
A stale `deepseek-chat` / `deepseek-reasoner` (or any other id no longer
accepted by api.deepseek.com) persisted in config.json bricked the next
launch with "Bad request (DeepSeek 400): supported API model names are
deepseek-v4-pro or deepseek-v4-flash, but you passed …". The picker
fallback list (used when the live catalog fetch fails) still surfaced
the v3 ids as selectable, so users could land there without ever
hand-editing config.
loadModel now keeps the persisted id only when (a) the user has a
custom baseUrl set — in which case we trust their model namespace —
or (b) the id is in the supported v4 allowlist. Otherwise it returns
DEFAULT_MODEL, and the next /model or picker write replaces the stale
config value.
Also drops the v3 ids from all six picker / settings fallback lists
(CLI, QQ, desktop composer + settings, dashboard composer + settings).
Co-authored-by: reasonix <[email protected]>
The "aborted at iter N" warning duplicated the synthetic assistant_final
that follows it; only the iter number was unique, and that's debug noise.
Removed the warning yield + the i18n string in both locales, and updated
the three loop tests that asserted on it.
Co-authored-by: reasonix <[email protected]>
When a user set a custom baseUrl + apiKey in config.json (e.g. routing
DeepSeek through new-api) but also had a stale env DEEPSEEK_API_KEY
left over from a default-endpoint setup, the resolver pulled baseUrl
from one source and apiKey from the other. The request hit the proxy
URL with the wrong token and the API returned auth errors with no
obvious cause.
Reported in #1631, root-caused but unfixed in #1577.
New loadEndpoint() resolves (baseUrl, apiKey) atomically: whichever
source defines baseUrl owns apiKey too. 12-factor env > config is
preserved for the default-endpoint apiKey case. New bridgeEndpointEnv()
mirrors the resolved tuple into process.env so subprocess constructions
and lazy DeepSeekClient instances see the matched pair. Every
DeepSeekClient construction site now passes both apiKey and baseUrl
explicitly via loadEndpoint().
Closes#1631
Presets bundled (model, reasoning_effort, thinking) under names like
flash/pro/auto. The bundling forced "max" as the cap and silently broke
OpenAI-compatible endpoints that only accept the standard literal set
(vLLM rejects "max" with a 400 — saw it in the wild against a
self-hosted DeepSeek-V4-Pro).
Direct controls instead:
- ReasoningEffort widens to low | medium | high | max
- Default cap is now "high" — the value every OpenAI-compatible
endpoint accepts; users opt into "max" knowing it's DeepSeek-only
- Dashboard + desktop settings: model picker + effort buttons,
both apply live through the existing settings bridge
- CLI: /model and /effort slash commands; ModelPicker shows EFFORT
and MODELS sections with full enumeration
- Config: preset field removed, model field persisted directly
Co-authored-by: reasonix <[email protected]>
Two small tidies left over from the edit-approval i18n PR:
- `entryStatusLabel(status)` was added to edit-history.ts but never
imported anywhere. The status-label i18n keys it wrapped are still
resolved inline by useEditHistory.ts (the only real consumer), so
the helper is pure dead code. Drop it, drop the now-unused `t`
import.
- `const status = t("app.editHistoryStatusApplied")` in useCodeMode's
discard path was unused. Even if it had been used, "applied" is
semantically wrong inside discard — the surrounding tail is built
from `discardedCount` and `nothingWritten` already.
Co-authored-by: reasonix <[email protected]>
Add a LIGHT_THEME (GitHub-style palette) alongside the existing
DARK_THEME and a usePrismTheme() hook that watches `<html data-theme>`
via MutationObserver, so code blocks switch highlight colors when the
app theme toggles. Without this, light mode rendered code in pale
dark-mode greys that were nearly invisible on the white background.
The MutationObserver only fires on data-theme changes (attributeFilter)
and skips no-op state writes via a prevRef, so the cost per toggle is a
single re-render.
Dashboard has the same hardcoded theme bug (dashboard/src/CodeView.tsx)
— good follow-up candidate.
Follow-up to #1650. Completes the system-event surfacing work:
1. Desktop bridge — the kernel WarningEvent (added in #1650) already
flowed through eventize → desktop sidecar → webview as a Tauri
event, but desktop's protocol type and App reducer didn't know
about it. Add WarningEvent to desktop/src/protocol.ts (matches
dashboard shape), grow ChatMessage with a "warning" kind, reducer
gated on severity === "high", thread renderer adds the
.sys-event-row inline divider (same styling as dashboard).
2. Settings toggle — new config field thread.showSystemEvents
(default true) with load/saveShowSystemEvents helpers in
src/config.ts. Desktop sidecar pushes it in $settings and handles
it in settings_save. Both SPAs grow Settings/SettingsEvent/
SettingsPatch, reducer stores it, warning render gates on
settings.showSystemEvents !== false. Settings panel adds a
seg-ctrl row in the Behavior section, en + zh-CN strings.
Default remains "shown" — severity filter (high-only) already caps
visible events to ~1-3 per session, so this is a preference, not a
noise mitigation.
Follow-up to #1585. The responsive sidebar logic was split across six
refs (autoSideCollapsedRef / autoCtxCollapsedRef / suppressSide... /
suppressCtx... / sideCollapsedRef / ctxCollapsedRef) and a 70-line
useEffect that did everything inline. Each panel's "is this collapsed
because the user asked, or because the layout forced it" state was
encoded across two of those refs; the resize logic had to spell out
all 6 stage-transition combinations by hand.
Extracted the per-panel collapse into useAutoCollapse(persistKey):
- collapsed: the boolean for CSS
- toggle: user-driven flip; persists to localStorage
- requireCollapsed: layout asks for collapsed — claims as auto if
the panel wasn't already collapsed
- releaseCollapsed: layout asks for expanded — restores only if WE
collapsed it (manual collapses stay)
The resize effect drops to one branch per stage:
WIDE → release both
COMPACT → require ctx (only when entering from wider — coming from
narrow we preserve a user's manual ctx-open); release side
NARROW → require both
Also: fixed the one-line CSS indent slip on .app[data-side-collapsed].
Behavior is unchanged — same five stage-transition outcomes that #1585
hand-coded, just expressed declaratively.
Co-authored-by: reasonix <[email protected]>
Layer 1 follow-up to #1649 (CompactionCard). Before this, every loop
warning fell through eventize.classifyWarning's default branch and
became an "error" event — Dashboard rendered compaction notices and
storm-stuck interrupts as alarming red error cards. Chatty warnings
(per-iter repeat-tool nudges, storm-suppressed counters) flooded the
thread.
- Add EventSeverity ("low" | "high") to LoopEvent. Tag the two known
chatty sites in loop.ts (repeatToolCallWarning, stormSuppressed
counter) as "low"; everything else is "high" by default — safer for
new emit sites added later.
- Add a typed WarningEvent to the kernel + dashboard protocol.
Eventize.classifyWarning now: drops low-severity entirely, emits a
proper warning event (not an error) for high-severity. Existing
policy.escalated / policy.budget classification still wins for those
patterns.
- Dashboard SPA: add warning kind to ChatMessage, reducer case in
applyIncoming (filters anything not "high"), render as a quiet
inline divider (.sys-event-row) — single line, dim, ~0.7 opacity,
flanked by hairline rules. Visually weak so several can stack
through a long session without crowding the conversation.
Tests: low-severity warnings dropped, high-severity emit typed warning
(not error), unmarked warnings default to high.
Follow-ups not in this PR:
- Desktop bridge equivalent (Tauri IPC + Tauri-side event types).
- Settings toggle to fully hide system events for users who want a
cleaner thread.
Co-authored-by: reasonix <[email protected]>
* chore(desktop): tidy follow-ups from #1645
Three small cleanups landed alongside the desktop UX bundle:
- composer: extract `recordSendAndReset` so the history-push + browse-
index reset logic is one helper, not duplicated between the Enter key
path and the send-button onClick.
- composer: drop the duplicate IME-quirk comment at the use site; the
ref declaration block at the top of the component already documents
the macOS Chinese IME ordering quirk.
- App: hoist the inline `onEdit` arrow into a useCallback so UserMsg's
memo isn't busted by a fresh function identity on every render of the
message list.
* test(server-dashboard): isolate from real \$HOME/.reasonix
The v0.13 panels suite uses mkdtempSync for cfgPath and usagePath but
the handlers it exercises (/api/health, listSessions) still call
homedir() under the hood. On a dev machine with thousands of session
jsonl files in ~/.reasonix/sessions the readdir + per-file statSync
walk blows past the 5 s default test timeout, even though the same
test runs in ms on a clean CI box.
Redirect HOME and USERPROFILE inside the suite's beforeEach so the
walks land in the suite's already-empty temp dir, and restore the
originals in afterEach. No production-code change — the handlers'
homedir() coupling is a separate cleanup.
Whole file now runs in 1.7 s.
---------
Co-authored-by: reasonix <[email protected]>
* feat(desktop): copy/edit overlay, msg history nav, IME guard, card collapse
* fix(desktop): guard history nav behind cursor position; keep reasoning open while streaming
---------
Co-authored-by: wufengfan <[email protected]>
After auto-compaction, the synthesized recap was being stored as a
plain assistant message with a HISTORY_FOLD_MARKER prefix. None of the
three surfaces special-cased it — TUI hydrated it as a regular streaming
card on resume; Desktop and Dashboard rendered it inline through
AssistantText. Users had no way to tell compaction had happened or
distinguish the recap from a real model reply.
- Single-source the marker + helpers in @reasonix/core-utils/compaction
(COMPACTION_SUMMARY_MARKER, isCompactionSummary, stripCompactionMarker).
Re-export the constant from src/context-manager.ts so existing
HISTORY_FOLD_MARKER imports keep resolving.
- TUI: new kind: "compaction" in state/cards.ts, renderer in
cards/CompactionCard.tsx, hydrate.ts emits it instead of a streaming
card when the marker is present.
- Desktop / Dashboard: CompactionCard component in ui/cards.tsx,
intercepted in the assistant-segment renderer in ui/thread.tsx.
Default-collapsed, archive icon, header shows char count, body renders
the recap markdown.
- Wire vite + tsconfig aliases for the sub-import path so browser bundles
don't pull in Node-only siblings (tildeify) via the barrel.
Tests: marker detection edge cases in core-utils, hydrate emits
compaction card for the marker, full verify (262 files / 3595 tests).
Follow-up: surface the loop "warning" event ("folded N messages → M")
as a visible row on Desktop / Dashboard (currently flows through
protocol, no ChatMessage reducer).
Route multi_edit through the same review gate that edit_file and
write_file already use, so the model can't mutate files in review mode
without surfacing pending edits to the user. Extract the gate logic from
App.tsx into edit-tool-gate.ts (pure, unit-tested) and add
setEditModeLive that updates the ref, React state, and disk in one
atomic callback — fixes the stale-ref window where an in-flight tool
call could see the old mode immediately after the user toggled it.
Closes#1639
Follow-up to #1642. After landing the fold-first preflight, the next
question was whether preflight needs to exist at all — and on a 1M-context
provider it doesn't: post-response decideAfterUsage already folds at
75%, upstream tool-result caps prevent single-message blowups, and the
byte ceiling the preflight was originally guarding against is gone.
Converge on the Claude-Code-style single compaction path: one fold check
per turn, at turn start.
- Delete decidePreflight, mechanicalTruncate, related constants, the
PreflightDecision interface, and the per-iter preflight block in step().
- Add a single turn-start check after the user message is appended:
if local request estimate > TURN_START_FOLD_THRESHOLD (90%), fold once
before the iter loop.
- No mechanical fallback. If fold can't shrink the log, the request goes
out and DeepSeek's error surfaces to the user — honest beats silent
re-compaction with worse semantics.
- Drop preflight i18n keys + delete tests/preflight.test.ts.
Net -393 lines. E2E (live DeepSeek) green across baseline, high-ratio
terminal turn, and turn-start fold scenarios.
Show the full tracked path for files in the desktop context panel, plus
per-file open/copy actions. Open honors `settings.editor` when set, else
falls back to the system default opener. Add an in-window completion
toast when a long task (>= COMPLETION_NOTIFY_MIN_MS) finishes while the
window is focused; unfocused windows continue to use the existing native
desktop notification path.
Closes#1638
The right-side context meter summed cacheHitTokens and cacheMissTokens,
which are session-wide running totals. After ~20 cached turns of a
50k-token context, the cumulative cacheHit alone reaches 1M+ and the
panel renders "1,500,000 / 1,000,000" with the bar pegged at 100%.
What the meter is supposed to show is the *current* context size — i.e.
prompt_tokens of the most recent API call. That value is already
captured per-turn as lastCallCacheHit / lastCallCacheMiss; switch the
meter to use those. Cumulative totals are still used elsewhere (status
bar / settings) for the cache-hit-rate display, where summing is the
right semantic.
Also mirror the reset into lastCall* on the $ctx_breakdown event so
/compact takes effect immediately instead of waiting for the next
model.final to overwrite a stale pre-compact value.
Co-authored-by: reasonix <[email protected]>
Live probe shows DeepSeek's gateway accepts at least 8MB request bodies —
the empirical ~880KB ceiling MAX_BODY_BYTES guarded against no longer
exists. Remove the byte path from decidePreflight + mechanicalTruncate
and converge on a single fold-first pipeline: preflight tries semantic
fold first, mechanical truncate is last-resort only when fold cannot
summarize.
fold() per-message token estimate now counts tool_calls JSON so heavy
args can't slip past the tail-budget check. New requireTailBoundary
option (preflight-only) prevents fold from wiping an active tool turn.
Preflight sets _foldedThisTurn to block decideAfterUsage from re-folding.
Disable font ligatures and contextual alternates for markdown code blocks
in both dashboard and desktop, so operator sequences like `->` `=>` `!=`
render as separate glyphs instead of shaped ligatures.
Closes#1636
Right-clicking in the WebView2 surface showed the browser's default
menu, where "Reload" wipes the in-memory session and leaves a blank
white screen. Block the contextmenu event at app startup. F5/Ctrl+R
are already trapped earlier in the same file.
Co-authored-by: reasonix <[email protected]>
* feat(subagents): per-skill flash/pro override + Settings UI
Subagent skills (`/explore`, `/research`, `/review`, `/security-review`
out of the box, plus any user-authored `runAs: subagent` skill) had only
one knob for picking the spawn model: a `model:` line in the .md
frontmatter. That meant users couldn't tune the four built-ins without
shadowing them by copying the bodies into a custom file, and the desktop
/ web settings had no surface for it at all.
Adds a per-skill `flash | pro` selector:
- `config.json` gets `subagentModels?: Record<skillName, "flash" | "pro">`
with `load`/`save` helpers that filter to valid values
- `SkillStore` accepts `subagentModels` in its constructor and applies
the override only to `runAs: subagent` entries (inline skills with
the same name are untouched, frontmatter `model:` is overridden
when an entry exists)
- `registerSkillTools` plumbs it through; `buildCodeToolset` reads
`loadSubagentModels()` so the runtime path picks up the live value
- desktop `settings_save` accepts the field, persists via
`saveSubagentModels`, re-emits the skill list so the UI's
inline-rendered model badge stays in sync
- dashboard `POST /api/settings` validates the same shape, GET surfaces
the current map, `appliesAt.subagentModels` = "next-skill-run"
- both desktop and dashboard Settings → Skills page render a
`<select flash | pro>` per subagent skill — inline skills get no
selector
`flash`/`pro` map to `deepseek-v4-flash`/`deepseek-v4-pro` inside
`SkillStore` so the config stays human-readable across model id swaps.
Tests:
- config: round-trip, filter unknown values, clear-all removes field
- SkillStore: override applies to builtins, doesn't touch inline `test`,
override beats frontmatter `model:` when both set, frontmatter still
wins absent override
* fix(settings): reject prototype-pollution keys in subagentModels POST
CodeQL js/remote-property-injection — `__proto__` / `constructor` /
`prototype` in a POST /api/settings body would land as own properties
on the sanitized map and persist into config.json.
* fix(settings): null-prototype map for CodeQL sanitizer recognition
The previous fix's explicit string blocklist wasn't recognized by
CodeQL's js/remote-property-injection rule as a barrier. Object.create(null)
is the canonical sanitizer — keeps the explicit blocklist so dangerous
keys still get dropped before persistence.
* fix(settings): use Map+Object.fromEntries for CodeQL sanitizer
CodeQL js/remote-property-injection didn't accept the explicit blocklist
or Object.create(null) as a barrier. Map.set bypasses the writeAccess
sink CodeQL tracks, and Object.fromEntries constructs via
[[CreateDataProperty]] which the rule trusts.
---------
Co-authored-by: reasonix <[email protected]>
Per-turn stats array grows indefinitely — iterated on every
summary() call. Over long sessions this causes both memory growth
and O(n) cost on each summary.
Add MAX_TURNS=200 cap: when the array exceeds this, oldest turns
are dropped and their costs/cache tokens folded into carryover
fields. Session totals remain accurate (totalCost, cacheHitRatio)
while the array stays bounded.
The cap is generous — 200 turns covers a full day of active use.
The carryover aggregation means resuming a session after trim still
reports correct cumulative totals.
Co-authored-by: Bernardxu123 <[email protected]>
Auto-escalation (flash → pro via the `<<<NEEDS_PRO>>>` marker) and the
one-shot `/pro` arming were both surfaces that could spend money behind
the user's back: a turn that ran on flash could silently re-bill on pro,
and `/pro` plus an idle session compounded the same risk. Both are gone.
PresetName is now exactly `"flash" | "pro"`. Old configs holding
`auto` / `smart` / `fast` / `max` keep loading: `loadPreset` and the
loose-input `resolvePreset` / `canonicalPresetName` silently coerce
anything that isn't `flash`/`pro` to `flash`. No legacy migration
notice — the user just gets the new safe default.
Surface dropped:
- `CacheFirstLoopOptions.autoEscalate`, `loop.autoEscalate`, the
streaming-time NEEDS_PRO buffer/flush, the post-call NEEDS_PRO retry,
`src/loop/escalation.ts`, the `loop.flashEscalation` i18n string.
- `loop.armProForNextTurn`, `loop.disarmPro`, `loop.proArmed`,
`loop.escalatedThisTurn`, `loop.currentCallModel`, the `_escalateThisTurn`
/ `_proArmedForNextTurn` state, the `loop.proArmed` warning yield.
- `/pro` slash command + handler + i18n.
- Dashboard `proNext` field on `POST /api/settings` + ctx.setProNextLive
+ the proNext / proArm / proArmed / proNextNote i18n bundle.
- StatsPanel's pro pill (escalated / proArmed props + rendering).
- ModelPicker's `currentAutoEscalate` prop and detect.
- usePresetMode's proArmed / turnOnPro state.
- ResolvedDefaults.autoEscalate, handleWarningEvent's setTurnOnPro hook,
AppProps.autoEscalate / ChatOptions.autoEscalate.
- "auto" preset card in both desktop and dashboard Settings → Models.
Tests updated:
- tests/presets.test.ts: legacy + unknown values coerce to flash.
- tests/resolve.test.ts: legacy auto/smart/fast/max coerce silently.
- tests/slash.test.ts: `/preset auto` returns usage; `/preset flash` /
`/preset pro` keep working; arg-picker enum is `["flash", "pro"]`.
- tests/loop.test.ts: NEEDS_PRO describe block and the proArm/disarm
tests are gone with the features.
- tests/server-dashboard.test.ts: proNext field is gone from the live
callback test.
- tests/preset-effort-isolation.test.ts: only flash/pro iterated.
- tests/ui-slash-suggestions.test.tsx: advanced-group count 11 → 10.
Verify: tsc clean (root + dashboard), biome clean (only pre-existing
welcome-banner warning), 3576 tests pass.
Net -669 lines.
Co-authored-by: reasonix <[email protected]>
iTerm2 light theme + reasonix theme `github-light` still rendered the
composer dock as a black band (#1607). The composer and the user-message
card both hardcoded `#1e1e1e` for their bg and `#0153e5` for the brand
accent — the proxy-tokens system (`SURFACE.bgInput`, `TONE.brand`) was
bypassed entirely, so theme switches did nothing to either surface.
What looked in the screenshots like "the status bar is also black" is
actually `PromptInput`'s inline mode/model row, which lives *inside* the
dark Box. The real `<StatusRow>` rendered below it with no bg and stayed
themed correctly all along.
Replaces four hardcoded literals with their theme tokens:
- composer left accent stripe #0153e5 → TONE.brand
- composer body bg #1e1e1e → SURFACE.bgInput
- composer inline mode label color #0153e5 → TONE.brand
- user message card bg #1e1e1e → SURFACE.bgInput
All six themes already define matching `bgInput` values, so dark themes
get the same near-black they had before and light themes (`light`,
`github-light`) get the near-white they were missing.
EditConfirm + SplitDiff still tint diff lines with hardcoded dark
red/green and will need new `diffAddedBg`/`diffRemovedBg` tokens for
light-theme parity — separate PR.
Closes#1607
Co-authored-by: reasonix <[email protected]>
- Auto-evict oldest completed jobs when count exceeds MAX_COMPLETED_JOBS (20)
- Cleanup runs on job completion (settleClosed) and list() calls
- No time throttle — gate on count only, O(jobs.size) is trivial at N=20
- Initialize lastCleanupAt to 0 so first call always runs (fixes dead zone)
Fixes#1571 (JobRegistry portion)
Co-authored-by: CI Fix <[email protected]>
The dashboard's <select> for switching web search backends shipped in
#1558 against the old Preact panel; the React port (#1418) dropped it
silently and the i18n strings have been dead code since. The desktop
settings panel never had it. Both surfaces now expose the same dropdown
under General → Behavior, alongside reasoning effort / edit mode /
budget — six engines (bing, searxng, metaso, tavily, perplexity, exa)
matching the `/search-engine` slash.
- protocol: `webSearchEngine` on SettingsEvent + SettingsPatch in both
desktop and dashboard mirrors
- backend: `src/cli/commands/desktop.ts` settings_save persists the
field via writeConfig; emitSettings reads it back via webSearchEngine()
- dashboard bridge: emitServerSettings forwards the field from
`GET /api/settings` (server side was already wired by #1558)
- desktop i18n: copies the six already-translated strings that were
living only in the dashboard bundle
API keys for metaso / tavily / perplexity / exa still go through the
slash command (or config.json) — UI-side key entry can come later if
demand shows up.
Co-authored-by: reasonix <[email protected]>
Place `node` next to a `com.apple.security.inherit` entitlement so the
child Node process inherits the .app's Documents / Desktop / Downloads
TCC grants instead of re-prompting on every spawn.
- entitlements/main.plist applied via bundle.macOS.entitlements; Tauri's
--deep codesign propagates inherit to Contents/Resources/node when
Developer ID is configured
- bundle-node.mjs adds an ad-hoc codesign with the helper plist so the
inherit entitlement still attaches on unsigned local / CI builds where
--deep never runs
Closes#1611
Co-authored-by: reasonix <[email protected]>
* feat(config): add dashboard.enabled setting to suppress auto-start
Add a `dashboard.enabled` boolean config field (default true) so users
can permanently disable the embedded dashboard without passing
--no-dashboard on every launch. The CLI flag still overrides the config
(--no-dashboard wins over enabled: true).
* test(config): cover loadDashboardEnabled defaults, explicit values, and noConfig
* fix(desktop): prevent stale events from corrupting UI after session switch (#1217)
When a session switch happens while a turn is running, the old turn's
cleanup code may still emit events (, , etc.)
that arrive after the new session is active, causing UI lag and state
corruption.
Add a switching flag to the Tab interface:
- Set tab.switching = true before aborting in session_load/new_chat
- In runTurn's finally block, check tab.switching to suppress stale events
- Reset tab.switching = false after processing
This prevents the old turn from emitting events that would interfere
with the new session's state.
Fixes#1217
* fix(desktop): only set switching flag when aborter is live (#1217)
The previous implementation set tab.switching=true unconditionally in
session_load/new_chat handlers. When no turn was in flight (the common
case), the flag stayed true and suppressed events for the first turn
in the new session.
Fix: only set switching=true when tab.aborter exists (live turn).
---------
Co-authored-by: CI Fix <[email protected]>
codeCommand was directly reading readConfig().mcp which only handles
the legacy string array format. When users configured mcpServers
(the object format) without the mcp array, MCP servers would not start.
Fixed by using normalizeMcpConfig() which processes both mcp and
mcpServers formats, then converts back to string array via specToRaw().
Fixes#1568
Co-authored-by: CI Fix <[email protected]>
* fix(dashboard): scope session list to current workspace + fix new-chat flow
Two related sidebar bugs:
1. The session list was unfiltered — users with thousands of subagent
transcripts (`subagent-sub-*.jsonl`) and cross-workspace sessions
in `~/.reasonix/sessions/` saw 10 000+ entries. The CLI's session
picker already uses `listSessionsForWorkspace(currentRootDir)`;
the dashboard's GET /api/sessions handler now does the same when
`ctx.getCurrentCwd()` is wired. Also surface `meta.summary` in the
listing so the bridge stops falling back to bare session names.
2. Clicking "new chat" pushed an error card into the transcript via
`$session_empty` ("loaded with no messages") and never updated
state.currentSession, which left #1586's URL mirror pointing at
the old session. The new endpoint echoes the freshly-minted
session name, and the bridge fires a real `$session_loaded` with
empty messages so the reducer resets cleanly and the URL flips.
Sessions-ops test grows by two cases covering each behaviour.
* feat(dashboard): cross-session stability, persistent URL, polish pass
Squash-merges a chain of fixes prompted by post-#1418 user feedback on
the live web dashboard. The unifying themes: nothing should change
when you don't expect it to (token, port, URL, SSE stream), and
everything should give visible feedback when you do change it.
Server
- POST /api/sessions/new now echoes the new session name so the bridge
can update state.currentSession without diffing the list.
- parseTranscript surfaces reasoning_content, tool_calls, and tool
results (by tool_call_id) so historical replays show what the model
actually did, not just the raw text turns.
- serveAsset injects ?token=... into CSS url() font references in
addition to the existing JS-import rewrite — the previous gap 401'd
every Geist / KaTeX font fetch.
- New /api/browse?path= lists immediate subdirectories (Windows drive
letters included on first call) so the web runtime can ship a real
directory picker.
- startDashboardServer exposes updateContext(ctx) — the handle now
outlives a chat.tsx-driven App remount, and the new App rewires its
loop/refs in place instead of forcing a port rebind that the OS
hadn't released yet (EADDRINUSE -> ephemeral fallback -> new URL).
- Dashboard token + actual bound port are persisted to config.json on
first run via ensureDashboardToken / saveDashboardPort, with an
EADDRINUSE fallback to ephemeral. /dashboard reset-token rotates
the token and restarts the server.
CLI
- listSessions workspace filter now reaches the dashboard's GET
/api/sessions, cutting sidebar entries from "every subagent
transcript on disk" (10 000+ for active users) down to the current
workspace's chats.
- getDashboardUrl appends &session=<name> so the printed URL points
at the attached session and survives copy/paste.
Dashboard UI
- Persistent module-level dashboardHandle + eventSubscribers Set so
React App remounts (session swap) don't tear the server down and
don't drop SSE subscribers on the floor — fixed the "send a message
after switching, web stays silent" desync.
- session_load bridge handler emits $session_loaded with the new
name and full segments (text + reasoning + tool calls stitched to
results), instead of pushing an error card via $session_empty.
- Thread renders use index-based React keys for AssistantMsg —
replayed transcripts arrive with turn=0 for every assistant row,
so the turn-keyed list was collapsing every assistant message into
one stale slot on every session switch.
- Sidebar gets a per-row loading spinner; thread shows a centered
overlay during the swap so big sessions don't look dead.
- CSS containment on .session-item, .msg, and .thread; dropped a
needless backdrop-filter on the loading overlay. Together these cut
the Paint/Layout/pointerover budget noticeably on long transcripts.
- New WorkdirInputModal backed by /api/browse — the web build
previously stub'd openDialog to "" so clicking Browse did nothing.
- Removed the "+ new tab" affordance from the tab bar (web has no
multi-tab story).
- URL session mirror from #1586 reverted to read-on-mount only so
clicking a session doesn't churn the address bar.
i18n
- statusbar.themeStyle{Graphite,Sandstone,Porcelain,Midnight}
- settings.themeStyle* + Desc, settings.page* Label + Desc for all 8
pages, sidebarPanel.loading, workdir.{cancel,go,goTip,loading,
emptyDir,openHere,pathPlaceholder}, handlers.dashboard.tokenReset*
(en and zh-CN where relevant).
Tests
- tests/dashboard-token-persistence.test.ts (9 cases) for
ensureDashboardToken / saveDashboardPort / clearDashboardToken.
- dashboard-sessions-ops gains coverage for the workspace filter
and the new POST /sessions/new name echo.
- dashboard-smoke verifies CSS font url() token injection in
addition to the existing JS chunk-import rewrite.
---------
Co-authored-by: reasonix <[email protected]>
After #1586 the browser URL stays in sync with the active session,
but the URL the CLI prints on startup and via /dashboard still only
carried `?token=`. Copying it never restored the right session.
Append `&session=<name>` in `getDashboardUrl()` and use it for the
auto-start log line and openUrl call too, so the URL you see, copy,
or click always points back at the session the CLI is attached to.
Co-authored-by: reasonix <[email protected]>
Builds went from a 943 KB monolithic `app.js` to a 224 KB entry plus
five lazy-cacheable vendor chunks (react, markdown, katex, prism,
icons). Total bytes are unchanged but the browser can fetch chunks
in parallel and reuse them across deploys when only app code moves.
Browsers strip query strings when resolving relative ESM imports, so
chunk-to-chunk references like `from "./vendor-react.js"` would 401
against the token-gated /assets/* route. `serveAsset` now rewrites
every relative `.js` import to carry the live token before sending
the body — same shape as the existing index.html templating, just
applied to JS bodies.
Before: app.js 942.61 kB │ gzip: 292.58 kB
After: app.js 223.76 kB │ gzip: 74.75 kB
vendor-react.js 192.84 kB │ gzip: 60.17 kB
vendor-katex.js 258.26 kB │ gzip: 77.53 kB
vendor-markdown.js 171.91 kB │ gzip: 52.18 kB
vendor-prism.js 86.04 kB │ gzip: 26.77 kB
vendor-icons.js 8.07 kB │ gzip: 1.98 kB
Co-authored-by: reasonix <[email protected]>
Until now the dashboard URL only carried the auth token, so a copied
link always landed on whichever session the CLI happened to be
attached to — refreshing a tab or pasting the URL elsewhere never
restored the session the user was actually viewing.
Mirror state.currentSession to a `?session=NAME` query param via
`history.replaceState` (no back-button noise) and, on the active
tab's first ready+sessions tick, read the same param back and
auto-dispatch session_load if the named session exists. Unknown
session names clear the param instead of erroring.
Both effects are gated on the tab being active, so multi-tab tabs
don't fight over the URL.
Co-authored-by: reasonix <[email protected]>
CI's `npm ci` at the root only triggers `npm --prefix dashboard ci`,
leaving `desktop/node_modules` empty. Vitest scans `desktop/src/**`
for tests, so the first desktop test that imports a transitive dep
(e.g. `react-markdown` via `Markdown.tsx`) fails to resolve in CI
even though it passes locally for anyone who's ever run
`npm install` inside `desktop/`.
Unblocks #1562.
Co-authored-by: reasonix <[email protected]>
* feat: port desktop dashboard from Tauri+Preact to CLI-hosted React Web app
Migrate the desktop Tauri + React UI to a CLI-hosted Web dashboard,
replacing the legacy Preact UI and laying groundwork for mobile compatibility.
- Independent Vite + React 19 dashboard build chain (dashboard/)
- Mock/Server dual-mode bridge layer (tauri-bridge.ts)
- REST API routing alignment (sessions, settings, submit, abort)
- editMode support (review/auto/yolo) with runtime setEditMode
- User message deduplication in busy state (App.tsx:546-549)
- assistant_final event carries usage + costUsd fields
- Binary asset serving fix (woff/woff2/ttf/png as Buffer, not UTF-8)
- Smoke tests (10 cases) + editMode regression tests
- Build chain: npm run build now runs dashboard build first
- Removed 38 legacy Preact files + 8 obsolete tests
- SSE reconnection: fixed 3s retry, no exponential backoff or max attempts
- settings_save: does not merge overview for complete broadcast
- session_load: still uses POST /api/sessions/load, not switch + GET
- app.js bundle size ~900KB (code-splitting deferred)
- Mobile layout optimization (deferred until desktop Web is stable)
- npm run build: pass
- npm run typecheck: pass
- npm run lint: pass
- npm run test: pass (229 files / 3271 tests)
* fix(ci): run build before test so smoke tests find dashboard artifacts
* cleanup: remove updater mechanism from web dashboard (CLI manages updates)
Web version doesn't need Tauri's @tauri-apps/plugin-updater since
updates are handled by CLI (npm). Removed:
- Imports and usage from App.tsx (pendingUpdate state, UpdateBanner component, check() call)
- about.tsx update checking UI (CheckStatus component, checkForUpdates)
- tauri-bridge.ts mock exports (Update type, check function)
- tsconfig.json and vite.config.ts path/resolve aliases
* fix: add /dashboard copy subcommand to copy URL to clipboard
Users could not copy the dashboard URL because /copy mode only captures
conversation cards, not the WelcomeBanner which displays the URL.
This caused repeated failed attempts (infinite loop).
Add /dashboard copy as a quick way to yank the live dashboard URL to
the clipboard via OSC 52.
Fixes#1450
* fix(ci): restructure settings.ts to fix biome parse errors
Move orphaned code (GET response body, declarations, helper function)
back into proper positions within the module. The merge left code
scattered at module level causing 41 biome lint errors.
- Move handleSettings function and its complete GET/POST handlers
into correct position after declarations
- Move VALID_WEB_SEARCH_ENGINES, VALID_EDIT_MODES, void saveEditMode,
and debugLogPresetWriteFromDashboard before the main function
- Restore complete GET response with session, model, proNext, budgetUsd,
skillPaths, appliesAt fields
* fix(i18n): add missing translation keys for dashboard components
Add 200+ missing i18n keys to en.ts and zh-CN.ts for new React
dashboard components (cards, composer, contextPanel, sidebar,
statusbar, thread, etc.). Also fix settings.ts structural issues.
* fix(ci): add postinstall to install dashboard deps automatically
npm ci in CI only installs root dependencies. Add postinstall script
that runs npm ci --prefix dashboard to ensure dashboard deps
(prism-react-renderer, lucide-react, etc.) are available for
typecheck and build steps.
* fix(tui): surface failure signals in collapsed run_command cards (#1496)
When a command exits non-zero, the collapsed card now:
- Shows error-relevant lines (error/fail/exception/assertion patterns)
mixed with tail lines instead of only the last N lines
- Displays exit code in the truncated hint: 'N lines hidden · exit 1'
- Uses 'Ctrl+R to expand' instead of confusing 'use /tool to read full'
Smart truncation for failed commands:
- Scan output for error-pattern lines (error, fail, fatal, exception, etc.)
- Include those lines + context + tail in visible output
- Add separators for hidden gaps between error regions
* Revert "fix(tui): surface failure signals in collapsed run_command cards (#1496)"
This reverts commit 3d71f613a2.
---------
Co-authored-by: Reasonix Dev <[email protected]>
Co-authored-by: CI Fix <[email protected]>
The 75%-off promo became the permanent rate on 2026-05-31, so the
parenthetical caveat is now misleading — readers think pro is on a
limited-time sale that will expire. Pricing math is unchanged
(stats.ts already uses the 1/4-of-original rate).
Closes#1559
Co-authored-by: reasonix <[email protected]>
read-before-edit gate (#1563) and cache-aligned fold summary (#1565)
landed after the release commit was written. Document them in the
0.49.0 entry before tagging so the published CHANGELOG matches what
ships.
Co-authored-by: reasonix <[email protected]>
* chore(release): 0.49.0 — static-history TUI, queued steers, Bing default, lifecycle plans
Headline themes:
- TUI: Static-history renderer is the only path; virtual-viewport layers removed (#1529 stages 1-4)
- Chat: queued mid-turn steer handling so input mid-render doesn't drop or fight the live frame (#1501)
- Web search: default switches to Bing; dashboard engine switcher; Mojeek dropped (#1558)
- Plans: lifecycle evidence summaries surface why a plan is ready to accept (#1500)
- Desktop: native OS notifications for approvals + completion (#1519)
- i18n: CLI command output (/mcp /sessions /prune /theme) + approval-prompt labels translated (#1524, #1560)
- Security: SSRF block in web_fetch (#1544), edit-snapshot path containment (#1454), shell redirect sandbox (#1457), Task integrity guardrail (#1516)
- Tools: per-turn dispatch-rate limit (#1356); run_command discourages shell-based edits (#1514)
- Client: DeepSeek 429 → concurrency-limit hint (#1526); timeoutMs honored with AbortSignal (#1535); --no-proxy opt-out for direct route (#1507)
- Files: read/edit/restore preserves source encoding (GB18030 / UTF-8 BOM) (#1518)
- Context: pinned constraints survive folds + full tail capture (#1515, #1552)
- Refactor: lifecycle risk policy extracted into its own module (#1557)
See CHANGELOG for the full list.
* fix(context): align fold summary prefix with main agent for cache reuse
The summarizer call was sending a bespoke "You compress conversation
history" system prompt and no tools, guaranteeing a 0% cache hit
against the main agent's just-cached prefix. Reshape the request so
system + tools + head bytes mirror the live agent's last call — the
only novel bytes are the trailing summarize instruction.
Skill-pin handling now collects bodies read-only instead of stubbing
mid-head, so the cache prefix stays unbroken. The summarize
instruction names pinned skills so the model knows not to paraphrase
their bodies (which we append verbatim regardless).
Measured on a real session at 48.7K prompt tokens:
OLD shape: 0.0% cache hit → $0.145 per fold
NEW shape: 99.6% cache hit → $0.015 per fold
saving: 89.6% per fold
* tools: add fold-cache shape + live benchmarks
bench-fold-cache-shape.mjs replays real session jsonls, simulates
OLD vs NEW summary-call shapes at the fold point, and reports
byte-level shared-prefix with the main agent's preceding request.
Pure local — no API required.
bench-fold-cache-live.mjs sends one priming + two summary calls to
DeepSeek and reports prompt_cache_hit_tokens / cost for each shape.
Used to confirm the shape change actually translates to API-side
cache hits.
---------
Co-authored-by: reasonix <[email protected]>
Soft prompt hint ("read_file first so SEARCH matches byte-for-byte")
was easy for the model to skip — the failure mode is a tool round
spent on "search text not found", a guess at the bytes, and a retry.
Each round is a cache-miss tail and an obviously-not-grounded edit
that erodes trust.
New ReadTracker lives on CacheFirstLoop and threads through
ToolCallContext. read_file marks the absolute path on any successful
load (full, range, head, tail, outline); write_file marks too — the
model knows what it just wrote. edit_file / multi_edit consult the
tracker before applying and refuse unread targets with a message
that names the path and tells the model to call read_file first.
multi_edit refuses the whole batch if any target is unread, so a
partial-knowledge cross-file refactor can't half-apply.
ContextManager fires a new onLogRewrite callback from fold and
mechanicalTruncate; the loop wires it to ReadTracker.reset() because
once the byte-level history is folded away the model's "I saw it"
claim no longer holds. The tracker is in-memory only, so session
resume also starts empty — the model must re-read before editing
after a restart.
tools.ts's repeat-rejection detector recognizes the "read_file first"
gate so a 2nd identical unread edit gets the sharper "do not retry
identical args — call read_file on the target path first" hint
instead of the same refusal echoed back.
Path normalization lower-cases on win32 so case variants of the same
file resolve to one tracker entry.
11 new tests in tests/read-before-edit-gate.test.ts cover: refusal,
post-read success, write_file-counts-as-read, partial-read accepted,
multi_edit all-or-nothing, repeat-rejection sharpening, reset
semantics, and backwards compat when no tracker is injected.
Co-authored-by: reasonix <[email protected]>
`toApprovalPrompt` in core-utils mints English labels so the ACP surface
(no i18n layer) can render immediately — but the CLI surface was rendering
those English strings verbatim, leaving "Run command" / "Run once" /
"Always allow — …" / "Deny" on screen even when the locale was zh-CN.
ShellConfirm and PathConfirm now override `prompt.title` and each
`action.label` with locally-translated strings keyed off `action.id` and
`prompt.data` (so we can still tell foreground vs background and read vs
write apart, even after the unified `prompt.kind` collapses each pair).
New i18n keys in both EN.ts and zh-CN.ts:
- `shellConfirm.promptTitleRunCommand` / `promptTitleRunBackground`
- `shellConfirm.actionRunOnce` / `actionAlwaysAllow` (with `{prefix}`) / `actionDeny`
- `pathConfirm.promptTitleRead` / `promptTitleWrite`
- `pathConfirm.actionAllowRead` / `actionAllowWrite` / `actionAlwaysAllow` / `actionDeny`
Test plan:
- `tests/shell-confirm-render.test.tsx` gains a `setLanguageRuntime("zh-CN")`
case that asserts 运行命令 / 运行一次 / 始终允许 / 拒绝 render and the
English labels do NOT survive.
- `npm run verify` passes (3554 tests).
Closes#1560
Co-authored-by: reasonix <[email protected]>
* feat(web-search): default to Bing (cn.bing.com), drop Mojeek, dashboard switcher
Mojeek's IP-geolocation reputation system 403s most CN-residential
clients on the very first request, leaving the default `web_search`
tool unusable for the bulk of this project's users. cn.bing.com serves
clean HTML from CN without a proxy, returns real URLs (not the
`/ck/a?u=a1<base64>` click-tracking wrappers the international `www.bing.com`
uses), and has no per-IP daily quota. Live probes across three queries
× two endpoints returned 200 with zero anti-bot markers.
- New `searchBing` + `parseBingResults` scrapes `<li class="b_algo">`
blocks (h2 a[href] + div.b_caption p) from cn.bing.com.
- `webSearch` dispatcher's fallback is now Bing; `webSearchEngine()`
loader returns "bing" for unset / unknown / legacy "mojeek" values.
- Legacy migration is read-only — we don't rewrite the user's
config.json. `/search-engine mojeek` is no longer in the slash
validation set, so users who explicitly retry the dead name see an
immediate "invalid engine" reject instead of a silent revert loop
on the next launch.
- Dashboard settings panel gets a Search Engine `<select>` with the
six valid backends; POST /api/settings validates the new
`webSearchEngine` field, persists to config, and includes it in the
GET response + `appliesAt` hints.
- searchMojeek/parseMojeekResults/MOJEEK_ENDPOINT removed; i18n
webErrors.mojeek* renamed to bing*; public-API surface swaps
parseMojeekResults for parseBingResults.
Tests:
- parseBingResults: real cn.bing.com HTML fixture, empty input, h2-less
block skip
- webSearch dispatcher hits cn.bing.com with browser UA
- webSearchEngine config loader: enum round-trip, default = bing, legacy
"mojeek" value reads back as bing
* fix(web-search): switch parseBingResults to DOM walk to silence ReDoS scanner
CodeQL flagged three polynomial-backtracking patterns in the regex-based
parser. node-html-parser is already in the file (used by
parseSearxngHtmlResults); using its selector API eliminates the
backtracking class entirely without changing parse semantics.
---------
Co-authored-by: reasonix <[email protected]>
Users still report `preset` flipping back to its prior value after a
relaunch, even with the BOM-cascade root cause (#1431) fixed. Two
follow-on changes to close the gap:
1. `writeConfig` now writes to a sibling `${path}.${pid}.tmp` and
`renameSync` into place. The previous `writeFileSync` is not atomic
on Windows — a concurrent reader during the write window can see a
truncated file, `readConfig` falls through to `{}`, and the next
read-modify-write saves an empty baseline that loses every other
field. The temp + rename pattern guarantees readers see either the
old file or the new one, never an in-flight blob.
2. Restore the `REASONIX_DEBUG_PRESET` env-gated trace retired in
#1431. Logs every `savePreset()` call, every `writeConfig()` call,
and the dashboard PATCH bypass — each with a short stack — so the
`tools/debug-preset-launcher.ps1` script can pinpoint who flipped
the preset when it does. Zero cost when the env var is unset.
Co-authored-by: reasonix <[email protected]>
`opts.signal ?? ctrl.signal` orphaned the timer's controller whenever the
loop forwarded its `_turnAbort.signal` — i.e. every real call. A genuinely
stalled SSE body (TCP open, no `[DONE]`, no close) then sat on
`reader.read()` forever and the TUI hung in "…waiting for response…"
until the user restarted it, even though the server-side request had
already completed.
Combine both signals with `AbortSignal.any` and have the timer abort with
a reason so the loop's error path surfaces "timed out after Xms" instead
of a silent stall.
Closes#1535
Co-authored-by: reasonix <[email protected]>
For example: just in this repo
- before:
1. input @benchmarks/compression-eval/.git
2. press tab
3. reasonix would show @.gitignore
(if just input @benchmarks/compression-eval/ and press tab, then would get benchmarks/compression-eval/.gitignore correctly)
- after: same step1 and step2, in step3 reasonix would show @benchmarks/compression-eval/.gitignore
Pure prompt-engineering tweak — addresses #1495. In long sessions the model has been rationalizing scope cuts to itself ("save tokens", "be efficient") and silently narrowing the user's task instead of asking. Adds a "Task integrity — non-negotiable" paragraph to the code-mode system prompt:
> The user's original objective and ALL constraints (especially "do NOT do X", "avoid Y", "never Z") remain in force for the entire session. You may NOT unilaterally simplify, narrow, or change the objective to save tokens, time, or steps. If you believe the objective needs adjustment, ask the user — do NOT decide on your own.
Inserted before `__ESCALATION_CONTRACT__`, after the format-rules section. About 50 tokens, in the static prefix so it caches with the rest. Additive — the existing cost-aware escalation contract is unchanged.
Refs #1495.
Small follow-up to #1515.
`extractPinnedConstraints` used `.match()` without the `g` flag, which only returns the first capture. The system prompt can carry multiple blocks under the same prefix:
- `# User memory — global` and `# User memory — this project` both exist when a user has both (`src/memory/user.ts` emits them as separate sections).
- Multiple `# Project memory (filename)` sections can show up when a project carries per-subdir memory.
Single-match meant the second one was silently dropped from the fold-tail constraint reinforcement.
Combined the three prefixes into one regex and switched to `matchAll` so every pinned block makes it into the fold summary.
Two fixes around context-fold memory preservation, plus a behavior-stability harness to regression-test them.
**`context-manager.ts`** — fold now reinforces pinned constraints after the summary:
- New `extractPinnedConstraints()` pulls the `# HIGH PRIORITY constraints`, `# User memory`, and `# Project memory` blocks out of the live system prompt and appends them verbatim under a `[PINNED CONSTRAINTS — preserved verbatim]` tail on the synthetic fold summary message. The system prompt always survives the fold (only history is compressed), but in long sessions the model's attention drifts away from instructions at the top; restating them near the current context window mitigates the "lost in the middle" effect.
- Summarizer system prompt now explicitly tells the model to preserve "do not" / "never" / "avoid" instructions when compressing — independent improvement, useful regardless of whether the new constraint tail fires.
**`loop.ts`** — wires `getSystemPrompt: () => this.prefix.system` into `ContextManagerDeps` so the fold can read the current system prompt.
**`benchmarks/behavior-stability/`** — small evals scaffold (harness / runner / report / types + one scenario). The `constraint-persistence` scenario stuffs the log with 40 synthetic turns, triggers a fold with a tiny `keepRecentTokens` budget, and asserts all four pinned constraints (2× HIGH PRIORITY, 1× User memory, 1× Project memory) survive in the folded summary. Local: `npx tsx benchmarks/behavior-stability/runner.ts --local` — 1/1 passing.
Refs #1462.
Pure prompt-engineering tweak. Issue #1372 reports the model reaching for `echo`/`cp`/`sed` through `run_command` to edit files, which trips the confirmation gate and ignores the dedicated `write_file` / `edit_file` / `multi_edit` / `copy_file` / `move_file` / `delete_file` tools that already have validation + rollback.
Prepends a negative-constraint paragraph to the `run_command` tool description telling the model not to use shell utilities for file operations and pointing at the right alternatives. About 50 tokens, included in the static tool spec so it caches with the rest of the prefix.
No behavior or schema change — just text the model sees every turn `run_command` is in scope.
Tiny follow-up to #1499. The harness helper used to register only mutation tools (`delete_file`, `move_file`, etc), but #1499 extended it to register `read_file` too so the cancel/stop-recovery tests could verify read-only operations still work. The old name `registerMutationTools` doesn't fit anymore — renaming to `registerLifecycleToolFixtures`.
Test-only, behavior-neutral.
Refs #1285. Follow-up to #1499.
Lets users type into the composer while a turn is busy and have those messages queued as mid-turn steers — they're appended as user-role guidance at the next loop iteration boundary, never interrupting the in-flight request.
**Loop side (`src/loop.ts`)**
- `_steer: string | null` → `_steerQueue: string[]`. `steer(text)` pushes; `steer(null)` clears.
- At the iteration boundary, shift one off the queue, wrap with `MID_TURN_STEER_WRAPPER` ("Do not treat this as a new task; use it only as additional guidance for the current task after completing the current step.") and `appendAndPersist` it as a `user` message before the next `buildMessages()`.
- `steerConsumed` now means "queue empty after consume" — the UI gate against double-submit.
- All abort / budget / 5xx / context-guard / final-done paths clear the queue so steers can't survive past the turn that owned them.
- When a model response has no tool calls but a steer is queued, the loop now `continue`s instead of returning `done` — so the queued steer drives one more iteration.
**TUI side (`App.tsx`, `PromptInput.tsx`, `ComposerArea.tsx`)**
- New `isBusyPromptCommand(text)` rejects slash / `!`-bang / `#`-memory while busy; ordinary text is accepted as steer.
- `submitPrompt` (dashboard ctx) and the busy keystroke branch both gate on it.
- `PromptInput` separates `inputFrozen` (`disabled && !steerBusy`) from `inputActive` (`!disabled || steerBusy`); placeholder, accent color, and cursor track that. New hint row: `⏎ send — injected mid-turn · esc to stop`.
**Dashboard side (`chat.ts`, `changes.ts`)**
- Both ChatInputs drop `disabled={busy}` on textarea + submit button; placeholder switches to `chat.placeholderSteerBusy`; popover dismisses when busy.
- `loop-to-dashboard` maps `steer` events to `user` messages so the consumed steer shows up in the dashboard transcript.
**i18n** — EN + zh-CN: `placeholderSteerBusy`, `steerHint`, `steerInjected`, `steerCommandRejected`, `steerPlaceholder`, `steerHint`.
**Tests** — 3 new `tests/loop.test.ts` cases:
- steer is persisted wrapped (not raw)
- multiple steers queue + FIFO consume
- `steerConsumed` flips back to `false` on a fresh steer
Adds e2e coverage for two strict-lifecycle recovery paths that weren't pinned down:
1. **User cancels a proposed plan** — after `submit_plan` returns `plan cancelled: ...`, snapshot resets (`planSteps=[]`, `completedStepIds=[]`, `mutatedSinceLastStep=false`); a fresh user prompt flips state back to `armed`; read-only tools work; a follow-up mutation is still rejected with `nextAction: "submit_plan"`.
2. **Checkpoint stop** — same assertions on the post-stop fresh prompt.
To make these tests possible the harness also picks up:
- `QueueGate` now handles the `cancel` verdict on `plan_proposed` (calls `lifecycle.cancel()`).
- Registers a `read_file` tool with `readOnly: true` so the test can prove the read path still works after recovery.
Tests-only — no runtime, prompt, or tool-schema changes.
Refs #1285.
Drops the misleading `^O expand` action hint from the paste-sentinel chip and tightens the Ctrl+O / Ctrl+P shortcut-panel labels.
`Ctrl+O` only toggles the streaming-reply expand view; it does nothing during input, and certainly nothing for pastes. Showing `^O expand` next to a paste chip is a false promise — issue #1493's reporter pressed it and (correctly) got no response. The chip now reads `📋 pasted ... · ⌫ remove`, which is the actual interaction it offers.
While in the strings file, the shortcut descriptions are sharpened:
- `descCtrlO`: "Expand stream" → "Expand reply (streaming only)" (EN) / "展开流式输出" → "展开回复(仅流式输出期间)" (zh-CN) — clarifies the streaming-only scope.
- `descCtrlP`: "Toggle shortcut panel" → "Show/hide shortcuts" / "打开/关闭快捷键面板" → "显示/隐藏快捷键" — shorter, same meaning.
Issue #1493 also reports a separate Shift+Enter bug; that's out of scope for this PR.
Refs #1493.
Adds OS-level notifications to the Tauri desktop app so a user away from the window finds out when:
- a new approval request appears (shell command / path access / choice / plan / checkpoint / revision)
- a long-running turn finishes (only after at least 15 s of busy → idle, to skip quick replies)
Design:
- Pure `deriveDesktopNotifications(...)` derives the list from previous-vs-current snapshots; no Tauri calls inside, so the unit tests run without a window.
- `dispatchDesktopNotifications(...)` takes injected deps (`isFocused` / `isPermissionGranted` / `requestPermission` / `sendNotification`) so the App.tsx wiring is the only place that talks to the Tauri plugin. Focus check is repeated at dispatch time as a second guard.
- Notification permission is requested at most once per session; a denial sticks.
- All copy goes through `t()` against the active desktop UI language; both EN and zh-CN added.
Wiring lives in `TabRuntime` via a `useEffect` over the pending-state slices + busy flag.
`tauri-plugin-notification` is added on both the JS and Rust sides (`Cargo.toml` + `capabilities/default.json`). A vitest alias maps the plugin to a mock so the desktop test suite stays hermetic.
Follow-up to #1546: gate the new `@mention` popover behind `MODE === "attached"`, matching the existing pattern in `chat.ts`.
Without this guard, standalone dashboard clients call `/files` on every `@` keystroke and get a 503 (`"@-mention picker requires a code-mode session"`) back — the popover never opens but each `@` still costs a round-trip. The `MODE` import added in #1546 becomes load-bearing here.
Brings the `@`-mention file picker to the dashboard's Changes / ChatPane, mirroring what's already in `chat.ts`:
- `PopoverKind` extended with `"mention"`.
- `updatePopover` detects the trailing `@prefix` token and posts to `/files` for matching paths.
- `applyPopover` replaces the `@prefix` token in place (not the whole input) so the user keeps anything they typed before it.
- Popover header / row icon switch between `/` and `@` based on `popoverKind`.
The `chat.projectFiles` i18n key already exists in EN + zh-CN — no new strings.
Closes a real SSRF hole in `web_fetch`. Previously the tool accepted any `http(s)` URL and auto-followed redirects, so the model could:
- hit `127.0.0.1` / `::1` directly,
- reach private / link-local / metadata ranges,
- or be redirected from a public host into an internal one mid-chain.
Defense-in-depth in `src/tools/web.ts`:
- Scheme allowlist (`http:` / `https:` only).
- IP-literal check rejecting RFC 1918 + loopback + link-local + CGN (100.64/10) + TEST-NET-1/2/3 + multicast + reserved + benchmarking (198.18/15).
- IPv6 check covering `::`, `::1`, ULA (`fc00::/7`), link-local (`fe80::/10`), multicast (`ff00::/8`), and `::ffff:` IPv4-mapped (recursing into the v4 check).
- For hostnames, `dns.lookup(host, { all: true })` and reject if **any** resolved address is internal — defends against half-public/half-private multi-A records.
- Manual redirect handling with re-validation on every hop + a 5-redirect cap.
- Timeout / response-size limits untouched.
Tests cover loopback literal, hostname resolving to an internal IP, and a public→internal redirect.
Localizes the remaining hardcoded CLI output strings — `reasonix mcp list / search / install` flow, `sessions` listing, `prune-sessions`, and the `/theme` slash handler — so zh-CN users see translated text instead of mixed EN/CN output.
31 new keys across `sessions` / `mcpCli` / `app` namespaces with full EN ↔ zh-CN parity. Mechanical migration — `t()` calls replace each string with the same parameters; no behavior change.
Verified clean rebase on top of the stage-1-through-4 refactor (#1530 / #1534 / #1536 / #1537) plus the path-approval bridge (#1540): typecheck + lint + 3528 tests all pass.
When the model asked for file access outside the sandbox, the TUI opened `PathConfirm` but the web dashboard stayed blank — the loop hung waiting for a decision the web user couldn't make. Same shape as #832 (plan-checkpoint). This PR bridges the path-approval gate end-to-end.
- `ActiveModal` gains a `path` variant (path / intent / toolName / sandboxRoot / allowPrefix).
- `DashboardContext.resolvePathConfirm` mirrors `resolveShellConfirm`.
- `App.tsx` broadcasts `modal-up` / `modal-down` for `pendingPath`, surfaces it in `getActiveModal` (mid-modal reconnect repaints correctly), wires `resolvePathConfirm` to `handlePathConfirmRef`.
- `/api/modal/resolve` accepts `kind: "path"` with `run_once` / `always_allow` / `deny`.
- New `PathModal` Preact component renders with sandbox / allow-prefix rows and three resolution buttons. EN + zh-CN strings added.
Audited every loop-blocking gate while in there — after this lands all of run_command / path_access / plan / plan_checkpoint / plan_revision / choice / edit_review have a TUI ↔ web bridge. Slash-command pickers (ModelPicker / ThemePicker / EditPicker / WorkspacePicker) are still TUI-only but don't block the loop, so out of scope here.
Closes#1538.
Final stage of #1529. The Frame algebra (`vstack`, `hstack`, `slice`, `overlay`, `viewport`, `bottom`, `fitWidth`, etc.) and its ANSI rasterizer existed so a full-screen persistent frame could be composed cell-by-cell. With Static-anchored history and Ink-native rendering, none of that is exercised — `frame-render.tsx` was the only caller of the Frame layer, and it itself had zero callers.
**Deleted:** `src/frame/{frame,ansi,types,index}.ts`, `src/cli/ui/frame-render.tsx`, `tests/frame.test.ts`.
**Migrated:** `src/frame/width.ts` → `src/cli/ui/text-width.ts`. These are text-cell utilities (`stringWidth` passthrough to the `string-width` lib, grapheme-safe `clipToCells` / `wrapToCells` / `graphemes` / `graphemeWidth`) that card renderers and markdown still need — they're not "frame" anything. Implementation is unchanged. 6 src callers and 2 tests updated. New `tests/text-width.test.ts` rescues the width-relevant edge-case coverage that lived in the deleted `frame.test.ts` (CJK, Hiragana / Katakana / Hangul, emoji, ZWJ clusters, combining marks, control chars, mixed scripts) and adds cases for `clipToCells` / `wrapToCells`.
Net: 907 deletions, 9 insertions across 16 files (plus the new 60-line `text-width.ts` and 100-line test file as untracked-then-added).
Closes#1529. Cumulative across stages 1–4: ≈ -2620 lines.
Stage 3 of #1529. The vertical row allocator existed so a full-screen persistent frame could parcel rows between zones (modal, status, input, stream, safety). With Static-anchored history the persistent frame sizes to content and the zones don't compete; there's nothing left to allocate.
**Deleted:** `src/cli/ui/layout/viewport-budget.tsx` (reducer + allocator + `ViewportBudgetProvider` + `useReserveRows` + `useTotalRows`) and its tests.
**Trimmed:** `App.tsx` drops the `<ViewportBudgetProvider>` wrapper (and the indentation it imposed). `StreamingCard`, `PromptInput`, `ChoiceConfirm`, `PathConfirm`, `ShellConfirm`, `PlanCheckpointConfirm` were all side-effect-only callers — removed. `EditConfirm` and `PlanConfirm` were the only consumers that read the allocator's return value; both swap `useTotalRows()` for `useStdout().stdout?.rows` and inline the max into a direct expression. `tests/plan-confirm.test.tsx` renders without the provider wrapper now.
**Kept:** `src/cli/ui/prompt-viewport.ts` — composer-internal input-cell math (CJK width, paste sentinels, single-row slicing). The stage 3 plan said "drop viewport-budget / prompt-viewport, after confirming the composer no longer depends on them"; the composer still depends on prompt-viewport, so it stays.
Net: 727 deletions, 433 insertions across 12 files (most of the App.tsx insertion count is biome re-indenting the subtree that lost its wrapper).
Stage 2 of #1529. `StaticCardStream` landed behind a flag in Stage 1 and held up under real use; this stage promotes it to the only path and deletes the machinery whose entire job was fighting the terminal for scrollback.
**Deleted:** `CardStream` (virtual viewport + height measurement + monotonic-shrink lock + scroll indicator), `chat-scroll-store` + `chat-scroll-provider`, `copy-mode/` (vim/tmux selection mode + OSC 52 snapshot), `InputAreaWithHistoryHint` (unused dead leaf), 5 obsolete tests, the `/copy` slash command + `openCopyMode` slash result + the qq-channel terminal-only notice + the `copyMode` i18n block.
**Trimmed:** `App.tsx` -114 net (drops `STATIC_HISTORY` flag, `HistoryTypingCapture`, `ChatScrollProvider` wrapper, `useChatScroll*` subscriptions, `pendingCopyMode`, the PgUp/PgDn/End/wheel/arrow keystroke handler, the conditional outer Box height); `ComposerArea` no longer wraps the input area in the "scrolled-up history hint" branch; `PromptInput` drops the absolute IME cursor write (its math required the persistent UI at terminal bottom and the Static frame floats); `mouse-mode` defaults to `off` everywhere with the env-var override kept as an escape hatch.
Net: 1545 deletions, 48 insertions across 26 files.
Stage 1 of #1529. Adds a Static-based history renderer behind `REASONIX_STATIC_HISTORY=1` so we can validate it in parallel before later stages delete the virtual-viewport CardStream + chat-scroll-store + copy-mode entirely.
- New `StaticCardStream` partitions cards at the first unsettled entry: settled prefix goes through Ink `<Static>` (terminal owns scrollback), live tail renders dynamically.
- Outer Box drops `height={stdout.rows}` under the flag so the persistent frame doesn't push Static commits straight into off-screen scrollback.
- Mouse mode resolves to a known wheel-passthrough state under the flag, and emits disable sequences for `?1000 / ?1002 / ?1003 / ?1006 / ?1007 / ?1015` on every "off" enable so stale capture from a crashed prior session can't keep eating wheel events.
- `PromptInput`'s absolute IME cursor positioning is skipped under the flag — its `\x1b[row;colH` math assumed the persistent UI sits at the terminal bottom; with the floating Static frame the absolute write desynced Ink's cursor tracking and ghosted previous frames.
Off by default; nothing changes for users who don't opt in.
Ctrl+Enter now inserts a newline instead of submitting, matching the behavior of Shift+Enter and Alt+Enter.
Changes:
- multiline-keys.ts: add key.ctrl to newline condition
- PromptInput.tsx: HintRow shows ^J as alt newline shortcut
- ShortcutsHelpModal.tsx: add Ctrl+Enter and Ctrl+J entries
- i18n: add descCtrlEnter / descCtrlJ translations
Refs #1493
DeepSeek's actual rate limit is concurrency-based, not RPM (500 for
v4-pro, 2500 for v4-flash, account-wide across API keys). When the
account exceeds it the server returns HTTP 429, which currently
surfaces as a raw `DeepSeek 429: {...body}` string — fine for a
maintainer to read, useless for a user trying to figure out why.
Add a friendly message that names the actual cap, identifies the
likely cause (another reasonix process on the same key, or a
parallel subagent fan-out that overshot), and points at the
remediation (wait + retry, reduce parallelism, or request expansion).
Same shape as the existing 401/402/422/400 cases.
Also clarify the `rateLimit.rpm` config docstring: it's a client-side
self-throttle for politeness on shared infra, not a DeepSeek-enforced
limit. DeepSeek has never had a published RPM cap.
Closes#1522
Co-authored-by: reasonix <[email protected]>
* fix(edit): preserve file encoding on read/edit/restore (GB18030, UTF-8 BOM)
read_file / edit_file / multi_edit / applyEditBlock all hard-coded
UTF-8 in readFileSync + writeFileSync. On Chinese Windows hosts most
project files are GB18030; lossy UTF-8 decode mangled the bytes so
the model's SEARCH text never byte-matched, edit_file silently
failed, and the model fell back to PowerShell + git-replay (token-
expensive and lossy for any user manual edits in between).
The shell stdout path already handled this via smartDecodeOutput's
UTF-8-fatal → GB18030 fallback. Same pattern, applied to the
filesystem path, plus encode-back via iconv-lite so the file stays
in its original encoding. UTF-8 BOM round-trips too. Snapshot
records prevEncoding so restoreSnapshots writes back correctly.
Closes#1445
* fix(edit): make GB18030 fallback platform-independent
CI ubuntu build flagged the previous platform gate — GB18030 files
are portable, Linux developers can have CN-Windows-origin files in
their projects. The gate was a copy of smartDecodeOutput's
cmd.exe-specific behavior that doesn't apply to file-on-disk
encoding detection.
---------
Co-authored-by: reasonix <[email protected]>
Mouse wheel sensitivity is terminal-dependent — most emit 2-5 SGR
mouse reports per physical notch (#1419 settled SCROLL_WHEEL_ROWS=1
to keep that case bearable), but some emit one report per notch and
the resulting 1-row-per-notch scroll feels broken (#1494).
A constant-bump fix would regress the over-sensitive class. Add
`mouseWheelRows?: number` (clamped to [1,10]) so affected users can
tune without compromising the default that #1419 validated.
Closes#1494
Co-authored-by: reasonix <[email protected]>
`DEFAULT_NO_PROXY` hardcoded `api.deepseek.com` / `*.deepseek.com` so
the dispatcher always routed them through `undici.Agent()` direct,
bypassing HTTPS_PROXY. Corporate firewalls that block direct egress
therefore broke `reasonix doctor`'s api-reach check with a
ConnectTimeoutError, with no way for the user to override.
Split the defaults: loopback stays mandatory, DeepSeek becomes opt-out
via `proxy.bypassDeepSeekDirect: false` (config) or
`REASONIX_PROXY_DEEPSEEK_DIRECT=0` (env). Default behaviour preserves
the clash/v2ray US-exit-IP 403 fix that put the bypass there.
Closes#1497
Co-authored-by: reasonix <[email protected]>
Validate redirect targets before execution to block sandbox escapes, symlink traversal, and sensitive redirect paths. Preserve PauseGate test stub typing and support case-insensitive Windows environment variables in executable resolution.
- App.tsx $session_empty branch was missing `id` on the error card so
TS rejected the literal against ChatMessage's required-id variant.
- App.test.ts stub state still used the pre-#1487 UsageStats shape
(`tokens.{input,output,...}`); update to the current flat shape so
the test compiles.
Caught by the desktop-v* release workflow — root verify doesn't run
desktop tsc, so these regressed silently after #1487.
`npm ci` inside desktop/ failed with EUNSUPPORTEDPROTOCOL because desktop/
is not listed under root workspaces, so the `workspace:*` spec added in
#1443 had no resolver. Replace with `file:../packages/core-utils`,
which is what the desktop install actually wants (source-only package,
type-only import in desktop sources).
Reported in #1448. With YOLO mode enabled, file edits skip confirmation
(editModeRef path) but shell commands still prompt — defeating the "fully
unattended" promise.
Two layers were supposed to bypass shell prompts in YOLO:
1. shell.ts's `isAllowAll()` check — should skip `gate.ask` entirely.
2. `pause-policy.ts:autoResolveVerdict` — should auto-resolve any
gate.ask that does slip through.
Layer 2 only handled `plan_checkpoint` and `path_access`. `run_command`
and `run_background` fell through to the UI for a manual prompt. That
gap matters because shell.ts's `allowAll` closure reads on-disk config
via `loadEditMode()`, but:
- `reasonix acp --yolo` sets `opts.yolo = true` in-memory without
calling `saveEditMode`, so shell.ts can't see it.
- Anywhere a desync between the in-UI editMode and the persisted
config can occur (e.g. mid-toggle races), shell.ts will let the
gate.ask through.
Extend `autoResolveVerdict` to return `{ type: "run_once" }` for
`run_command` / `run_background` when `editMode === "yolo"` — same
pattern as `path_access`. `run_once` (not `always_allow`) so a YOLO
session doesn't pollute the persisted allowlist with every transient
command. Matches the documented intent ("yolo mirrors shell.ts's
allowAll bypass").
Tests in tests/acp-yolo.test.ts:
- Replaced the previous assertion that `run_command` falls through to
the bridge under --yolo (that was the old design that's now the
bug) with one that asserts auto-resolve to `run_once`.
- Added the same coverage for `run_background`.
- Added a regression that `run_command` in auto mode still bridges to
the client (only yolo bypasses).
Closes#1448
Co-authored-by: reasonix <[email protected]>
User report: storm-repair / repeat-loop warnings pile up as red error
cards in the desktop transcript with no way to close them. A handful
of self-repaired loops in a long session leaves a wall of "错误" cards
permanently sitting in the chat, even though the loop already worked
around the underlying problem.
The kernel-side already classifies these correctly — KernelErrorEvent
carries `recoverable: true` for storm-repair / repeat-loop notices and
`false` for hard failures. The desktop just wasn't using either signal:
- Every error event got the same red tone with no dismiss UI.
This commit:
- Adds an id to each error chat message so dismiss can target one
without taking out unrelated messages.
- New `dismiss_error` action + reducer case removes by id.
- Each error card now renders a close (×) button. Click dispatches
`dismiss_error` for that id.
- When the kernel event marks the error `recoverable: true`, the
card renders with warn tone (warningLabel + tone-warn border/text)
instead of error tone — softer signal for things the loop already
handled.
- Protocol `$error` events (RPC-layer hard failures) keep the red
error tone.
i18n: added `app.warningLabel` and `app.dismissError` for en + zh-CN.
3539 tests pass (+4: dismiss_error by id; no-op for missing id;
recoverable=true from kernel error; recoverable=false from \$error).
Co-authored-by: reasonix <[email protected]>
Follow-up to #1477. The alternate-scroll switch fixed native text
selection / right-click on terminals that honor `?1007h` properly, but
Windows Terminal turns out NOT to be one of them — it advertises the
mode but doesn't reliably translate wheel events into keys, so reasonix
sees nothing and the wheel goes dead in-app. That's exactly the
regression #514 was originally fixed by `?1000h` mode in the first
place. Tested on a fresh checkout: pre-#1477 Windows Terminal wheel
worked; post-#1477 it doesn't.
Pick the protocol by platform:
- `process.platform === "win32"` → `?1000h+?1006h` (proven on
Windows Terminal / conhost / ConEmu, restores wheel for everyone
who had it before #1477)
- otherwise → `?1007h` (still gives back native text-select and
right-click on iTerm2, GNOME Terminal, kitty, Alacritty, recent
xterm — the platforms whose users asked for #1337 / #677)
`REASONIX_MOUSE_MODE=sgr|alternate-scroll|off` still overrides for the
edge cases (e.g. a Linux user whose terminal also breaks under `?1007h`,
or a Windows user who wants the new selection behavior at the cost of
wheel scroll).
Tests use platform-conditional expected sequences so both branches are
verified on CI (Ubuntu hits the alternate-scroll path, Windows hits
SGR). New test specifically covers
`REASONIX_MOUSE_MODE=alternate-scroll` as an override on Windows.
Co-authored-by: reasonix <[email protected]>
* feat(ui): redesign input area and integrate Ctrl+P shortcut help modal
- Remove border lines from PromptInput, keep blue left bar + #1e1e1e background with 5-row internal padding
- Add ShortcutsHelpModal as floating overlay triggered by Ctrl+P, styled with round border and #649ed2 accent
- Remove Ctrl+P from multiline-keys ↑ alias (was conflicting with shortcut panel)
- Mode display in PromptInput now uses i18n (t('statsPanel.modeYolo/Auto/Review'))
- StatusRow: remove PresetPill ('▴ auto'), fix balance order to '剩余 balance', i18n Ctrl+P hint
- Remove edit-mode status bar (ModeStatusBar) from ComposerArea (duplicated with shortcut modal)
- InputAreaWithHistoryHint restyled with blue left bar + #1e1e1e to match input box
- All shortcut descriptions in ShortcutsHelpModal use i18n via t() calls
- Add i18n keys for shortcutsHelp + statusBar.shortcutsHint in EN / zh-CN / types
* fix(tests): update multiline-keys tests for Ctrl+P removal as arrow alias
Ctrl+P now handled by App.tsx shortcut modal, no longer maps to arrow-up in multiline-keys.ts. Tests updated to verify NOOP behavior for Ctrl+P and moved arrow-up cursor tests to use upArrow key.
---------
Co-authored-by: Reasonix Dev <[email protected]>
Reported in #1456. Repro:
1. /plan → agent generates plan → plan approval card renders below
the assistant message
2. User types follow-up guidance and presses Enter → queued (busy=true)
3. User clicks what looks like the send button — but with busy=true the
composer swaps it for the stop/abort button. The turn aborts.
4. \`$turn_complete\` fires (busy=false), the queue drains, send_user
appends the user's text to state.messages. But pendingPlans was
never cleared, so the orphaned plan card is still rendered AFTER
all messages. Result: the new user message visibly lands ABOVE
the plan card, exactly the layout the issue screenshots show.
By the time the loop emits \`$turn_complete\` any modal still in a
pending* array is orphaned — the tool call that opened it has either
resolved already (so the array entry is gone) or the turn aborted
(so the model isn't coming back for it). Clear all six pending arrays
at that point.
The error toast the user also saw is from the aborted submit_plan call
unwinding through pauseGate; that path is unchanged.
Closes#1456
Co-authored-by: reasonix <[email protected]>
Reported in #1479. The bottom status bar shows the session-aggregate cache
hit (intentional, per the comment in state/events.ts — same number as the
web dashboard). `/cost` was showing the LAST TURN's ratio, so on any
session where one turn ran cold (e.g. the first one, or right after a
fold) the two numbers diverged and looked like a bug.
Switch `/cost`'s Usage card to `summary.cacheHitRatio`. The card also
shows `sessionCost`, so a session-aggregate cache hit reads cleanly
alongside it. Per-turn metrics in the card (prompt/output tokens, turn
cost) are unchanged.
Closes#1479
Co-authored-by: reasonix <[email protected]>
Reported in #1475. After pressing Esc on the plan picker (entering the
reject staged input), pressing Esc again restored the picker but choosing
"Accept" then surfaced ANOTHER staged input — the "approve mode" optional-
guidance prompt. That input was visually close enough to the regular
composer that users assumed they were back in normal chat and typed
follow-up instructions (e.g. "执行计划") into it, which actually went
through as the approve verdict's `feedback` field. The user's mental
model — "Accept means run it" — kept breaking.
The optional-guidance staged input only makes sense when the plan has
open questions that the user needs to address before approving. When
the plan is fully specified, Accept should resolve the pause gate
directly. Updated handlePlanConfirm so:
- `approve` with no open-questions section → resolve the gate immediately
via the same handleStagedInputSubmit override path used by /dashboard,
so plan-card lifecycle hooks (recordPlanApproved, showPlan(active),
persistPlanState) all fire identically to the explicit-feedback path
- `approve` with open questions → staged input still appears so the user
can answer them
- `refine` → unchanged, always shows the input (feedback is the point)
- `/apply-plan` slash fallback (no pending plan, no gate) → unchanged
The Esc-back restoration loop now terminates the moment the user picks
Accept, instead of dropping them into a deceptively-similar second input.
Closes#1475
Co-authored-by: reasonix <[email protected]>
Adds a session_rename IPC command that writes to meta.summary, plus an inline edit affordance in the sidebar (pencil icon, Enter/Esc/blur). Reorders the header title to prefer meta.summary over the first user message so a rename is reflected immediately.
The TUI never reacts to mouse clicks or drags — only the wheel — but the
old `?1000h+?1006h` default made the terminal capture ALL button events
and route them to reasonix. Reasonix then dropped them, which silently
broke native text selection and right-click context menus for every user
just to get wheel scrolling working. The same pattern shows up across at
least four bug reports (#1266 wheel broken on Linux, #1337 left-drag and
right-click broken on Windows Terminal, #677 PowerShell long answers
can't be selected, #1419 wheel too sensitive + selection broken).
`?1007h` (DECSET alternate scroll) is the correct protocol for an app
that only cares about wheel events: the terminal translates the wheel
into cursor/PageUp/PageDown keys (which reasonix's chat-scroll handler
already understands) and leaves clicks/drags alone for the terminal to
handle natively. Supported by Windows Terminal, iTerm2, GNOME Terminal,
kitty, Alacritty, recent xterm. Old emulators that don't recognise it
silently ignore the sequence — wheel falls back to the host terminal's
own scrollback, still functional.
Escape hatch via `REASONIX_MOUSE_MODE=sgr|alternate-scroll|off` for the
small slice of users on edge-case terminals; default is alternate-scroll
so the common case needs zero configuration.
Closes#1266
Co-authored-by: reasonix <[email protected]>
Three bugs piled up on the desktop /btw path so the user saw nothing after
pressing enter until a delayed error showed up:
1. The composer never dispatched send_user for the /btw line, so the typed
text never landed in the message stream and the user had no confirmation
the command was received. Mirrors the CLI shape (log.pushUser(text))
now: the full /btw line is echoed and busy flips on while the side call
runs.
2. $btw_result didn't clear busy on arrival, so even after the answer
showed, the composer would have stayed disabled. Reducer now flips
busy back off when the result lands (matches $error which already
clears busy on the failure branch).
3. The backend sent the question to the model with the FULL coding system
prompt (tab.system) instead of the brief side-question prompt the CLI
uses. That put the model into coding-agent mode for an unrelated side
question — it would either hang trying to call tools that weren't
wired up for the side-channel or take a long time to produce an
answer, which is exactly what the bug report described
("过了一段时间出现一个报错提示"). Backend now mirrors the CLI's
one-shot side-question prompt.
Closes#1470
Co-authored-by: reasonix <[email protected]>
The first test in `chat-mcp-startup-summary.test.ts` timed out at 15s
on Windows CI during the #1439 post-merge run. Vitest's coverage (v8)
instrumentation roughly doubles cold dynamic-import cost, and the first
`captureStartupState` call eats most of that — the SECOND test in the
same describe was back to ~400ms once the worker was warm.
Bump the describe-level timeout to 30s. Happy-path runs are unchanged
(each test still finishes in well under 500ms after the first cold
load); only a hung/genuinely-broken test gets a longer chance to fail.
Co-authored-by: reasonix <[email protected]>
* fix(desktop): sync context token meter after /compact (#1305)
Problem: Desktop ContextPanel showed stale token counts after /compact
because it relies on per-turn API usage events (model.final) to update
cacheHitTokens/cacheMissTokens. /compact is a local operation with no
API call, so no usage event fires and the meter never refreshes.
Fix (high-cohesion):
1. ContextManager.getLogTokens() — real-time token count of current log.
2. Loop.getCurrentLogTokens() — forwards to ContextManager.
3. Extend \$ctx_breakdown event with optional logTokens field.
4. emitCtxBreakdown() now computes + pushes logTokens alongside
reservedTokens, becoming the unified context-refresh entrypoint.
5. compact_history handler calls emitCtxBreakdown(tab) on success so
the frontend immediately receives the compressed token count.
6. App.tsx \$ctx_breakdown handler resets cacheHitTokens=0 and
cacheMissTokens=logTokens when logTokens is present, calibrating
the meter to the actual current context size.
This keeps all computation in ContextManager, all emitting in
emitCtxBreakdown, and all consumption in App.tsx — no new event types.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* feat(core-utils): introduce ApprovalPrompt unified data model (#1322 Phase 3 PR 1)
- Add `toApprovalPrompt()` and `resolveApprovalPrompt()` in `@reasonix/core-utils`
to serve as the single source of truth for PauseRequest → UI metadata mapping.
- Define `ApprovalPrompt`, `ApprovalAction`, `ApprovalTone`, `ApprovalPromptKind`
types with English fallback labels.
- Move `derivePrefix` computation into `toApprovalPrompt` so all surfaces share
one implementation.
- Add `secondaryInput` to `ApprovalAction` to describe two-phase deny flows.
- Replace ACP `gates.ts` inline mapping with calls to the new unified helpers,
deleting duplicated `permissionOptionsFor`, `permissionTitleFor`,
`permissionKindFor`, `verdictFor`, and all `ID_*` constants.
- Update `acp.test.ts` to use new semantic action IDs (`always_allow`, etc.).
- Add `packages/core-utils/tests/**/*.test.ts` to vitest include pattern.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* feat(cli): migrate ShellConfirm and PathConfirm to ApprovalPrompt model (#1322 Phase 3 PR 2)
- Update `ShellConfirm.tsx` and `PathConfirm.tsx` to accept `prompt: ApprovalPrompt`
instead of individual raw fields.
- Drive `SingleSelect` items from `prompt.actions` instead of hardcoded options.
- Trigger deny phase via `action.secondaryInput` detection instead of hardcoded
"deny" value check.
- Remove `clampCommand`, `tildeify`, and `derivePrefix` from ShellConfirm/PathConfirm
(computed centrally in `toApprovalPrompt`).
- In `App.tsx`, call `toApprovalPrompt()` at render time for both shell and path
confirmations, removing inline `derivePrefix` at the component boundary.
- Update `shell-confirm-render.test.tsx` to use `ApprovalPrompt` fixtures.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* feat(desktop): migrate ConfirmApprovalCard and PathAccessApprovalCard to ApprovalPrompt (#1322 Phase 3 PR 3)
- Add `@reasonix/core-utils` workspace dependency to `desktop/package.json`.
- Extend `ConfirmRequiredEvent` and `PathAccessRequiredEvent` with optional
`prompt: ApprovalPrompt` for backward-compatible RPC.
- In `src/cli/commands/desktop.ts`, call `toApprovalPrompt()` when emitting
`$confirm_required` and `$path_access_required` events.
- Update `ConfirmApprovalCard` and `PathAccessApprovalCard` in
`desktop/src/ui/thread.tsx` to consume `prompt` instead of raw fields.
- Drive primary/secondary/tertiary buttons from `prompt.actions` mapped by
`kind` (`allow_once`, `allow_always`, `reject`).
- Map `ApprovalPrompt.tone` to Desktop `ApprovalTone` (warn/danger/info/brand).
- Remove inline `derivePrefix` from card components.
- Update `PendingConfirm` and `PendingPathAccess` types in `desktop/src/App.tsx`
to store `prompt`, and pass it to the card components at render time.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* test(desktop): add ApprovalPrompt reducer and component tests
- Add desktop/src/App.test.ts (5 reducer integration tests)
- Add desktop/src/ui/thread.test.tsx (6 component rendering tests)
- Install @testing-library/react and jsdom for Desktop component testing
- Configure vitest with React aliases to prevent duplicate React copies
- Fix tildeify double-slash normalization bug on Windows
- Fix ACP gates comment length to pass policy check
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(desktop-tests): mock Tauri and lucide-react imports for CI
CI installs only root dependencies; desktop-specific deps like
@tauri-apps/api and lucide-react are not available in test runners.
Add vi.mock() calls to App.test.ts and thread.test.tsx so vitest
can resolve these imports without the desktop node_modules.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(tests): add vitest aliases for desktop-only dependencies in CI
CI installs only root dependencies; desktop-specific packages like
lucide-react and @tauri-apps/api are not available. Add mock modules
in tests/mocks/ and wire them via resolve.alias in vitest.config.ts
so desktop tests can resolve these imports without desktop/node_modules.
Also remove redundant vi.mock() calls from App.test.ts and thread.test.tsx
since aliases now handle module resolution globally.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
* fix(desktop-tests): mock local desktop modules to avoid transitive dep loading
App.test.ts imports reduce from App.tsx, which transitively loads
CommandPalette, Markdown, and theme modules with desktop-only deps.
thread.test.tsx imports from thread.tsx, which loads cards.tsx,
which loads Markdown.tsx with react-markdown and other deps.
Add vi.mock() for these local module boundaries so tests resolve
without needing the full desktop/node_modules dependency tree.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
---------
Co-authored-by: Claude Sonnet 4.6 <[email protected]>
End-to-end benchmark across 12 runs (3 repeats × 4 thresholds on the
"audit src/ and write an architecture overview" task, ctxMax forced to
120k to make folds reachable) showed normal fold at 0.5 is a stable net
loss:
config folds hit% miss cost
no-fold 0.0 92.7±1.3 75k±4k $0.0169±0.0006
current 50/70 2.3 83.0±9.5 127k±48k $0.0221±0.0054
late 75/90 0.0 92.7±1.7 82k±26k $0.0184±0.0040
agg 90/95 0.0 92.6±0.3 57k±8k $0.0142±0.0014
Every fold wipes the prefix cache: in current_50_70 prompt tokens drop
63k→16k at the fold, then the next ~9 turns rebuild a fresh prefix and
miss tokens climb 2-3×. Task quality is unchanged across configs (all
12 runs completed the audit), so fold was buying nothing in exchange.
Raising HISTORY_FOLD_THRESHOLD to 0.75 keeps fold available as a
last-mile-before-force-summary mechanism without firing on mid-context
turns. Aggressive lifted to 0.78 to stay in the same band.
The benchmarks/compression-eval/ harness is included so future tuning
can re-run on the same task.
Co-authored-by: reasonix <[email protected]>
A user reported a cryptic `DeepSeek 400: messages[156].content: unexpected
end of hex escape at line 1 column 884819` mid-session. Reproducing against
real session logs: Node's `JSON.stringify` can't emit a malformed `\u`
escape, and no lone surrogates exist in any of 10 saved sessions — the
gateway is truncating the request body mid-escape because it exceeds the
DeepSeek API's body-byte limit, which is independent of the 1 M-token
context window the existing preflight checks.
Token preflight stays at 95% of ctxMax. New byte preflight trips when the
stringified messages array exceeds `MAX_BODY_BYTES` (700 KB, ~80% of the
observed 884 KB failure point). Either signal triggers the existing
`mechanicalTruncate` path; the truncate now bounds output by tokens AND
bytes so byte-triggered folds actually shrink the body.
The `trigger` field on `PreflightDecision` records which signal fired so
follow-up diagnostics (and the user-facing warning, now showing body KB)
can distinguish the two paths.
Two `tests/loop.test.ts` fold cases used 2 MB seed logs and a 1 M-token
ctxMax to verify fold tier behavior. With the new 700 KB byte gate the
preflight emptied those logs before fold could run; switched both to a
100 K test ctx + proportionally scaled seed sizes so they exercise fold
tiers within both windows.
Two reusable tools added under `tools/` (`analyze-session-body.mjs`,
`scan-all-sessions.mjs`) so future "DeepSeek 400 from a long session"
reports can be diagnosed from the user's local session files without
guessing.
Co-authored-by: reasonix <[email protected]>
The dsnix workspace landed in #1440 but its addition wasn't reflected
in package-lock.json, so `npm ci` fails on every fresh checkout — main
CI has been red since the merge. Regenerate the lock so workspace
entries match the new package.json shape.
Also extend the README install section with the dsnix one-liner so the
shorter command is discoverable, not just a hidden bin alias.
Co-authored-by: reasonix <[email protected]>
`reasonix` is nine characters; users asked for a shorter form. Ship
a thin alias under `dsnix` that resolves to the same CLI:
- bin alias on the main package so global installs expose both
- dedicated shim package on npm so `npx dsnix@latest` works
- independent publish workflow keyed on `dsnix-v*` tags
Version tracks reasonix 1:1; first release at 0.48.0.
Co-authored-by: reasonix <[email protected]>
Headline themes:
- Network: full NO_PROXY support + per-host routing visible in /doctor
- Code intel: tree-sitter get_symbols/find_in_code + Java source/decompile + Perplexity/Exa search
- Lifecycle: gate mutations during checkpoints, preserve state across plan revisions
- Subagent: live byte progress + top-level explore/research/review
- Desktop: QQ sessions usable, custom fonts, lots of reliability fixes
See CHANGELOG for the full list.
Surfaces basic project metadata inside the chat without sending the user
to the docs site or package.json. Lives in the info group next to
/feedback so the discoverability path is obvious from the bare-slash
picker.
Output (EN):
Reasonix vX.Y.Z — a cache-first DeepSeek coding agent
Website https://esengine.github.io/DeepSeek-Reasonix/
GitHub https://github.com/esengine/DeepSeek-Reasonix
License MIT
URLs + license tag are constants in the handler (language-agnostic);
header + row labels go through i18n so the zh-CN bundle matches the rest
of the TUI.
Co-authored-by: reasonix <[email protected]>
Two changes:
1. `readConfig()` strips a leading UTF-8 BOM before `JSON.parse`. Windows
PowerShell 5's `Set-Content -Encoding UTF8` and several text editors
emit `EF BB BF` at the head of the file; `JSON.parse` rejects that
and throws, which used to fall through to the `return {}` branch
and silently nuke every saved field on the next read-modify-write —
you'd lose `apiKey`, `preset`, `mcp`, the whole config after one
`saveEditMode` or `markEditModeHintShown`. Reproduced reliably in
diagnostic-probe sessions; verified fixed by injecting a BOM and
confirming all 13 fields survive a normal run.
2. The trace hooks added in #1429 (`debugLogConfigWrite`,
`debugLogPresetWrite`, `debugLogPresetWriteFromDashboard`) did their
job: they confirmed every `writeConfig` callsite preserves fields,
and that no hidden bypass exists. The "preset flipped to pro after
relaunch" report was a BOM-corruption cascade, not a stealth save.
Drop the diagnostic now that the underlying bug is fixed at the
source.
Test plan:
- `npx tsc --noEmit` clean
- `npx biome check src/config.ts src/server/api/settings.ts` clean
- Manual: inject `EF BB BF` head into config.json, run `reasonix code`,
exit, confirm all 13 fields preserved (was: collapsed to 3 fields)
Co-authored-by: reasonix <[email protected]>
PR #1055 capped tool-card output but left reasoning.text, streaming.text,
and diff.hunks on every card forever. On thinking-model sessions
reasoning.text dominates the cards array: 50KB-1MB per turn x thousands
of turns drags it into the GB range until Mark-Compact gives up. The
heap snapshot in #1031 is the symptom.
Generalize elideOldToolOutputs into elideOldCardContent. Same window
(200 cards), same idempotent stub prefix, same on-disk-log pointer
message; now also stubs reasoning + streaming text and clears
diff.hunks (stats stay so the badge still renders). Streaming cards
mid-flight (streaming===true / done===false) skip elision so chunks
don't land on a stub. UserCard text is left full — user input is
small and precious.
End-to-end budget test (cards-memory-budget.test.ts) drives 1000-turn
realistic sessions and asserts state.cards retains under 10% of raw
input bytes. Measured: 5.4 MB retained vs 110 MB raw (95% off); V8
heap delta 3.4 MB with --expose-gc.
Co-authored-by: reasonix <[email protected]>
WebView reload flashes a white frame and drops React state (open
composer, in-flight gates) — packaged apps shouldn't expose browser
shortcuts users hit by reflex. Gate on !import.meta.env.DEV so the
dev workflow still has the escape hatch if HMR ever gets stuck.
Co-authored-by: reasonix <[email protected]>
REASONIX_DEBUG_PRESET=<path> turns on a timestamp + stack trace at three
points: the writeConfig() sink (catches any path that goes through it),
the savePreset() callsite, and the dashboard /api/settings PATCH branch
that mutates cfg.preset directly. Zero-cost when the env var is unset.
Co-authored-by: reasonix <[email protected]>
Windows users reported the desktop window booting into a near-black
screen with `rpc_spawn failed: rpc already spawned` in DevTools. Two
issues conspiring:
1. The Rust `rpc_spawn` command errors out if the Node child is already
running. Any path that remounts the React effect (WebView reload via
DevTools F5, host-side respawn, transient re-render) hits this and
logs to console.
2. Node's bootstrap events (`$tab_opened`, `$settings`, `$needs_setup`,
`$ready`) are fire-once during `bootstrapTab`. A reloaded React app
never receives them — the Setup view stays in its initial state and
structural copy renders against unset CSS variables, so the user
sees a mostly-empty dark window.
Make `rpc_spawn` idempotent (a second call is a no-op for the spawn
itself) and have the frontend follow up with a new `desktop_resync`
command. The Node handler walks every live tab and re-fires the
bootstrap events; the reducers already dedupe by tab id so an extra
emit on the fresh-spawn path is harmless.
Co-authored-by: reasonix <[email protected]>
The POST /settings handler rejected an empty baseUrl with 400, so once
a user had typed a base URL into the dashboard they could only edit it,
never clear it — the only way back to the default was hand-editing the
JSON config. Treat empty / whitespace-only as "clear" instead: drop the
key from disk so loadBaseUrl() falls through to DEEPSEEK_BASE_URL or the
built-in default on next start. GET continues to surface null when the
key is absent, which the dashboard already renders as an empty input.
Closes#1409
Co-authored-by: reasonix <[email protected]>
* fix(ui): map mouse wheel to single-row scroll, not page
Wheel ticks were routed to scrollPageUp / scrollPageDown (5 rows each).
Most mice emit 2-5 SGR mouse reports per physical notch, so one flick of
the wheel jumped the buffer by 10-25 rows — what the issue describes as
"abnormally sensitive". Splits wheel into its own action backed by
SCROLL_WHEEL_ROWS=1 and leaves PgUp / PgDn on the page step. PlanConfirm
detail pane gets the same treatment so the modal scroll matches.
Closes#1419 (first half).
* fix(ui): collapse per-card stdout resize listeners into one broadcaster
Ink's useBoxMetrics calls stdout.on('resize', ...) once per mounted
card. A long chat legitimately holds dozens, so any fixed cap is a
band-aid — the previous setMaxListeners(200) just delayed the
MaxListenersExceededWarning, it didn't fix it.
Shim stdout.on / .off for the 'resize' event into a single subscriber
Set with one real native listener. Ink's per-card subscribe path is
unchanged but no longer touches Node's EventEmitter accounting. Install
before render() so Ink's own constructor-time subscribe is shimmed too.
Closes#1419 (second half).
---------
Co-authored-by: reasonix <[email protected]>
Refuse text edit blocks when the SEARCH content matches more than once in the target file. This keeps the `/apply` path aligned with `edit_file` behavior and prevents silently modifying the first matching occurrence when the model did not provide enough context.
Update the edit block test to assert that ambiguous SEARCH text leaves the file unchanged.
Co-authored-by: Cursor <[email protected]>
* chore(desktop): document writeAllSync + drop redundant optional chain on caught err
* feat(subagent): live byte progress + top-level explore/research/review tools
The "subagent looks frozen" UX problem had two roots — fixed both, with
one architectural change and one set of progress affordances.
1. Sink wiring (the actual bug): `buildCodeToolset` runs before the TUI
mounts, so its `subagentRunner` closure can't capture a sink ref.
Introduce `SHARED_SUBAGENT_SINK` — a process-wide `{current: null}`
singleton both sides reach through. Setup reads `.current` at
dispatch time; `useSubagent` writes `.current` on mount. The wiring
resolves itself in time order without prop-drilling through
`chatCommand`. Tests / library callers can override via the new
`subagentSink` option on `buildCodeToolset`.
2. Live byte counters: `spawnSubagent` now emits throttled
`stream-progress` events carrying monotonic `outputChars`,
`reasoningChars`, and `toolReadChars`. `SubagentRow` renders these
as `↓ read X · ↑ out Y · ◆ think Z`. `OngoingToolRow` carries the
same line as a fallback (so the bytes show even if the rich
SubagentRow is off-screen) and adds `args N B` for any in-flight
tool dispatch.
Two unrelated improvements bundled:
3. Top-level subagent tools: `explore` / `research` / `review` /
`security_review` registered as siblings to `read_file`. Same
`subagentRunner` path as `run_skill(name="explore", ...)` — the
surface change is purely affordance. Models pick the tool whose
name matches the verb in the question; the `run_skill` meta-API
was too indirect. Empirically lifts the model's "spawn vs chained
read_file" decision toward the right choice on broad audit
queries. User-defined skills still flow through `run_skill`.
4. `forceSummaryAfterIterLimit` now passes `thinking: "disabled"` —
the task is "paraphrase tool results into prose", which needs zero
reasoning. Pinning was `thinking: enabled` + `reasoningEffort:
high` and burning reasoning tokens on every storm-breaker /
context-guard summary.
Verification:
- `npx tsc --noEmit` clean
- `npx biome check src` clean
- Full suite: 3420 passed / 9 skipped
- New tests: 7 cases for the top-level wrappers (registration,
dispatch, model→skill name mapping for security_review, no-runner
error, empty-task guard, inline-override bounce)
---------
Co-authored-by: reasonix <[email protected]>
Desktop runTurn checks its own outer aborter after each yielded event and
break's out of the for-await on stop. That calls generator.return() on
loop.step(), which throws into the suspended yield and skips any
straight-line code after it. Both abort handlers (iter-start and
in-flight) had `_turnAbort = new AbortController()` after the bail-out
yields, so the reset never ran when the consumer broke early. The next
step() then carried the stale aborted state via the carry-abort check at
the top and re-fired the "在第 0 次工具调用处中断" warning at iter 0
without making any API call — every subsequent user message in the
session was effectively dead until restart.
Move the reset into a finally block in both handlers so generator.return()
still runs it. Existing turn-bleed test only drained events to completion
and didn't catch the consumer-break path; added a regression that mirrors
the desktop pattern (break right after the abort warning yield).
Co-authored-by: reasonix <[email protected]>
End-to-end validation showed model-driven spawn_subagent loses 5× vs
no-spawn baseline due to spawn storms; the orchestrator topology RFC
is moot since production already routes subagents through named skills
(/explore, /research, /review, /security-review) rather than a
free-form model-callable tool. The 9 probe scripts existed to measure
the deferred-cost case for an unshipped model-spawn surface and no
longer have a referent.
Co-authored-by: reasonix <[email protected]>
Refs #1285 / #1306.
The lifecycle state machine in `src/code/lifecycle.ts` already exposed a `checkpoint` state but the runtime never entered it — checkpoint pauses ran through `approved`/`executing` instead. That meant high-risk mutations weren't gated while a checkpoint was waiting on continue/revise/stop, and a stopped checkpoint could leave the lifecycle in an execution-shaped state instead of cleanly cancelling.
- New `EngineeringLifecycleRuntime.recordCheckpointReached()` — flips `approved` / `executing` → `checkpoint`. `guardToolCall` already blocks high-risk mutations when state isn't `approved` or `executing`, so the new transition picks up gating for free.
- `App.tsx` plan-checkpoint hook calls it as soon as the gate fires.
- If the user picks `stop` at the checkpoint, `App.tsx` now calls `lifecycle.cancel()` so the lifecycle ends cleanly instead of staying mid-flight.
Tests cover the gated-mutation path and the clean-cancel path.
`npm run verify` was OOMing on 16-core hosts mid-run with V8 `Zone Allocation failed`, causing cascading flake (`spawn UNKNOWN`, dashboard 21s timeouts, `jobs.tailLines` mismatches).
Root cause: vitest defaults to `pool: "threads"`, so all worker threads share one Node process's ~4GB heap. With 16 cores, ~15 workers × ~300MB each — each loading the tokenizer BPE + tree-sitter wasms + sqlite handles — blows past the heap cap. `retry: 1` doubles transient state on flakes.
Switch to `pool: "forks"` with `maxForks: 8` so each test file runs in its own process with its own heap; process exit frees everything. Costs ~20% wall-clock (62s → 74s on this box) for full isolation.
3412 tests / 244 files pass, no OOM, no `spawn UNKNOWN`, no zone-allocation failures.
The end-to-end `run_background → list_jobs → wait_for_job → job_output → stop_job` test added in #1400 (`tests/shell-tools.test.ts:647`) used the default 5s vitest timeout. On Windows the full chain — Node child spawn + 500ms `wait_for_job` + SIGTERM grace inside `stop_job` — runs ~3-8s depending on load. Verified failing on plain main under moderate load.
Raise the per-test timeout to 15s. No functional change.
Refs #1285 / #1301 / #1306.
The repeated-rejection guard in `ToolRegistry.dispatch` already sharpens the error message when the model retries the same lifecycle interceptor rejection. Two gaps:
1. **Sensitive to JSON key order.** `{command, cwd}` vs `{cwd, command}` fingerprinted as different calls, so the guard didn't fire on a real retry.
2. **Only triggered on structured `rejectedReason` payloads.** Plain-text host denials (`run_command` / `run_background` `user denied:` and `edit_file` / `write_file` `User rejected this edit`) flew under the guard, so the model could keep submitting the same shell or edit until the user gave up.
- `fingerprintArgs` now runs JSON through a recursive key-sort before stringify; `rawFingerprintArgs` keeps the literal string path for invalid-JSON malformed feedback.
- New `plainTextRejectedReason()` recognises shell-gate and edit-gate text patterns and tags them with a `rejectedReason` for the storm guard.
- `rejectionRecoveryHint()` returns per-reason guidance instead of a single generic hint, so the second-rejection error message names the actual escape hatch (allowlisted command vs different edit vs revise plan).
- Internal `_lastInterceptorRejection` → `_lastGateRejection` rename reflects the broader scope.
Test coverage: lifecycle gate with reordered keys; shell-gate corpus across `run_command` / `run_background`; edit-gate corpus.
Refs #1285 / #1306 / #1302.
The plan store already persists structured step evidence from `mark_step_complete`, but the scrollback only shows generic "step N/M complete" progress. During an active engineering lifecycle that means verification / diff / checkpoint / manual evidence stays buried in the plan state and only appears via `/plans show`.
Adds a compact ghost-styled scrollback line right after the step-progress line when `mark_step_complete` returns structured evidence:
```
evidence: verification - lifecycle tests passed (npm test -- tests/lifecycle.test.ts); diff - runtime transition added (src/code/lifecycle.ts, tests/lifecycle.test.ts)
```
- New `formatStepEvidenceSummary` / `formatStepEvidenceItem` helpers in `src/cli/ui/hooks/handle-tool-event.ts`.
- Path list capped at first 3 to keep the line tight.
- Plan store format unchanged.
New `tests/handle-tool-event.test.ts` covers the formatting path with a mocked Scrollback.
Refs #1285 / #1306.
Previously the App handled an accepted plan revision by replaying state through `recordPlanApproved(merged)` + a loop of `recordStepCompleted()` calls. That round-trip resets approval state and can clear mutation-evidence obligations earned during the steps that were already done — which weakens the reliability rail right after a redirected step.
- New `EngineeringLifecycleRuntime.recordPlanRevised(remainingSteps)` — first-class lifecycle transition for accepted revisions.
- Keeps already-completed steps in `_planSteps`, replaces only the remaining tail.
- Preserves `mutatedSinceLastStep` so the next `mark_step_complete` still needs evidence.
- App `applyPlanRevision` switches from the replay loop to the single API call.
Test coverage: revision keeps completed steps + new tail; revision after a mutation still requires evidence for the next step.
Refs #1285 / #1306.
After #1306, strict lifecycle is opt-in, but the App had no way to tell `/plan off` (an explicit user request to leave) apart from the internal plan-mode shutdown that happens after plan approval. Result: lifecycle rails could stay armed even after the user explicitly asked to leave.
Threads a `PlanModeToggleSource` through `togglePlanMode` so the slash-driven path can release the lifecycle while the internal post-approval path preserves it.
- `/plan off` → release strict lifecycle immediately
- internal plan-mode shutdown after approval → keep lifecycle execution state intact
Refs #1343 — clearer desktop QQ path and a slimmer top-level README.
- README.md / README.zh-CN.md: trim QQ section to a short overview + entry points, link out to the dedicated guide. The full tutorial belonged in `docs/qq-connect.md`, not the top-level README.
- docs/qq-connect.md: new "Desktop quick start" with the actual button flow (`Settings -> General -> QQ Channel -> Configure -> Save and connect`) + the active-tab binding note, plus a troubleshooting case for "configured but no round-trip."
- docs/qq-connect.zh-CN.md: mirrors the English changes; replaces English desktop labels with the real Chinese i18n labels (`设置 -> 通用 -> QQ 通道`, `配置`, `沙箱` / `正式`, `保存并连接`). Verified all label strings exist in `desktop/src/i18n/zh-CN.ts`.
Fixes#1305 — Desktop ContextPanel shows stale token counts after `/compact`.
`/compact` is a local operation (no API call), so the `model.final` usage event that normally refreshes `cacheHitTokens` / `cacheMissTokens` never fires. The meter stays pinned to pre-compact numbers until the next real API turn.
- New `ContextManager.getLogTokens()` — sums `countTokensBounded(content)` per message (plus assistant `tool_calls` JSON when present).
- `Loop.getCurrentLogTokens()` forwards to it.
- `$ctx_breakdown` event gains an optional `logTokens` field; `emitCtxBreakdown()` populates it.
- `compact_history` handler emits `$ctx_breakdown` on success so the panel refreshes immediately.
- Frontend resets `cacheHitTokens=0`, `cacheMissTokens=logTokens` when `logTokens` is present — a transient calibration; the next real API turn overwrites both with actual usage numbers.
The token count is approximate (skips role markers + DSML wrappers), which is fine for a UI meter — directionally correct is what matters here.
The top-level `run_command` description already enumerates the chain operators / redirects / rejected forms. The `command` parameter's own description repeated the same list verbatim — 432 chars of duplicated syntax docs the LLM was paying for on every uncached turn.
Schema token cost: 415 → 296 (−119, −28.7% on this tool). Total fixed-prefix tool tokens: 6997 → 6878. All 106 `tests/shell-tools.test.ts` cases pass — the trimmed text contained no decision-making content, only restated syntax the top-level already covered.
Verified via `scripts/measure-tool-token-cost.mts`.
`scripts/measure-tool-sizes.mts` reports byte counts — useful for compression planning but not what gets billed. The prompt-token cost is what the V4 BPE charges, and byte count is only a rough proxy. This script measures the real thing.
`scripts/measure-tool-token-cost.mts` registers the full tool suite in a tmp workspace, dispatches each with a representative input, and reports schema / args / output token counts using `src/tokenizer.ts`. Gate-bound tools (`submit_plan`, `ask_choice`, …) are skipped because they block on the user. Every non-skipped tool executes against real filesystem / shell / mocked-fetch state, so the table doubles as a boundary smoke check.
Current snapshot: 35 tools, ~7000 schema tokens fixed per turn (cache-miss rendering — actual cost is ~120× lower once cache is warm). Top spenders: `run_command`, `submit_plan`, `glob`, `install_skill`, `create_skill`.
Closes dispatch-level E2E gaps in the tool suite — 7 registered tools had unit coverage of their `fn` but were never exercised through `ToolRegistry.dispatch()`, so the boundary itself (plan-mode gating, parallel-safe checks, error wrapping, result augmentation) wasn't tested for them.
- `shell-tools`: new dispatch tests for `run_background` / `job_output` / `stop_job` / `list_jobs` — full start → list → read → stop round-trip, plus not-found and `cwd`-escapes-workspace cases.
- `web-tools`: dispatch tests for `web_search` (mocked Mojeek fetch) and `web_fetch` (mocked HTML).
- `tools-scaffold`: switched the in-file `call()` helper from `def.fn(args)` to `reg.dispatch(name, JSON.stringify(args))` — all 16 existing `create_skill` / `add_mcp_server` tests now flow through dispatch with no per-test churn.
Net: 3388 → 3394 passing tests.
Strip constant pool, debug tables (`LineNumberTable`, `LocalVariableTable`, `StackMapTable`), and `Compiled from` header from `javap` output — large generated classes (protobuf, ANTLR) were hitting the 10MB buffer limit, and the constant pool accounted for most of the output (useless for an AI reading it). Roughly 60–80% token reduction on those classes.
Also raises `javap` `maxBuffer` from 10MB to 15MB as a safety margin, and reorders the tool description so `className + jarKeyword` is the documented default — encourages the LLM to pass a keyword instead of scanning the entire `~/.m2/repository`. The schema is unchanged; `jarKeyword` remains optional.
readConfig() previously cast JSON.parse output to ReasonixConfig with no runtime validation. Hand-edited config.json could put objects, numbers, or null into fields typed as `string[]` (mcp, mcpDisabled, recentWorkspaces, skills.paths), corrupting downstream consumers — see #1295 / #1394 where non-string mcp items reached JSX and crashed the desktop tools panel.
- New `sanitizeStringArrayField` in `src/config.ts` drops non-string items at the boundary and warns once per field with the file path + dropped count.
- Removes the now-dead downstream defenses (#1394's filter in `emitMcpSpecs`, `typeof` ternaries in `context-panel.tsx` / `settings.tsx`, `summarizeMcpSpec`'s non-string catch). `summarizeMcpSpec` no longer needs to be exported.
- Test file renamed to `config-sanitize-string-arrays.test.ts` and rewritten against `readConfig` (where the validation actually lives).
Closes#1395
Fixes#1295 — Desktop MCP tools panel crashes with React error #31 ("Objects are not valid as a React child") when `config.json` contains non-string items in the `mcp` array.
Root cause: `readConfig()` does `JSON.parse` without runtime validation, so `cfg.mcp` can contain objects even though it's typed as `string[]`. When `summarizeMcpSpec()` threw on these object inputs, its catch block returned `summary: raw` directly, leaking objects into JSX.
Fix:
- `summarizeMcpSpec` catch block — stringify non-string `raw` before returning.
- `emitMcpSpecs` — filter `cfg.mcp` to string items before mapping.
- `CtxTools` / `PageMCP` — render `summary` / `name` only when string.
- Regression test in `tests/mcp-desktop-react31.test.ts`.
Follow-up tracked separately: tighten `readConfig` with zod schema validation so this boundary check lives in one place.
* feat(code-query): tree-sitter get_symbols + find_in_code tools for TS/TSX/JS
Two grammar-aware tools for single-file code structure queries, scoped
per the #556 RFC's "narrowly-scoped one-tier pilot" constraint.
- get_symbols: outlines top-level + nested symbols (function, class,
method, interface, type, enum, namespace) with 1-based positions
- find_in_code: identifier search with role classification (call /
definition / reference), AST-filtered so comments + string literals
do not match; handles `new X()` and `obj.X()` as calls on X
Bundles tree-sitter-typescript + tree-sitter-javascript wasm from the
official npm packages (~3.4 MB in dist/grammars/). Non-TS/JS files
return an "unsupported; use search_content" hint. Within-file only —
cross-file resolution stays out of scope per the RFC.
Closes#556
* feat(code-query): extend to Python / Go / Rust / Java
Adds 4 grammars beyond the TS/TSX/JS/JSX pilot: tree-sitter-python,
tree-sitter-go, tree-sitter-rust, tree-sitter-java. Total bundled
grammar wasm now 5.5 MB.
Per-language symbol queries land function / class / method / interface /
type / enum / namespace / property kinds with consistent shape. Methods
detected via post-process when a `function_definition` / `function_item`
sits inside a class, impl, or trait container; Rust impl blocks set the
parent name from impl's `type` field so `impl Foo` and `impl Trait for
Foo` both attribute methods to Foo.
find_in_code's classifier learns each language's call shape:
- Python `call`, Java `method_invocation`, `object_creation_expression`
- Go selector_expression, Rust field_expression, Python attribute, JS
member_expression — all handled uniformly via field-name lookups so
obj.X() is a call on X across languages
---------
Co-authored-by: reasonix <[email protected]>
`/btw` with no question silently returned in desktop/src/App.tsx:1267,
matching the slash-command picker's behavior of pre-filling "/btw " —
users who hit Enter without typing a question saw nothing happen at all
(#1370).
Push a status message with the usage string when the payload is empty,
and re-fill the draft with "/btw " so the user can immediately type
the question without retyping the slash. New `push_status` reducer
action backs this and stays available for other client-side hints.
Closes#1370.
Co-authored-by: reasonix <[email protected]>
The final tier of the proxy UX work. After Tier 1/2 wired NO_PROXY,
the DeepSeek-bypass default, the CLI flag, the env override, and the
config field, users still had no way to see what actually applied —
`reasonix doctor` just printed the proxy URL.
Add a separate `proxy routing` doctor check below the `http proxy`
line that shows:
- Pattern-count summary by source: defaults, env NO_PROXY,
REASONIX_NO_PROXY, cfg.proxy.noProxy.
- Routing simulation for three probe hosts (api.deepseek.com /
github.com / api.github.com) — "direct" or "via proxy" — so a
CN user with clash sees at a glance that DeepSeek bypasses but
GitHub still routes through, and they can immediately tell whether
their NO_PROXY layering matches intent.
The proxy-routing simulator and installProxyIfConfigured both go
through a new shared `resolveNoProxy()` helper so the two paths
can't drift apart.
Co-authored-by: reasonix <[email protected]>
Tier 1 (#1373) honored NO_PROXY at the env level and baked the DeepSeek
bypass into the default whitelist. Tier 2 layers app-specific overrides
on top so users don't have to fight system-wide env vars:
- `--no-proxy` CLI flag on the top-level program, code, chat, and run
subcommands. Detected by argv peek before commander runs so it takes
effect for the same boot that argv set it.
- `REASONIX_NO_PROXY` env var — parsed with curl-style syntax, additive
on top of system `NO_PROXY`. Pattern matches GitHub CLI's
`GH_HTTPS_PROXY` shape (app override > system env).
- `cfg.proxy.disabled` / `cfg.proxy.noProxy` config fields — persistent
per-user override, loaded via new `loadProxyConfig()` reader.
Precedence: --no-proxy / cfg.proxy.disabled short-circuit the install
entirely. Otherwise default whitelist + env NO_PROXY + REASONIX_NO_PROXY
+ cfg.proxy.noProxy all merge additively.
Co-authored-by: reasonix <[email protected]>
Reasonix's proxy hookup (#646) installed undici's ProxyAgent globally
without checking NO_PROXY. CN users with HTTPS_PROXY pointed at clash /
v2ray would route api.deepseek.com through their foreign-exit pool, land
on an abused shared IP, and 403 — even though the API host is in CN and
shouldn't need a proxy at all.
Route around it: ship a SelectiveProxyDispatcher that picks the proxy or
a direct Agent per-request based on a curl-style NO_PROXY pattern list.
Default whitelist (always applied) covers api.deepseek.com / *.deepseek.com
/ localhost / 127.0.0.1 / ::1; user-set NO_PROXY entries layer on top.
Startup now logs '[proxy] using <url> (NO_PROXY: ...)' so the routing
decision is visible without /doctor.
Co-authored-by: reasonix <[email protected]>
src/tools/filesystem.ts aliased SKIP_DIR_NAMES directly to the semantic
indexer's exclude list (DEFAULT_INDEX_EXCLUDES.dirs), which contains
'.reasonix'. The indexer correctly skips that path so session logs and
caches don't get embedded — but the same alias made search_files,
search_content, directory_tree, and glob blind to user skills living
at <root>/.reasonix/skills/ and ~/.reasonix/skills/. Agents would see
the skill in /skills but report 'no skill found' when search_files
went looking for it.
Decouple the two: filter '.reasonix' out of SKIP_DIR_NAMES while
leaving DEFAULT_INDEX_EXCLUDES.dirs untouched. Indexer behavior is
unchanged; FS tools now reach into .reasonix/ on a normal walk.
Closes#1357.
Co-authored-by: reasonix <[email protected]>
Both desktop renders swap in the ¥ symbol when the wallet currency is
CNY but forget to multiply the underlying USD value by the 7.2 FX
factor:
- desktop/src/ui/statusbar.tsx — formatMoney() emitted '¥ <usd>'
- desktop/src/ui/settings.tsx:1023 — billing card emitted '¥ <usd>'
Result: a turn that costs ~$0.14 (the actual DeepSeek deduction is
~¥1.03) showed as '¥ 0.1428' — wrong by roughly the FX rate. The
TUI's tokens.ts formatCost has done this conversion correctly all
along; only the desktop forgot. The costCurrencyHint copy already
claimed the conversion happens, which is what masked the regression.
Closes#1354.
Closes#1367.
Co-authored-by: reasonix <[email protected]>
Two follow-ups to #1350:
1. Perplexity / Exa landed without unit tests, while tavily has 5
covering missing-key / 401 / 429 / parse-error / body shape. Mirror
that pattern so a fetch-shape change in either backend can't regress
silently. Also add a formatSearchResults case for the new "answer +
sources" dual-section branch.
2. Drop the `// ── Perplexity ──` / `// ── Exa ──` / `// ── API-key
engines ──` section-banner separators — CLAUDE.md bans them; group
by export instead.
Co-authored-by: reasonix <[email protected]>
* chore(java): strip section-banner comments and module-header essays
#1344 followed conventions from a different codebase — `// ── types ──`
banner separators, multi-line module-header essays, and JSDoc-style
`@param`/`@returns` text restating type signatures. CLAUDE.md bans all
three. Trim to plain code with comments only on hidden constraints or
non-obvious invariants.
No behavior change; all 41 java-source tests still pass.
* test(java-source): isolate project-search tests from real ~/.m2 cache
Three searchProject tests ("returns not-found", "skips common non-source
directories", "handles empty project root gracefully") were walking the
real ~/.m2 / ~/.gradle defaults — fine on a fresh CI runner, flaky on a
dev machine with a populated cache under full-suite I/O contention.
- Pass repoPaths: [] so the not-found path skips the jar scan entirely.
- Bump per-test timeout to 30s as a defensive cap; the searches now run
in ms, but Windows AV scanning of fresh tmp dirs can still spike.
---------
Co-authored-by: reasonix <[email protected]>
#1331 added augmentProcessPath() in desktopCommand so the Tauri-spawned
Node could see nvm/asdf/fnm/volta/mise PATH entries — the GUI process
never runs the user's shell init. #1334 was branched before #1331 landed
and the rebase dropped the import + call without it being part of the
QQ-runtime work.
Re-add the import and the call site, no behavior change beyond restoring
the previous fix.
Co-authored-by: reasonix <[email protected]>
0.47.1 published with @reasonix/core-utils as a runtime dependency
pinned to workspace:*. Because the workspace package is private:true,
npm publish did not rewrite the protocol literal, breaking install with
EUNSUPPORTEDPROTOCOL on consumer machines.
The bundled dist/ already inlines core-utils at build time — it is not
needed at runtime. Move it under devDependencies.
#1043 (in 0.46.0) flipped read_file from "head+tail+outline preview"
to "full content for files ≤ 512 KiB" on the theory that the prompt
cache amortizes the cost. Multiple users have reported significantly
higher token consumption since — and they are right: cache hits cost
~10% of input price, so a 10× bigger tool result still pays 10× more
on the hit path, plus full miss price on first read.
Drop the default to 64 KiB, which covers ~99% of source files in
real-world repos while pushing generated bundles, lockfiles, novels,
and other genuinely large files into outline mode (head + symbol map
+ drill-in hints). Users who really want the old behavior can set
`filesystem.outlineThresholdBytes: 524288` in config.
config.ts gets a new `filesystem.outlineThresholdBytes` field plus a
`loadFilesystemOutlineThresholdBytes` loader that returns undefined
on unset / non-positive / non-numeric values, letting the registered
default win. setup.ts wires the loader into registerFilesystemTools.
Expected savings: 5-15k tokens per typical session, depending on how
many >64 KiB files the user touches. read_file's own description was
already updated to reflect "FULL CONTENT for files ≤ N KiB" via the
existing interpolation, so the tool description shifts to "≤ 64 KiB"
automatically.
Co-authored-by: reasonix <[email protected]>
The system prompt was 24,387 bytes (≈ 6,100 tokens) — much of it
overlapping with the tool descriptions sitting right next to it in
the cache prefix. Sections like "When to propose a plan", "When to
ask the user to pick", and "When to track multi-step intent" each
recited rules that the tool's own description already carried.
Aggressive dedup pass:
- Drop the redundant "you have these filesystem tools" opening
sentence — the API ships the tool list separately.
- Merge the three independent submit_plan / ask_choice / todo_write
sections into one short "Picking the right tool" block.
- Fold "Exploration", "Trust what you already know", and "When the
user wants to switch project" into shorter equivalents — same
rules, no narrative.
- Collapse the foreground/background section. The full how-to lives
in the run_command / run_background tool descriptions; the prompt
only needs the picking rule.
- Compress the audit-mode rails (#610) prose around the six rails
themselves. Every rail's load-bearing phrase is preserved verbatim
so tests/code-prompt.test.ts still asserts on them.
Result: 24,387 → 11,956 bytes (-51%, ≈ 3,100 tokens per request).
Combined with PR #1320 / #1321 the cache-prefix tax per request is
now ~16k tokens instead of ~36k.
Behaviour unchanged — every rail / gate / mode constraint is still
asserted by the existing prompt tests.
Co-authored-by: reasonix <[email protected]>
Every byte of a tool's description and JSON-schema parameter blob ships
in every request. The spec list had grown to 39,377 bytes (≈ 10k tokens)
across 35 tools — much of it teaching guidance that was already covered
in the system prompt, plus verbose schema property descriptions that
restated what the parameter name already conveys.
Compress the heaviest twelve tools while preserving the actually
load-bearing rules (don't-use-for-A/B/C-menus on submit_plan, plan-mode
gate behavior on run_command, prefix-stable warning on remember):
submit_plan 3517 → 1648 (-53%)
revise_plan 2554 → 1482 (-42%)
create_skill 2379 → 1367 (-43%)
install_skill 2293 → 1510 (-34%)
search_content 2167 → 1263 (-42%)
mark_step_complete 1988 → 1037 (-48%)
add_mcp_server 1898 → 1213 (-36%)
run_command 1862 → 1376 (-26%)
todo_write 1675 → 872 (-48%)
ask_choice 1807 → 1313 (-27%)
remember 1812 → 1306 (-28%)
run_background 1611 → 1186 (-26%)
Total: 39,377 → 28,412 bytes (-28%, ≈ 2,740 tokens per request).
Behaviour unchanged — guidance that lived only in tool descriptions
(plan-mode interaction, ChoiceRequestedError stop semantics, prefix
re-load timing) is preserved verbatim. The system prompt and tool
error messages already carry the longer-form teaching content.
scripts/measure-tool-sizes.mts added so future audits don't have to
re-derive per-tool byte counts by hand.
Co-authored-by: reasonix <[email protected]>
Every byte of the system prompt and tool spec list ships in every
request — paid at full miss price the first time and ~10% on every
subsequent cache hit. Recent PRs have grown both without anyone
tracking the cumulative cost.
Lock the current values:
- CODE_SYSTEM_PROMPT.length ≤ 24_500 bytes
- code-mode tool spec list ≤ 40_000 bytes
- no single tool description > 8 KiB
A failing assertion forces the PR author to either compress an
equivalent section or raise the budget explicitly with a
justification in the commit message — visible in code review.
Co-authored-by: reasonix <[email protected]>
Restores the `devtools` Cargo feature dropped in #1188 and removes the
contextmenu suppression. The original lockdown treated end users as
needing protection from the inspector; for an open-source dev tool
that argument inverts. Users can right-click → Inspect or use the
standard Cmd+Option+I / F12 shortcut to get a real console for bug
reports — which we lost any cheap path to after #1188 + #1297-class
issues started landing without reproducer info.
Reverts #1187 / #1188.
`/search-engine tavily` silently fell back to Mojeek and got 403s,
two bugs stacked:
1. `webSearchEngine()` only branched on `searxng` / `metaso`; `tavily`
slipped to the `mojeek` default. Add the missing arm.
2. `registerWebTools` cached the engine + endpoint at registration
time via opts, so a runtime `/search-engine` switch never reached
the tool fn. Drop both opts; read fresh inside the dispatch.
Closes#1309
`powershell.exe` runs under conhost, which repaints each Ink frame
visibly — at 8Hz spinner + 20Hz streaming flush, a maximized window
shows continuous flicker and content "jumping" during model reasoning.
Windows Terminal double-buffers, so this is conhost-specific.
Detect legacy conhost (win32 && !WT_SESSION && !TERM_PROGRAM) and
drop FAST_TICK_MS 120→250 and the default FLUSH_INTERVAL_MS 50→150
on that path. Modern terminals see no change. Reasoning streaming
goes from ~28Hz total repaints to ~11Hz on conhost.
Closes#1300
About-modal's "Check for updates" was a raw WebView `fetch()` to `api.github.com`, which the Tauri CSP (`connect-src 'self' ipc: http://ipc.localhost`) blocks before the request leaves the browser. Switch to `check()` from `@tauri-apps/plugin-updater` — same R2 endpoint as the background auto-check, IPC → Rust, not bound by CSP. Drops the bespoke `cmpSemver` and the orphaned `checkNoRelease` i18n key.
Switch heap re-exec to resolve the child entrypoint from `import.meta.url` instead of `process.argv.slice(1)`, preserve the parent's `execArgv` (so `--inspect` survives the relaunch), and treat Vitest workers as already-reexec'd so tests don't get process-replaced.
Adds optional `targets`/`acceptance`/`verification` to plan steps, structured `evidence` on `mark_step_complete`, and a v2 plan-store schema with v1 read fall-through. Final-step checkpoint UX flips to a finish/summarize label. Exposes `requireStepEvidence` and `onPlanStepCompleted` as host hooks; no caller wired here.
Adds `ToolRegistry.addToolInterceptor(id, fn)` for ordered host-side interceptors; legacy single `setToolInterceptor` keeps working and runs after the chain. Intercepted short-circuit results now flow through the existing result augmenter, matching the normal tool-result path.
Thanks @dimasd-angga — surfacing the per-call gate in three first-run spots is exactly the right scope, and the tests pin it down well. CI tripped on a one-line biome wrap in zh-CN.ts; fixing that on main in a follow-up.
R2 path and GitHub release-asset URL were still built as `v${version}`,
but desktop bundles now live under `desktop-v${version}` after the
release-namespace split (#1153). Every Download-page link 404'd.
The docs site hardcoded `window.REASONIX_VERSION = "0.45.1"` in
i18n.jsx. Every release that didn't remember to bump that line left
the install commands, mirror grid, footer badge, terminal demo and
hero badge stuck at a stale value — and the bump was easy to forget
because no test catches it. By the time CLI was at 0.46.1 the docs
still read 0.45.1.
Read it dynamically from R2's `latest/latest.json` (which the release
mirror already keeps up to date, and which is desktop-release-owned
since the latest.json artifact only comes from desktop bundles). The
fetch kicks off as i18n.jsx loads, sets `window.REASONIX_VERSION` and
`window.REASONIX_VERSION_STATUS`, dispatches a `reasonix:version`
event when it settles.
`useVersion()` (a new hook in i18n.jsx) subscribes to that event and
returns `{ version, status: "loading" | "ok" | "failed" }`. Each
consumer renders a localised "正在获取…" / "fetching…" string while
status === "loading"; the mirror grid swaps its whole panel for a
"fetching latest version…" line because its URLs aren't usable yet.
On hard failure (5s timeout or non-2xx) we say so explicitly rather
than fall through to a stale literal — the previous behaviour was
already a stale literal, so "fetch failed" is a strict improvement.
No hardcoded fallback in i18n.jsx anymore; the value either comes
from R2 or doesn't come at all. The synchronous version.js shim I
prototyped first turned out worse than this — it would have meant a
console 404 on every page load until the next desktop release, and
no loading state for the in-between window.
Co-authored-by: reasonix <[email protected]>
Squash-merge of #1274 inadvertently included `效果图.png`, the preview
image the contributor attached to the PR. GitHub renders PR-body
attachments without needing them tracked; in-repo binaries just bloat
git history and rot fast.
Co-authored-by: reasonix <[email protected]>
PromptInput:
- Add backgroundColor={SURFACE.bgInput} to the round-bordered input
box, giving it a subtle dark fill that visually separates it from
the chat area above.
UserCard:
- Replace the generic Card wrapper with a custom layout:
- Left stripe: 1-column Box with backgroundColor={CARD.user.color}
(brand blue), matching the input border color.
- Card body: flexDirection="column" Box with
backgroundColor={SURFACE.bgElev} (elevated surface) and
paddingLeft={1}, creating a dark background panel.
- This gives user messages the same "blue stripe on dark panel"
visual identity as the input box.
Performance: backgroundColor does not affect Yoga layout. One extra
1-wide Box per user card adds ~1 Yoga node per message — negligible.
Before: the banner flipped to "Installing…" the moment the user clicked
Install and stayed there until the app relaunched. On a 30+ MB install
over a slow link that looked like a hang and the user had no signal
about what was happening.
Wire `pendingUpdate.downloadAndInstall((evt) => …)` to the Tauri
updater's per-chunk event stream:
- Started — capture `contentLength` if the server sent Content-Length
- Progress — accumulate `chunkLength` into a running byte counter
- Finished — pin progress to total so we don't undershoot at the end
`UpdateBanner` now renders "Downloading · 4.2 MB / 31.7 MB (13%)" plus
the existing `.meter-mini` progress bar (already styled in styles.css,
just unused). When the server doesn't advertise a content length we
fall back to "Downloading · 4.2 MB" with no bar — better honesty than
a fake ratio.
The Later button disables during install so the user can't accidentally
dismiss a half-completed download. Failure state still shows the same
"Installation failed" line as before.
i18n strings (`downloading`, `downloadingUnknown`) added in en + zh-CN.
Co-authored-by: reasonix <[email protected]>
`tauri.conf.json` was pointing the updater at
`github.com/.../releases/latest/download/latest.json`. GitHub's "latest"
is a single global pointer — every CLI patch release moves it, leaving
the desktop updater chasing a 404 (or worse, the wrong artifact set).
With desktop and CLI on independent release cadences this would only
get more painful as CLI ships more often.
Two coordinated changes:
1. `tauri.conf.json` — list the R2 manifest first
(`https://pub-147fb53b9c1e4bbf891a257968619ea7.r2.dev/latest/latest.json`)
and keep the GitHub URL as a fallback. R2 is owned by the desktop
release pipeline, so it only changes when the desktop ships; CLI
releases don't touch the `latest/latest.json` object.
2. `release-mirror.yml` — rewrite the platform `.url` fields inside
`latest.json` to `<R2_BASE>/<TAG>/<file>` before uploading to R2.
Without this the updater would fetch the small JSON from R2 but
still pull the heavy installer from github.com, defeating the
mirror. minisign signatures are bit-identical content checksums,
so swapping the URL doesn't invalidate them. Skips gracefully when
`latest.json` isn't in the release (CLI-only tags).
Public R2 base URL matches the one already hardcoded in
`docs/src/mirrors.jsx`, so the download page and the in-app updater
agree on where bundles live.
Co-authored-by: reasonix <[email protected]>
`u` used to fire whenever any non-undone edit batch sat in history, not
just while the auto-apply banner was visible. That meant a stray `u`
tap minutes (or hours) after a batch landed quietly rolled back files
the user had already moved on from. Issue #1249.
Drop the `|| hasUndoable()` half of the gate; only `undoBanner` keeps
the keybind live. Older batches now go through `/undo` (already wired,
takes an optional index), so nothing is taken away — just the
zero-friction destructive path.
The existing i18n copy already says "within the 5s banner" / "press u
within 5s", so no string changes are needed; the keybind now matches
what the UI was already telling users.
Co-authored-by: reasonix <[email protected]>
Ink writes a full ANSI frame each render; the terminal's system cursor
ends up at the bottom of that output. IMEs query the system cursor for
candidate-window placement, so fcitx5 / ibus / Microsoft Pinyin draw
their popup at screen bottom instead of next to the visual ▌. Closes
#1261.
PromptInput now emits an absolute CUP escape (`\x1b[<row>;<col>H`)
inside a render-effect, landing the system cursor on the same cell as
the visual block:
- absolute row = stdout.rows − (linesBelow + largeHint + 3 + rowsAfter),
where the constant 3 covers the blank marginTop, HintRow, and bottom
border of the prompt box; rowsAfter is parent-supplied.
- absolute col = paddingX(1) + prefix(2) + cell width of the typed
prefix on the cursor line, computed via stringCells so CJK and
paste-sentinel widths land correctly.
ComposerArea passes rowsAfter that accounts for LoopStatusRow,
ModeStatusBar, and StatusRow rendered below the prompt box.
Cross-platform: no `process.platform` guard. The earlier Windows-only
attempt (closed PRs #1222 / #1225 / #1232) used relative CUU+CUF
without `\r`, which drifted on CJK columns and skipped Linux entirely.
Co-authored-by: reasonix <[email protected]>
Two more claude-code-parity bindings:
ctrl+r — verbose mode
- New VerboseContext provided at App.tsx, toggled by global ctrl+r
keystroke. Persists across turn boundaries; resets on restart.
- ReasoningCard skips head/tail elision while verbose, rendering the
full body via the existing BodyLines slice.
- ToolCard drops the per-tool tail cap while verbose; full stdout
flows through instead of the last 2-5 lines.
- Status info row toasts the new state on every toggle.
esc esc — rewind to a previous user turn
- New loop.rewindToUserTurn(N) — mirrors retryLastUser but takes a
0-based user-turn ordinal so the picker can target any earlier
turn, not just the last one. Reuses rewriteSession for disk
persistence; in-memory log compacts even if the disk write fails.
- New session.fork reducer event splices state.cards at a given
cardId; everything from that card onward is dropped.
- New EditPicker overlay component lists user cards with previews;
↑↓ to focus, Enter to pick, Esc to cancel.
- App.tsx tracks the previous Esc timestamp; a second Esc inside
500 ms with an empty composer + no other modal collects the user
turns and opens the picker. On selection, the loop rewinds, the
cards splice, and the composer pre-fills with the original text.
/keys reference + i18n strings updated in EN + zh-CN.
Co-authored-by: reasonix <[email protected]>
Spell out that .claude/skills/<name>/SKILL.md loads alongside .reasonix/skills/
(landed in #1259) and show the OpenSpec recipe — `openspec init --tools claude`
drops openspec-* skills that invoke through /skill openspec-propose, no upstream
adapter needed. Closes#1184.
Co-authored-by: reasonix <[email protected]>
When the chat has no messages and the terminal window is resized
taller, CardStream's flexGrow=1 inner Box expands to fill all
available vertical space above the composer. Since the stream has
no cards to render, this creates a large blank gap that pushes the
WelcomeBanner just above the input — making the UI feel top-heavy
and uncentered on tall terminals.
Fix: wrap the WelcomeBanner in a flexGrow=1 Box with
justifyContent="center". This Box competes with CardStream for
the remaining space in the parent flex column. When CardStream is
empty (0 intrinsic height), the two flexGrow children split the
available space equally — so the WelcomeBanner renders near the
vertical center instead of flush against the composer.
This has no effect when the chat has messages — the WelcomeBanner
is not rendered (hasConversation is true), and CardStream retains
its full flexGrow for scrolling as before.
Refs #743
* feat(tui): surface /copy in the scroll hint + full-row background on history hints
Two complementary discoverability nudges for the existing copy-mode
entry point and the "scrolled up" state:
- CardStream's ScrollIndicator now appends `· /copy to select` after the
PgUp/wheel/↑ keys, so anyone who notices the scroll affordance sees
the copy entry next to it without digging through /help.
- Both `<ScrollIndicator>` and the two history-hint paths
(InputAreaWithHistoryHint + ComposerArea.HistoryHint) pad to the full
terminal width with `SURFACE.bgElev` background, so the row reads as a
status band instead of a stray faint line. `string-width` handles the
CJK + arrow glyphs in the localized text correctly.
New i18n key `cardStream.scrollCopy` (EN / zh-CN / types).
* feat(tui): align composer keys + visuals with claude code
- ↑/↓ now navigate prompt history (single-line) or move the per-line
cursor (multi-line). Ctrl+P / Ctrl+N kept as readline aliases.
Chat scroll is owned by PgUp/PgDn + mouse wheel + End; arrows only
scroll when the composer is hidden (chat scrolled up).
- Drop the duplicate ↑/↓ branches from the App-level picker handler
— picker selection now flows through PromptInput → historyHandoff
→ handleHistoryPrev/Next which already checks pickers first.
- Composer border: top + bottom rule only (no left/right verticals),
muted FG.meta color when active.
- StatusRow: each segment wraps in a Pill with bgElev background +
1-space padding, separated by a 1-cell gap. Dot separators removed.
- UserCard body now carries a subtle bgElev background so the user
can spot their own messages while scrolling.
- HintRow shows ↑↓ instead of ^P/^N for prompt history.
- /keys + tipMouseClipboard + scrollPgUp + scrollCopy strings updated
in EN + zh-CN. /copy reads "enters copy mode" / "进入复制模式" to
avoid the "did that just copy?" misread.
---------
Co-authored-by: reasonix <[email protected]>
#514 dropped mouse tracking because it broke native drag-select copy
and right-click. The trade was made on the assumption that every terminal
in alt-screen translates wheel→arrow for free. In practice (Windows
Terminal + PowerShell at least) that translation doesn't always fire, so
the wheel just scrolls the parent terminal's scrollback while the TUI
sees nothing. Users have been complaining about exactly this.
Re-enables `\x1b[?1000h\x1b[?1006h` at chat-command startup; the existing
SGR parser in stdin-reader.ts already maps `mouseScrollUp/Down` to
chat scroll. Disable escape fires on the `finally` cleanup, plus
`process.once("exit"|"SIGINT"|"SIGTERM")` so the sequence can't leak into
the parent shell on a hard kill.
Trade-off acknowledged: native drag-select stops working with mouse
tracking on. Shift+drag still selects in most terminals (Windows Terminal,
iTerm2, GNOME Terminal all honor the shift bypass). For users who'd
rather have native select than wheel, `mouseTracking: false` in
~/.reasonix/config.json opts out.
Co-authored-by: reasonix <[email protected]>
* feat(search): add Tavily as web_search backend — escape hatch for Mojeek 403s
Users hit "frequent 403s" with the default Mojeek backend; it's HTML scraping
with no official API and gets anti-bot'd routinely. Tavily is the LLM-agent
ecosystem's de facto answer: real JSON API, 1000 searches/month free per
account, returns LLM-ready snippets out of the box.
- `webSearchEngine` accepts `"tavily"` alongside mojeek/searxng/metaso.
- New `tavilyApiKey?: string` in config + `loadTavilyApiKey()` (env > config >
undefined). No baked-in default — the free quota wouldn't survive being
shared across the user base; missing key throws a setup-pointing error.
- `searchTavily` POSTs to api.tavily.com/search and maps 401/403/429 to
actionable hints.
- `/search-engine tavily` slash entry + EN/zh-CN strings.
- 5 new test cases — missing-key error, body wire shape, 401/403, 429,
empty-results.
Default is still Mojeek; switching is one slash command. Users who get
fed up with 403s now have a free, no-scraping path that doesn't require
self-hosting (SearXNG) or a Chinese phone number (Metaso).
* test(web): use plain-string assertion for tavily.com signup URL message
CodeQL's `js/regex/missing-regexp-anchor` rule flags `/tavily\.com/` as a
URL check that could match `evil-tavily.com.attacker.org` — it can't tell
the regex is matching inside an error-message string, not a URL field.
Switching to `.toThrow("tavily.com")` preserves the substring-match
intent (does the error mention the signup URL?) without the regex.
---------
Co-authored-by: reasonix <[email protected]>
Stage 1 of the Claude-compat layer — the cheapest 80% of "users can't copy
their Claude config / skills folder over" complaints. No behaviour change for
existing Reasonix users; new paths and aliases are additive.
MCP:
- `McpServerConfig` accepts `type` as an alias for `transport`; `"http"` maps
to `"streamable-http"` so Claude's shorter spelling Just Works.
- New `src/mcp/dot-mcp-json.ts` reads project-level `.mcp.json` from cwd; its
`mcpServers` block merges into the resolved config with project entries
winning on name collision (same precedence Claude uses for shared,
git-committed team configs).
Skills:
- `~/.claude/skills/` and `<project>/.claude/skills/` join the existing
Reasonix + .agents search roots, so a user can drop a Claude skill folder
in and it loads.
- Frontmatter aliases: `context: fork` and any non-empty `agent:` both flip
runAs to `subagent` — same semantics, different field names.
- Missing `description:` now warns to console instead of silently dropping
the skill from the prefix index (the most common "why doesn't my skill
show up" footgun).
Co-authored-by: reasonix <[email protected]>
When navigating / and @ popups with arrow keys, the active item can
fall outside the visible area because the popup-list has overflow-y:
auto but no programmatic scroll. This makes keyboard navigation
difficult when the item count exceeds the container height.
V8 finishes any non-catastrophic regex on the 2 MiB per-file cap in seconds
even on slow hardware; the previous 5 s default risked false-positives on
WSL / low-end laptops while only marginally improving the catastrophic
case (ESC tears the worker down immediately anyway). 60 s gives generous
headroom for legitimate slow patterns; ReDoS still gets caught — just after
a longer unattended wait.
Walk deadline must stay above the per-file timeout so one timed-out file
doesn't always trip the walk guard immediately after; 120 s leaves room for
a second slow file plus the rest of the walk.
Co-authored-by: reasonix <[email protected]>
Relaunching only kept the set of open tab workspaces (#933); window
geometry, the focused tab, each tab's conversation and scroll position
were all lost.
- Window — replace the hand-rolled useWindowBounds hook (debounced
save, no flush on close, unreliable window.screenX/innerWidth) with
tauri-plugin-window-state, which persists size/position/maximized
and restores them cross-platform.
- Per-tab session — desktopOpenTabs persists { dir, session, active }
instead of a bare dir; bootstrapTab reopens the conversation when
its jsonl is still readable.
- Active tab — the frontend reports focus via a tab_activate message;
$tab_opened carries an `active` flag so restore reopens on the
previously focused tab, not the last one created.
- Scroll — the transcript offset is saved per session and restored on
boot via useAutoScroll, which stays un-pinned so growth doesn't yank
it back to the bottom.
- Sidebar and context panel collapse state persist to localStorage.
Closes#1244
V8's regex engine is uninterruptible and exponential for catastrophic
patterns (`(a+)+!`, `(.+)*x`); the walk-level 15 s deadline can't help if a
single re.test wedges inside one file. Moves the per-line regex match into a
worker thread and arms a 5 s timeout per file: a wedged worker is killed via
worker.terminate(), the file is recorded as `regex timed out` in the result
footer, and the walk continues with a freshly spawned worker.
- new src/tools/fs/regex-runner.ts: singleton Worker manager with eval-mode
source so nothing has to resolve a path at runtime, AbortSignal-aware so
ESC tears the worker down immediately, and a respawn-on-timeout policy
that keeps the singleton useful across the rest of the session.
- search.ts: regex path now delegates to the runner; substring fallback
(invalid regex) stays inline. Regex-timed-out files are summarised in a
single footer line.
Zero new deps — uses Node's built-in node:worker_threads. Cold-start cost is
amortised across calls in the same TUI session.
Closes the catastrophic-regex limitation called out in #1246 / #1236.
Co-authored-by: reasonix <[email protected]>
The truncation test asserted out.length < CODE_SYSTEM_PROMPT.length +
5000. The builtin Skills index injected by applyMemoryStack has since
grown past that 5000-char slack, so the test fails even though
truncation still works.
Compare against a prompt built with a tiny .gitignore instead, which
isolates the truncation delta from fixed-size, unrelated prompt
additions — the bound no longer goes stale as the prompt grows.
- Implement regex-based slash command detection in `TabRuntime` to trigger skills
- Add `insertOnly` property to `SlashCmd` to support command insertion without immediate execution
- Update `Composer` to handle conditional execution based on `insertOnly` flag
- Include `state.skills` in `TabRuntime` dependency array for correct command matching
Pass resolved preset metadata through chat/code startup so flash remains pinned without auto escalation and the UI initializes with the correct preset label.
* fix(tools): bound search_content runtime and let ESC preempt queued tools
Three small hardening steps for the "ESC sometimes can't interrupt" complaint:
1. search_content now feeds at most 8 KiB of each line to the matcher.
A minified-JS one-liner can be MBs on a single line; both the lowercase
pass and the regex hot loop chewed through the whole thing per file, and
`throwIfAborted` only ran *between* lines so ESC was useless. Truncating
the matcher input doesn't change real-world matches (displayed slice is
already capped at 200 chars).
2. search_content honours a 15-second soft deadline across the whole walk,
checked at every directory entry. A pathological regex that wedges inside
`re.test` is still uninterruptible (V8 doesn't yield), but any sane walk
that's just slow now fails loudly instead of pinning the turn forever.
3. tools.ts central dispatch refuses to start a tool whose signal is already
aborted, returning a uniform `{ rejectedReason: "aborted" }` error. ESC
during a queued sequence (e.g. five read_file calls in flight) now stops
calls 2-5 from running to completion after the user gave up — each tool
needn't re-implement the entry-time check.
Closes#1236 — wait, #1236 is already closed; this is the follow-up the
maintainer's audit identified.
* fix(search): drop per-line truncation — accuracy regression for narrow benefit
The 8 KiB LINE_MATCH_BUDGET was the wrong axis: catastrophic regex
backtracking is exponential, so 8 KiB still hangs V8's regex engine; meanwhile
legitimate long-line files (single-line JSON dumps, source maps, generated
data) silently lost matches past the first 8 KiB. Reverts the truncation;
the 2 MiB per-file cap (pre-existing) is the real upper bound on matcher
input, and the 15 s walk deadline catches slow-but-not-infinite searches.
Catastrophic regex (`(a+)+!` shape) remains uninterruptible inside re.test —
that's a separate problem that needs a worker-thread or RE2 swap, not input
truncation.
---------
Co-authored-by: reasonix <[email protected]>
The ESC handler in App.tsx was gated on `submittingRef.current || isLoopActive()`
— neither is true during the deferred MCP bridge that runs in a mount-time
useEffect, so a server stuck in `initialize()` would pin boot for the full 60s
per-request timeout with no escape. Ctrl+C still killed the whole process, but
ESC silently swallowed.
Threads an AbortSignal from App.tsx → mcpRuntime.addSpec → McpClient.initialize
→ request, then adds an ESC condition that fires before the turn/loop branch:
when no turn is active and there are pending MCP aborters, abort them all and
log a hint pointing at /mcp for retry. The underlying client is closed in the
existing catch branch in addSpec, so the stdio child is killed cleanly.
Closes#1236
Co-authored-by: reasonix <[email protected]>
Adds remark-math + rehype-katex + katex so `$E = mc^2$` and `$$ ... $$`
blocks typeset as real equations instead of leaking raw markup. Inline
math comes from `$...$`, display math from `$$...$$`; math inside fenced
code blocks stays as code because the `pre > code` override runs first.
throwOnError: false on rehype-katex so a half-typed `$` in a mid-stream
chunk degrades to plain source instead of throwing — important because
the streaming pipeline can split tokens anywhere.
KaTeX CSS is imported once in main.tsx; Vite picks up the woff2/woff/ttf
font URLs and emits them as bundled assets, so first render is offline-
safe (no CDN fetch at runtime) — that matters for a Tauri app.
Closes#1235
Co-authored-by: reasonix <[email protected]>
The macos-universal release shard runs on an ARM64 runner, so bundle-node.mjs
was downloading darwin-arm64 Node and shipping it inside a binary advertised
as universal. Intel Macs couldn't exec the sidecar, Tauri's child spawn failed
silently, and the WebView came up blank.
Bundle script now downloads both arm64 and x64 Node distributions on darwin
and lipo's them into one universal Mach-O. CI verifies the result with
`lipo -archs` before tauri-action runs, and asserts `desktop/dist/index.html`
exists so a silent frontend build failure can't ship an empty bundle either.
Co-authored-by: reasonix <[email protected]>
International donors can send via PayPal (paypal.me/yuhuahui); domestic users
scan the WeChat Pay QR. README copy frames it as "coffee, not contract" —
donations don't buy feature priority or change issue triage, which keeps the
project's cheap-and-narrow positioning intact.
Co-authored-by: reasonix <[email protected]>
Brings the desktop's slash-command list to parity with four CLI
commands that were already in src/cli/ui/slash/commands.ts but not
plumbed through to the desktop sidecar.
Backend (src/cli/commands/desktop.ts) — three new RPC handlers
wiring to existing loop methods:
- compact_history → loop.compactHistory()
- retry → loop.retryLastUser(), emits $retry_result
- btw → side-channel loop.client.chat() with a fresh
{system, user} payload (NOT the running log),
emits $btw_result
Frontend (desktop/src/App.tsx):
- /feedback opens the GitHub new-issue URL in the system browser
- /compact, /retry fire their RPC and rely on the existing $error
event for failures
- /btw sets draft to "/btw " and the send() handler intercepts the
prefix and routes to the btw RPC. The answer appends as a status
message (UI-only, never persisted) — matches "side question, never
in context" semantics.
- $retry_result drives a retryNonce counter so the useEffect that
fills the composer fires exactly once per retry.
Refs #1220 (desktop ↔ CLI parity tracking).
The header "Export" button only copied the conversation to the
clipboard — the label promised something different than the action
delivered. Split it into two:
- Copy → full conversation Markdown to clipboard (same content
as before).
- Export → native save dialog, writes a UTF-8 .md file via a new
write_text_file Tauri command. Gated by the existing capability
system; the path comes from the OS save dialog, so it's
user-chosen.
Factor the shared Markdown rendering into formatConversationMarkdown
to drop duplication between the titlebar menu, the main-head buttons,
the command palette, and the slash-action surface.
en + zh-CN i18n updated consistently; new dialog:allow-save Tauri
capability + a copy icon added.
The desktop already persists theme / font scale / font family /
currency via localStorage, but the window itself reset to the
default 1024×720 centered bounds on every launch.
New useWindowBounds hook follows the existing useAutoScroll /
useDisableTextAssist extraction pattern: restores
reasonix.windowBounds on mount, debounces 300 ms saves on
tauri://resize + tauri://move, skips saving while maximized (that
state belongs to the OS), and gates restore on a 400×300 minimum
so corrupted data can't reopen the window in an unusable size.
App.tsx calls the hook once alongside the other persistence hooks.
decorations: false in tauri.conf.json means the WebView viewport
equals the outer window, so innerWidth/innerHeight round-trip
cleanly through setSize without frame-chrome drift.
Closes#1206
The serif font stack in theme.ts had `"Geist"` as its first entry,
but Geist is a geometric sans-serif (same one the Sans option uses).
Latin glyphs matched Geist immediately and never fell through to
Georgia — selecting Serif in Settings looked identical to Sans on
English text. CJK text changed only because neither Geist nor
Georgia covers CJK and the OS picks something up the chain.
Drop Geist from the serif stack; Georgia + Times New Roman are
built-in on macOS / Windows and widely available on Linux.
Closes#1212
The dashboard /sessions panel could only browse — to actually create,
swap, or delete a session you had to bounce to the CLI. Users got
stuck wondering why nothing was clickable.
Wire the existing onSwitchSession path through to the dashboard
context, then expose:
- POST /api/sessions/new → mint fresh
- POST /api/sessions/<name>/switch → swap into existing
- DELETE /api/sessions/<name> → unlink (409 on the active
session, 404 if missing)
GET response gains currentSession + canSwitch so the SPA degrades
gracefully in standalone mode. Panel: + New button, per-row switch
+ delete (disabled on the active row), active-session pill, falls
back to the "resume in TUI" hint when no CLI is attached.
9 new tests cover both attached + standalone paths.
Closes#1216
Two desktop UX fixes:
Per-message copy. The Ctrl+K palette only offered "copy last reply" or
"export everything"; there was no way to grab a single turn in the
middle of a long thread. UserMsg and AssistantMsg each gain a small
copy button at the bottom-right of the body. UserMsg copies raw text;
AssistantMsg concatenates `.kind === "text"` segments only (reasoning
and tool calls excluded). 1.2s "copied" indicator reuses the existing
.copy-btn pattern.
Relabel "Clear messages" → "Clear screen" (清屏). The clear action
only zeroes the local UI — session data persists on disk and reloads
from the sidebar. The "Clear messages" label implied permanent
deletion; "Clear screen" matches what the action actually does. The
hint (clearChatHint) already correctly stated "Clear the UI only —
subprocess stays alive".
Shorten preset pill labels (`deepseek-v4-flash` / `deepseek-v4-pro`
→ `v4-flash` / `v4-pro`) so they fit the composer bottom row without
truncation.
When a skill ships without a description, fall back to a localized
`{scope} skill · {runAs}` string instead of the previous hardcoded
`skill · ${s.scope}`. Both en + zh-CN get scope + runAs entries.
Add `text-overflow: ellipsis` to `.popup-item .desc` so an overly
long skill description can't dominate the slash picker.
Tauri's WKWebView on macOS 12 (Monterey) ships with WebKit older than
16.4 — no lookbehind support. Hitting (?<=...) falls into the
named-capture-group parser, sees `=` as the first character of the
name, and throws "invalid group specifier name" at script parse time
before any JS runs. User sees a black window.
Two lookbehinds were shipping:
- FILE_PATH_RE in Markdown.tsx — rewritten as a leading capture group;
splitFilePaths advances past the captured prefix to keep FilePill
boundaries unchanged.
- mdast-util-gfm-autolink-literal's email regex — the package's
previous() callback already validates the preceding character after
the match, so the lookbehind was just a fast-fail. Stripped at
build time via a small Vite transform plugin scoped to that
module's id.
Verified: zero (?< occurrences in the rebuilt bundle.
Closes#1209
The original #1179 report ("click a session, nothing happens, terminal
shows no logs") had a quieter cause than the slow-list path #1207
addressed. If loadSessionMessages returns [] (file 0 bytes,
all-malformed lines, etc.), the sidecar emits $session_loaded with
messages:[] and the renderer re-renders an empty chat — click looks
dead, stderr stays silent because nothing failed.
Three changes:
- session_load now stderr-logs empty/failed loads AND emits a new
$session_empty event with the byte count
- App.tsx renders $session_empty as a visible inline error message
in the chat ("Session 'X' loaded with no messages (N bytes)…"),
with restore-from-.bak guidance
- the rpc-dispatch unknown-tab path stops silently dropping events
(the previous emit had no tabId, so the renderer's per-tab router
ignored it) — switched to stderr.write so it's observable
Closes#1179 (follow-up to #1207)
The desktop sidebar's session list was reading every .jsonl in
~/.reasonix/sessions/ in full just to count lines, then filtering by
workspace — multi-second stalls on every list refresh once any
session got large.
Two changes:
- listSessions takes an optional workspaceFilter and reads meta.json
before statSync + countLines. Sessions outside the current
workspace skip the (potentially multi-MB) jsonl read entirely.
- countLines drops the UTF-8 decode + regex split + filter chain for
a raw Buffer byte-scan. ~10x faster on multi-MB jsonls. Still
picks up a dangling final line on hand-edited files.
Also incidentally addresses #1179 — the "click doesn't load" report
was the post-click emitSessions round-trip blocking on every-jsonl
re-read, not the click itself.
Closes#1179
Subdir AGENTS.md / REASONIX.md / AGENT.md has worked since #1033 but
only via read_file. If the agent runs list_directory pkg/foo and then
picks what to read next, the guidance in pkg/foo/AGENTS.md never
surfaces — the picking decision is blind.
Add findDirMemory(absDir, rootDir) that walks the listed dir +
ancestors innermost-first. Wire it into list_directory with the same
once-per-session dedupe as read_file. findSubdirMemoryAncestors stays
as a thin wrapper for read_file. Root REASONIX.md still excluded —
it's already in the system prompt.
7 new tests cover the new walker plus the list_directory integration.
Closes#1160
Replace hardcoded Mac-only keyboard symbols (⌘, ⇧, etc.) with a
platform-aware <Shortcut> component. macOS keeps ⌘ / ⇧; Windows and
Linux render Ctrl, Shift, etc. Platform detection in main.tsx now
recognises Windows in addition to macOS, setting data-platform on
<html>.
Adds desktop/src/ui/shortcut.tsx with:
- Shortcut component for inline kbd rendering
- shortcutText() for plain-text shortcut strings
- localizeShortcutText() to swap ⌘ inside already-translated strings
Updates every hardcoded <kbd> across App, CommandPalette, cards,
composer, jobs-pop, settings, sidebar, statusbar, workdir-pop.
Closes#1095
MCP responses cross a network boundary — TypeScript types are
compile-time only. validateResultShape() now runs at the top of
flattenMcpResult() (the single funnel every MCP result passes through
before reaching the model), and rejects malformed payloads with a
useful error string instead of letting them bubble up as opaque
`.map is not a function` or similar crashes downstream.
Covers: non-object result, missing/non-array content, non-object
block, unknown block type, non-string text, non-string image data,
non-string image mimeType. 8 unit tests in tests/mcp.test.ts cover
every rejection path plus a valid-result passthrough.
A user reported the desktop window went white when opening the right
panel's Tools tab after configuring an MCP server (#1197). With no
error boundary in place, a render error in any panel sub-tree
unmounted the whole React tree.
Add a small PanelErrorBoundary, wrap the context-panel tab body with
it (keyed by tab so switching resets), and harden the $mcp_specs
reducer against malformed payloads. Future render errors now show an
inline message with the actual error string instead of white-screening
the app — the rest of the UI stays usable and the user can copy the
error back to us.
Closes#1197
The desktop client shipped with a purple-gradient "R" placeholder
that didn't match the brand on the docs site or npm page.
Regenerate every platform icon (macOS .icns, Windows .ico, Windows
Store squares, Linux PNG sizes, Android adaptive, iOS app icon set,
master icon.png) from docs/brand/reasonix-logo-square.png via
`tauri icon`, and replace desktop/icons/source.svg so future
regenerations stay consistent.
Closes#1117
The Community section used to carry its own contrib.rocks avatar wall;
the new Acknowledgments section at the bottom now does too. Drop the
upper one, point the Community NOTE callout at the bottom wall, and
upgrade the remaining wall to the wider max=100 / 12-column layout.
Calls out nine contributors selected by both commit count and code
volume, plus separate thanks for the logo designer and the XiaoHongShu
promoter. Listed alphabetically with an explicit "no ordering of
importance" note. Also adds a contrib.rocks avatar mosaic and fixes
the footer link to the canonical esengine/DeepSeek-Reasonix path.
The desktop language switch still left some UI in hardcoded English or
Chinese — context panel tabs, sidebar relative times, status bar
labels, approval / plan / checkpoint cards, markdown copy + open
tooltips, composer footer, and exported markdown summaries.
Route the remaining user-facing strings through the existing
desktop i18n dictionaries and fill matching keys on both sides. The
zh-CN file's `typeof en` constraint locks both halves in sync.
Closes#1192
Bold the Discord nav link and add an IMPORTANT callout right before
the Install section. Drowned out among 7 nav links + 9 badges, the
Discord invite was effectively invisible on first scan; the callout
puts it at the same level as the cache-stability TIP and case-study
NOTE, with the channel layout and contributor-verify hook visible
in the first screen.
When an MCP server in config.json failed to bridge (wrong URL,
network 404, smithery streamable endpoint unreachable, missing auth
header, etc.), the dashboard showed a generic "未桥接 / unbridged" with
a "restart reasonix code" hint that didn't help — the bridge had
already run, errored, and we dropped the reason.
Track the last bridge failure per spec in mcp-runtime, expose it via
runtime.failures(), pipe through /mcp/specs, and render the actual
error reason inline in the dashboard MCP panel.
Adds 3 unit tests for the new failure tracker.
Until now, only busy→idle re-pinned to the bottom. If the user had
scrolled up earlier (un-pinned) and then sent a new message, the new
turn rendered off-screen until the turn completed.
Treat both busy edges the same: turn start = user just acted and
expects to see the new turn; turn end = settle on the final answer.
Closes#1182
Drop the `devtools` Cargo feature so the inspector is compiled out of
release builds entirely; Tauri auto-enables it on debug, so `tauri dev`
is unchanged.
Add a small prod-guard that suppresses the `contextmenu` event in
production via `import.meta.env.DEV`, exempting input / textarea /
contenteditable so native copy-paste still works.
Closes#1187
embedAllOpenAICompat sent ALL texts in a single API call. Providers like
Aliyun Bailian's text-embedding-v4 cap batch size at 10 items/request,
so files with more chunks than the cap got HTTP 400.
Split input into batches of batchSize (default 10) and thread the option
through config types, builder, semantic tool, server API, and the
dashboard form.
The command-palette `about` handler was wired to `flashToast("Reasonix · …")`,
which only flashed the version string for a second. With the new AboutModal
in place, route the palette entry to the same `setAboutOpen(true)` the
sidebar row uses.
Co-authored-by: reasonix <[email protected]>
Add an About entry in the sidebar foot (under 审批规则, above 设置)
that opens a new modal showing:
- App name + tagline.
- Current version, read at build time from desktop/package.json via
Vite's `define` and exposed as the `__APP_VERSION__` ambient
constant.
- Repository link — clicks open https://github.com/esengine/DeepSeek-Reasonix
via @tauri-apps/plugin-opener (already a dep).
- "Check for updates" button — queries the GitHub releases API,
prefers the latest `desktop-v*` tag (per the split-namespace
release scheme in #1153), falls back to bare `v*` if the desktop
track hasn't cut its own tag yet. Surfaces up-to-date / outdated /
failed states inline, and offers a "View releases" link on outdated.
EN + zh-CN strings added under `t("about.*")`.
Refs maintainer request — wire a single click-to-open About panel.
Co-authored-by: reasonix <[email protected]>
Right-clicking a session item in the sidebar opened a delete-confirmation
popover (#906). Users in #1116 hit it accidentally — right-click on a
list item doesn't read as "delete" in any standard desktop UI, and the
popover obscured the item enough that some users perceived the session
as "disappeared". One reporter explicitly asked whether right-click-to-
delete was a bug or intentional.
Remove the right-click hijack and surface deletion via a small X icon
inside each session-item, hidden by default and revealed on
hover / focus-within. Clicking the icon opens the same confirmation
popover anchored to the icon's bounding rect. stopPropagation keeps
the click from also firing the row's onClick (which loads the session).
The popover, its dismiss-on-outside-click + Esc handling, and the
auto-focused Cancel button all stay — only the entry gesture changes.
Closes#1116
Co-authored-by: reasonix <[email protected]>
Adds a Discord invite link to both READMEs (nav row + badge) so users
have a synchronous channel alongside GitHub Discussions.
Wires the CI workflow to post to the #ci-alerts Discord channel on
main-branch push failures only (PR failures stay out of Discord to
avoid noise). Reads the webhook from the DISCORD_CI_WEBHOOK repo
secret; quietly skips when the secret is unset so forks don't break.
Adds a brand asset bundle to docs/brand/ — the whale-in-R mark
contributed by @Bernardxu123 in discussion #1130. Carries the icon
(SVG / PNG / ICO) plus square-logo and wordmark variants, so the same
mark can be reused on the site, GitHub OG image, npm card, and the
Discord server avatar.
docs/logo.svg (the historical wordmark referenced from the READMEs)
stays in place; this commit only adds new files.
Pressing Enter to commit a CJK IME candidate often sends the same
Enter through the terminal as a real keystroke (Microsoft Pinyin,
Sogou, …), and a TTY program has no way to know whether that Enter
was IME commit or "send the message". The chat composer was treating
it as "send" and submitting whatever the user had typed so far.
Watch for non-ASCII input on the keystroke stream and stamp a
timestamp; when a submit action fires within 50ms of that stamp,
drop it instead of calling onSubmit. The window is wide enough to
catch the back-to-back commit-then-Enter the terminal flushes
together and tight enough that a real typed Enter after CJK input
(human key cadence ≥80ms) still sends the message.
Closes#1136
Co-authored-by: reasonix <[email protected]>
The setup wizard's API-key check hit `${baseUrl}/user/balance`, an
endpoint that exists only on DeepSeek's API. Users pointing the
config at any OpenAI-compatible third party (DashScope / Tongyi,
Moonshot, Zhipu, …) got a 404 surfaced as
`暂时无法验证 API key (DeepSeek 404)` even with a valid key — the
config was right, the probe was wrong.
Switch to `${baseUrl}/models`. It's the standard OpenAI-compat
listing endpoint, exists on every provider the client.ts loop
already talks to (`listModels` uses the same path), and 401/403
there still cleanly means "key rejected". Relabel the non-auth
failure message from `DeepSeek <status>` to `HTTP <status>` so the
surfaced error isn't misleading on non-DeepSeek backends.
Add a regression test that pins the probe URL to DashScope's
`compatible-mode/v1` base so a future revert can't quietly
re-DeepSeek-ify the validator.
Closes#1168
Co-authored-by: reasonix <[email protected]>
Each MeasuredCard registers a stdout `resize` listener via Ink's
useBoxMetrics. A long conversation legitimately keeps dozens of
cards mounted at once, so Node's default MaxListeners=10 trips
and prints a spurious "Possible EventEmitter memory leak detected"
warning the moment the user hits the 11th card.
Raise the ceiling to 200 right before render() so normal use stays
quiet while a real leak (one not bounded by card count) would still
surface above the new bar.
Refs #1157
Co-authored-by: reasonix <[email protected]>
The cache loop carried a per-turn TurnFailureTracker that flipped
flash→pro mid-turn after N repair signals (default 3, range
[1,20], configurable via `--escalate-after`, `escalation.failureThreshold`
in config). That heuristic was guess-work — three "search text not
found" or repair-storm hits doesn't reliably mean the model needs
more reasoning power, just that it hit one kind of friction.
Strip the counter entirely and rely on the two escalation paths
that don't rely on a magic number:
- `/pro` arms the next turn manually when the user wants it.
- The model self-escalates via the `<<<NEEDS_PRO>>>` marker when
it actually thinks it needs more headroom — that path stays
intact and is what `autoEscalate` continues to gate.
Removals:
- TurnFailureTracker class + FAILURE_ESCALATION_THRESHOLD constant
- CacheFirstLoop.noteToolFailureSignal + its two call sites
- `failureThreshold` option threaded through CacheFirstLoop /
chat.tsx / code.tsx / run.ts / App.tsx / index.ts
- `--escalate-after` CLI flag (3 commands)
- `escalation.failureThreshold` config field
- `loop.autoEscalation` i18n string (EN + zh-CN + types)
- Nine tests targeting the counter-based path; the marker-path
tests and `escalatedThisTurn` field tests stay.
Behavioral change: a long string of tool failures no longer flips
the model to pro mid-turn. Users who want pro for a hard turn type
`/pro` (one-shot) or `/preset max` (persistent). The model can
still self-escalate.
Co-authored-by: reasonix <[email protected]>
124 comment lines in src/cli/ui/App.tsx carried GBK→UTF-8 mis-decoded
Chinese fragments — some short (`闂?` standing in for an em-dash or arrow
separator), some destroyed Chinese paragraphs.
- Substitute the short `闂?` pattern with `—` (em-dash). For groups of
adjacent corruption that originally encoded arrow keys (`↑/↓`), restore
the arrows so the navigation-key comments read correctly again.
- Rewrite three corrupted JSDoc / inline comments where the Chinese tail
was destroyed; salvage the recoverable English prefix and drop the
unrecoverable bytes.
No code paths touched. typecheck / lint / comment-policy stay green.
Co-authored-by: reasonix <[email protected]>
CacheFirstLoop is rebuilt by App.tsx's useMemo whenever the active
session changes, and its constructor calls `stats.seedCarryover(...)`
with the resumed session's persisted totals. The TUI's `summary` state
was only ever updated at turn-end, so until the user submitted a new
turn the StatusRow kept showing the previous session's cost — or
$0 on a cold start with --resume.
Mirror `loop.stats.summary()` into summary state on every loop
rebuild so the displayed totals follow the active session immediately.
Refs #1143
Co-authored-by: reasonix <[email protected]>
Python MCP SDK servers write info logs (e.g. `INFO server.py:534
Processing request of type ListPromptsRequest`) to stderr. The stdio
transport was inheriting the child's stderr from the reasonix process,
so those lines wrote straight into the TUI's render buffer and stuck
around until a SIGWINCH triggered a full redraw.
Switch the third stdio slot from "inherit" to "pipe" and drain the
child's stderr in onStderr. Forward to our own stderr only under
REASONIX_DEBUG_MCP=1, matching the gating already used for dropped
malformed stdout lines.
Closes#1146
Co-authored-by: reasonix <[email protected]>
Sticky-bottom in useAutoScroll relied on the scroll event listener
to compute isPinned. Scroll events fire for our own scrollTo too,
and a smooth scrollTo keeps dispatching them for 200-500 ms — long
enough to misread "smooth scroll mid-flight" as "user scrolled up"
and freeze the view for the rest of the streaming turn (#1103).
Drop the scroll listener entirely. Un-pin only on real user input
(wheel / touchmove / keydown / pointerdown). ResizeObserver still
follows scrollHeight while pinned. Programmatic scrollTo no longer
has a way to flip isPinnedRef itself.
Closes#1103
Co-authored-by: YHH <[email protected]>
Pushing a CLI tag (`vX.Y.Z`) just triggered the desktop Tauri bundle
matrix — `release.yml` listened on `tags: ["v*"]`, same namespace the
npm CLI uses. Decouple them so each release surface owns its own
tag prefix.
- `release.yml` (desktop): trigger flips to `tags: ["desktop-v*"]`,
workflow_dispatch description updated; future desktop bumps are
`git tag desktop-vX.Y.Z`.
- `publish-npm.yml` (new): triggers on `tags: ["v*"]`, runs
`npm publish` against the matching tag. Verifies the tag's version
segment matches `package.json` before publishing so a forgotten
bump fails clean instead of as an opaque npm 403.
- `sync-desktop-version.mjs`: strip both `^v` and `^desktop-v` prefixes
so the desktop workflow's new tag shape flows through to
tauri.conf.json / Cargo.toml / desktop/package.json unchanged.
Net effect: npm publish stops being a manual local step (no more risk
of forgetting `npm run verify` first), and CLI tags can never again
spawn a stray desktop bundle.
Co-authored-by: reasonix <[email protected]>
* chore(chat): default to Ink — remove rust integration hooks
Drop the rust renderer setup branch in chat.tsx: warning print, stderr-
to-log redirect, null stdin/stdout, scene/trace handler wiring, the
approval/composer/mode/preset/setup-submit refs. Ink runs as the only
TUI path; render() loses the rust-vs-node ternaries.
First step of removing the rust renderer entirely — App.tsx still owns
the (now-orphan) ref effects, scene modules and crate still on disk.
* chore(ui): drop scene-driven picker bridges + integrated handlers
App.tsx loses the five isIntegratedRendererRequested() picker effects
(sessions / theme / checkpoint / model / mcp hub) — Ink modals already
handle those states without the rust bridge. Strip useSceneTrace, all
*Json memo inputs that only fed it, sceneApproval, prompt-input /
list-picker subscribe stores, and the approvalDispatchRef / rustComposer
/ modeSet / presetSet effects.
use-qq-channel.ts drops the rust prompt-overlay branch in promptLine —
readline is the only path; the `{ secret: true }` option goes with it
(no terminal-side echo masking either way under Node readline).
* chore(ui): delete scene/ directory + useSceneTrace hook + tests
Drop the rust-renderer integration surface: scene/renderer.ts (NAPI
loader), scene/trace.ts (snapshot bridge), scene/{null-stdin,null-stdout,
input-adapter}.ts (Ink-side stubs when rust owned the TTY), scene/{prompt-input,
list-picker}-store.ts (cross-process picker dispatch), hooks/useSceneTrace.ts
(scene-frame emitter), and the three companion test files.
Setup.tsx loses its submitRef forwarding too — Node's MaskedInput is the
only key source now.
* chore(rust): delete crates/, subpackages/, build scripts, release workflow
Pure tree deletion: crates/reasonix-render/ (rust ratatui sources + napi
glue), subpackages/render-*/ (the five empty per-platform optional-dep
packages — the .node binaries were CI artifacts, never committed),
scripts/dev-prepare.mjs (cargo build wrapper), scripts/sync-render-versions.mjs
(subpackage version pin syncer), .github/workflows/release-render.yml
(napi-rs CI matrix), and the matching .gitignore entries.
Cargo.toml + Cargo.lock at repo root go too — no rust code remains.
* chore(pkg): strip optionalDependencies + rust build scripts
Drop the five @reasonix/render-{platform}-{arch} optional deps (subpackages
are gone), the rust:build / render:versions:* / dev:prepare npm scripts
(scripts gone), and the corresponding render-version guards in verify /
prepublishOnly. npm install on every supported platform now resolves to the
same minimal dep tree — no platform-specific .node fetch step.
* feat(tui): pure-Ink rebuild — drop renderer patches, simplify cards
Now that the rust renderer is gone, the workarounds we layered on top
of Ink for it (or in defense against its quirks) are unmotivated dead
weight. Clear them out in one pass and adopt a single consistent glyph
vocabulary across the card vocabulary.
Renderer config:
- chat.tsx render() drops `patchConsole: false`, `incrementalRendering:
false`, `alternateScreen` toggle — Ink defaults take over
- `--no-alt-screen` / `--no-mouse` CLI flags + altScreen / mouse
ChatOptions removed; useTerminalSetup hook (hand-rolled DECSET 2004 /
>4;2 / 1007 ANSI sequences) deleted
- useCursorBlink + its issue-#728 active-guard removed; cursor stays
statically visible (no half-blink ghosting on the slow side)
Card chrome:
- Card primitive drops the left stripe + border config; settled
vs active is now identical, just a column box with a top margin
- CardHeader drops titleBg / titleColor pill background; titles
are plain bold tone-colored text
- All card / LiveRows / Setup callers stripped of pill props
Glyph vocabulary (consistent across every card):
- running / active ●
- completed ✓
- failed / error ✗
- aborted ⊘
- queued / pending ○
- warning ⚠
- child row ⎿
- progress bars █ / ░
- spinner braille
Layout:
- PromptInput wrapped in borderStyle="round" — rounded composer box
- ComposerArea reorders: suggestions → composer → loop status →
ModeStatusBar → StatusRow (bottom)
- StatusRow outer row flips to flexWrap="wrap", drops height=1; on
narrow terminals pills wrap to a new line instead of truncating
- Leading horizontal rule above StatusRow removed (it's at the bottom now)
Discoverability hints (info rows surfaced on startup):
- /dashboard once the embedded server URL is ready
- /copy permanently in startupInfoHints
Residual rust mentions cleaned: --node CLI flag, useInputRecall +
keystroke-context comments, REASONIX_RENDERER plumbing in the
chat-mcp startup-summary test.
* chore(release): 0.46.0 — Rust TUI removed, pure-Ink rebuild
CLI npm package only — the desktop Tauri client banner stays at its
own version on the download page. README drops the "Terminal renderer
(Rust by default)" section that pointed at the now-removed
optionalDependencies + REASONIX_RENDER_BIN path.
CHANGELOG 0.46.0 entry covers the rust-renderer removal, the env vars
that became no-ops, and the TUI overhaul that landed in the same arc
(rounded composer, bottom status row, /dashboard + /copy hints,
narrow-terminal pill wrapping).
* ci: drop rust job (rustfmt / clippy / cargo test) — crate is gone
---------
Co-authored-by: reasonix <[email protected]>
* fix(chat): rust TUI input — setup capture, paste burst, Ctrl+V
- Setup: rust now owns the keystroke buffer while setup_pending is
Some. Previously every event was dropped via `continue`, so Ink's
MaskedInput (which receives a null keystroke reader in integrated
mode) sat on a screen that ate every keypress — Windows users (and
any Mac user after the rc.2 eager-spawn change) couldn't enter
their API key. Buffer is forwarded to Setup.handleSubmit via a new
`setup-submit` event and a submitRef on the Setup component.
- Composer paste: track last_key_at and treat an Enter that arrives
within 15ms of the previous key as paste-as-keystrokes, inserting
'\n' literally instead of submitting. Bracketed paste is the happy
path, but Apple Terminal (macOS default) and cmd.exe pre-ConPTY
don't speak it, so multi-line pastes used to submit on the first
'\n'. The same guard short-circuits Enter inside prompt_input
(single-line, can't accept '\n') so paste bursts don't submit
half-pasted answers.
- Ctrl+V: explicit clipboard paste via arboard::get_text in both
composer and prompt_input. The only working paste path when
bracketed paste is unavailable.
* fix(test): normalize tmp cwd via realpath on macOS
mkdtemp in /var/folders/... but process.cwd() after chdir resolves
to /private/var/folders/...; the spy compared the unresolved tmp
path against the resolved one and bare-routing tests failed on
every Mac. Resolve at setup so the assertion sees one path.
* chore(release): 0.45.1
* chore: rustfmt + sync package-lock.json to 0.45.1
- rustfmt: one-line match arm in integrated.rs (CI fmt --check fixed it)
- package-lock.json: regenerate so optional-deps resolve to 0.45.1 instead
of the stale 0.44.2-rc.4 lock that was blocking `npm ci` on main
---------
Co-authored-by: yhh <[email protected]>
Co-authored-by: reasonix <[email protected]>
When `buildMessages` heals dangling assistant `tool_calls` before a request, also persist the healed log: `log.compactInPlace(healed.messages)` updates the in-memory state and `rewriteSession()` flushes it to the JSONL on disk (now crash-safe via the `.jsonl.bak` sidecar from #1101). The disk write is wrapped in try/catch — a FS failure shouldn't block the in-memory heal.
Before this, send-time healing scrubbed the outgoing request but the JSONL stayed poisoned, so the next process restart reloaded the bad state and the user got "session can't send" symptoms forever.
Refs #1079.
Replace the in-place `writeFileSync` in `rewriteSession` with: write to a sibling `*.tmp` file, snapshot the previous live transcript to `<path>.jsonl.bak`, then atomically `renameSync` the tmp into place. On error the tmp is unlinked and the error rethrown.
`loadSessionMessages` falls back to the `.bak` sidecar only when the live file has content but no valid entries — an intentionally empty live file is preserved.
`renameSession` / `deleteSession` / `archiveSession` carry the `.jsonl.bak` recovery sidecar so orphaned backups can't accumulate.
Refs #1079.
Move the scroll-history hint into an i18n-backed `InputAreaWithHistoryHint` component (`app.historyScrollHint`), and replace remaining GBK-as-UTF-8 mojibake literals (`闂?`, `濠电姷…`) in `App.tsx` with the intended ASCII separators / wording.
Adds `tests/app-visible-mojibake.test.ts` to scan source for the mojibake byte sequences so the corruption can't recur.
Closes#1082.
Extract two visual regions from `App.tsx` per #565 Phase 2:
- `LiveActivityArea` — OngoingTool, SubagentLiveStack, ThinkingRow, UndoBanner, PlanLiveRow, ToastRail
- `ComposerArea` — ModeStatusBar, LoopStatusRow, StatusRow, PromptInput, SlashSuggestions, AtMentionSuggestions, SlashArgPicker, HistoryHint
`React.memo` on both for render isolation once Phase 3 lands.
`Parameters<typeof UndoBanner>[0]['banner']` derives the undoBanner prop type from the source component, avoiding transitive imports.
Real types throughout — `EditMode`, `JobRegistry`, `Parameters<typeof LoopStatusRow>`, `SlashArgPickerProps`.
Closes#565 Phase 2.
* feat(render): in-process NAPI addon (0.45.0-rc.0)
Replaces the spawn-child + stdio/socket IPC architecture with a
native Node addon. The rust ratatui loop now runs on a std::thread
inside the Node process; scene state goes through emit() (mpsc) and
events come back via ThreadsafeFunction.
Why: the two-process model raced Ink's null-stdio composition with
rust's TTY takeover on macOS — stdin pipe closed before the seed
scene frame landed, rust hit `if stdin_closed && !have_state` and
exited at 120ms. rc.1-rc.4 patched symptoms; this rip-out removes
the structural cause. Distribution also simplifies (.node per
triple, no chmod +x, no optional-dep resolver, no UDS/named-pipe).
Also: kills the caret-blink-driven sync-update bursts every 480ms
that overwrote Windows Terminal's IME composition overlay and
produced flicker while typing CJK. Idle scenes are now flicker-free;
needs_animation gates on scene.busy.
Drops: scene_socket.rs, renderer-process.ts, renderer-resolver.ts,
input-source.ts, createRustKeystrokeReader, smoke-rust.ps1, all
REASONIX_RENDER_CMD / REASONIX_INPUT_CMD / REASONIX_SCENE_SOCK
env vars, the rust child's --integrated CLI mode, the keep-alive
setInterval, optional-dep binary resolver fallback.
Release workflow rebuilt for napi: cargo build --lib produces a
cdylib, staged as reasonix-render.<triple>.node into each subpackage.
* style(render): rustfmt
* fix(render): gate napi behind a feature so cargo test links
Without the feature, the rlib doesn't pull in `napi-*` runtime symbols
(`napi_create_reference`, `napi_call_function`, …), which the linker
can't resolve when building the standalone `reasonix-render` bin or
the integration tests under tests/ — those don't run inside Node, so
no host provides the N-API symbol table. CI's `cargo test` step on
ubuntu was failing with rust-lld undefined-symbol errors as a result.
Default features stay empty. Release CI + `npm run dev:prepare` pass
\`--features napi\` when building the cdylib that Node loads.
---------
Co-authored-by: reasonix <[email protected]>
rc.3 diagnostics confirmed: rust integrated child exits in ~118ms with
code=0 signal=null and no stderr output. Single explanation: the rust
integrated loop's early-exit branch
if stdin_closed && !have_state { return Ok(()) }
fires because Node never wrote any scene state to the child stdin pipe
before something closed it (likely Ink unmount cascade on macOS).
Fix: ensureSceneTraceReady() now writes an empty trace frame ('{type:"trace"}')
immediately after spawn. Rust decodes it as a default SceneState,
flips have_state=true, and the early-exit branch no longer triggers
even if Node's pipe later closes. Rust will keep running on its
inherited stdout + own /dev/tty input.
Subsequent React-driven state updates (when useSceneTrace's effect
fires, on platforms where it does) overwrite the seed frame normally.
Co-authored-by: reasonix <[email protected]>
rc.2 made the mac symptom flip from 'hang' to 'exit immediately' — but
~/.reasonix/rust-render-stderr.log still empty, so we have no signal
on what actually killed the rust child. Three diagnostic improvements
to make rc.3 land actionable info:
1. trace.ts: emit [trace] resolver source+command + spawn-start line
before spawning. Confirms which binary was picked.
2. renderer-process.ts: log [spawnRenderer] child exit code/signal/aliveMs.
Distinguishes startup crash (aliveMs<1s) from clean exit.
3. renderer-process.ts: log non-JSON child stderr lines (rust panics /
crossterm errors / debug output) as [rust-stderr] ... Previously
silently dropped — exactly the path that left rc.1/rc.2 undebuggable.
Also: don't synthesize an 'exit' event back to the integrated handler
when the child dies within 1.5s of spawn. Sub-second deaths are almost
always startup crashes; letting Node cascade into process.exit hides
the real cause. Hold Node alive so the user can read the log.
Co-authored-by: reasonix <[email protected]>
rc.1's keep-alive interval prevented Node from exiting, but the rust
child was never actually spawned — on macOS, the React useEffect in
useSceneTrace that normally triggers emitSceneMessage → trace.ts
ensureInitialized() → spawnRenderer() simply never fired in some npx
contexts. Result: Node held the event loop open via keep-alive,
nothing rendered, user saw 'hung'.
Three layered fixes:
1. trace.ts exports ensureSceneTraceReady() — chat.tsx calls it right
after setIntegratedEventHandler so spawn happens eagerly, before
Ink mounts. No more React-effect-timing dependency.
2. renderer-process.ts synthesizes an {event:'exit'} when the rust
child dies on its own (panic / SIGKILL / terminal close) so the
integrated handler can tear Node down. Previously Node's keep-alive
would hang forever waiting for a dead child.
3. trace.ts logs to stderr when resolveRenderer returns no usable
command instead of bailing silently — anyone hitting 'TUI never
appears' can grep ~/.reasonix/rust-render-stderr.log for the
reason.
Co-authored-by: reasonix <[email protected]>
macOS reproducer: `npx reasonix code` (default = rust + integrated TUI)
prints the startup info line then immediately exits back to shell, no
TUI ever renders. Rust binary runs fine standalone; Ink runs fine when
forced via REASONIX_RENDERER=node. The breakage is at the seam between
the two.
Root cause: makeNullStdin / makeNullStdout are pure-JS Node streams
with no underlying libuv handles. The rust trace child is spawned by a
React useEffect (useSceneTrace → emitSceneMessage), enqueued
microseconds AFTER render() returns. On macOS the event loop sees no
active handles in that window and exits before the effect runs. Linux
and Windows happen to keep the loop alive via other handles in the
boot path (timers from MCP runtime / proxy init / etc.); macOS
doesn't.
Defensive setInterval(()=>{}, 0x7fffffff) keep-alive held for the
lifetime of waitUntilExit() and cleared in finally. RC bump to
0.44.2-rc.1 for Mac smoke before promoting to stable; no other code
changes — same renderer binary as 0.44.0.
2026-05-17 19:42:45 +08:00
1030 changed files with 121327 additions and 42543 deletions
<a href="https://oosmetrics.com/repo/esengine/reasonix"><img src="https://api.oosmetrics.com/api/v1/badge/achievement/9e931d80-2050-4b10-902e-44970cc133ad.svg" alt="oosmetrics — Top 2 in Agents by velocity"/></a>
<a href="https://oosmetrics.com/repo/esengine/reasonix"><img src="https://api.oosmetrics.com/api/v1/badge/achievement/556d94b3-61b7-486b-baf2-888b9327deab.svg" alt="oosmetrics — Top 3 in LLMs by velocity"/></a>
<a href="https://oosmetrics.com/repo/esengine/reasonix"><img src="https://api.oosmetrics.com/api/v1/badge/achievement/0f457d4c-efca-4d15-ad2b-139691ff342c.svg" alt="oosmetrics — Top 3 in CLI by velocity"/></a>
</p>
<br/>
<h3 align="center">ターミナルで動く DeepSeek ネイティブの AI コーディングエージェント。</h3>
<img src="docs/assets/hero-terminal.svg" alt="Reasonix code mode — assistant proposes a SEARCH/REPLACE edit; nothing on disk until /apply" width="860"/>
> **This is the legacy TypeScript line (Reasonix 0.x), in maintenance mode.**
> Active development moved to the **Go rewrite** — see the [`main-v2`](https://github.com/esengine/DeepSeek-Reasonix/tree/main-v2) branch (the new default) and the [migration guide](https://github.com/esengine/DeepSeek-Reasonix/blob/main-v2/docs/MIGRATING.md). Only bug fixes land here.
> **Real user, single day (2026-05-01):** 435M input tokens, **99.82% cache hit**, ~$12 instead of the ~$61 the same workload would cost with no cache on `v4-flash` — see the [case study](./benchmarks/real-world-cache/README.md). DeepSeek provides the cacheable bytes; the four mechanisms in [Pillar 1](./docs/ARCHITECTURE.md#pillar-1--cache-first-loop) are how Reasonix keeps them cacheable across long sessions.
> [!IMPORTANT]
> **Community · 加入社区** — bilingual Discord with channels for setup help (`#help` / `#求助`), workflow showcases, feature ideas, and contributor-only PR coordination. Verify your GitHub in-server to get the **Contributor** role automatically. → **<https://discord.gg/XF78rEME2D>**
<br/>
## Install
@@ -76,6 +90,15 @@ Grab a [DeepSeek API key →](https://platform.deepseek.com/api_keys) · `reason
If you use Reasonix daily, global install is the simplest path. If you just want to try it, use `npx`.
**Prefer fewer keystrokes?** The shorter `dsnix` alias resolves to the same CLI:
~~~bash
npm install -g dsnix # exposes `dsnix` on PATH, depends on reasonix
npx dsnix@latest code # one-shot via the shorter command
~~~
A global `npm install -g reasonix` also drops a `dsnix` shim on PATH, so the two are interchangeable.
Bare `reasonix` (no subcommand) launches `code` in the current directory — typing `reasonix` and `reasonix code` are equivalent.
| Command | When |
@@ -86,43 +109,19 @@ Bare `reasonix` (no subcommand) launches `code` in the current directory — typ
| `reasonix doctor` | Health check: Node, API key, MCP wiring. |
| `reasonix update` | Upgrade Reasonix itself. |
### Terminal renderer (Rust by default)
Since 0.44.0, Reasonix ships a native ratatui renderer (`reasonix-render`) as the default TUI. `npm install` resolves one of five pre-built `@reasonix/render-{platform}-{arch}` sub-packages via `optionalDependencies` so install is zero-config on **win32-x64 · linux-x64 · linux-arm64 · darwin-x64 · darwin-arm64**. No cargo, no toolchain, nothing extra to fetch.
- Want the old Ink/Node TUI back? Pass `--node` to any subcommand (`reasonix --node`, `reasonix code --node`, `reasonix chat --node`) or set `REASONIX_RENDERER=node` in your shell.
- Running on a platform without a published sub-package (Linux musl, FreeBSD, ARM v7, etc.)? Reasonix prints a one-line warning and auto-falls-back to the Ink renderer — nothing breaks.
- Building rust from source? `cargo build --release --bin reasonix-render` inside the repo; the dev flow (`npm run dev`) does this automatically. The resolver also accepts `REASONIX_RENDER_BIN=/path/to/binary` to pin a specific build for testing.
Other subcommands (`replay` · `diff` · `events` · `stats` · `index` · `mcp` · `prune-sessions`) are in `reasonix --help` and the [CLI reference](https://esengine.github.io/DeepSeek-Reasonix/#cli).
### QQ channel
Reasonix can attach QQ as a remote communication channel for existing `chat` and`code` sessions. It is not a separate runtime mode.
QQ can extend an existing `chat`,`code`, or desktop session as a remote channel. It is part of the current session flow, not a separate runtime mode.
Start a session first:
- CLI: start a session, then run `/qq connect`
- Desktop: open `Settings -> General -> QQ Channel`
~~~bash
reasonix code
# or
reasonix chat
~~~
Once connected, QQ messages can enter the current session, assistant replies route back to QQ, and follow-up interactions can continue remotely.
Then connect QQ from inside the session:
For full setup, desktop quick start, and troubleshooting, see [QQ channel setup](./docs/qq-connect.md).
~~~text
/qq connect
~~~
Available commands:
-`/qq connect`
-`/qq status`
-`/qq disconnect`
Once enabled, later `chat` / `code` sessions auto-start the QQ channel. Slash commands, confirmation prompts, and follow-up assistant replies can continue through QQ without terminal-side input.
See [QQ channel setup](./docs/qq-connect.md) for setup details and QQ Open Platform bot registration.
### Desktop client (prerelease)
A native Tauri client for users who want a GUI over the same loop. Multi-tab, the right-panel shows files the agent has read or edited this session, the same cost / cache / token meters live at the bottom. Same DeepSeek API key, same `~/.reasonix` config — the desktop bundles its own Node runtime, no separate `npm install` step.
/skill new my-skill --global # ~/.reasonix/skills for cross-project use
~~~
**Claude-format skills also load.**`<project>/.claude/skills/<name>/SKILL.md` and `~/.claude/skills/` are read alongside Reasonix's native paths, so tooling that emits Claude-format skills works out of the box. Example — drop OpenSpec workflows in without an upstream adapter:
~~~bash
npx openspec init --tools claude # writes .claude/skills/openspec-*/SKILL.md
/skill openspec-propose <task> # then invoke from Reasonix
~~~
</details>
<br/>
@@ -181,7 +187,7 @@ One JSON file at `~/.reasonix/config.json` plus per-project overrides under `<pr
| [Memory](https://esengine.github.io/DeepSeek-Reasonix/configuration.html#memory) | User-private knowledge pinned into the prefix. `user` / `feedback` / `project` / `reference` types. |
| [Web search](https://esengine.github.io/DeepSeek-Reasonix/configuration.html#search) | Mojeek by default; switch to self-hosted SearXNG or Metaso with `/search-engine`. |
| [Web search](https://esengine.github.io/DeepSeek-Reasonix/configuration.html#search) | Bing by default; switch to Baidu AI Search, self-hosted SearXNG, Metaso, Tavily, Perplexity, Exa, Brave, or Ollama with `/search-engine`. |
| [Semantic index](https://esengine.github.io/DeepSeek-Reasonix/configuration.html#index) | `reasonix index` — local Ollama or any OpenAI-compatible embedding endpoint. |
<br/>
@@ -218,7 +224,7 @@ Click through to the full architecture writeup → [Pillar 1 — Cache-first loo
| Web search (Bing + Baidu + SearXNG + API engines) | yes | yes | yes | yes |
| Open community development | yes | — | — | yes |
For live cache-hit rates, costs, and methodology, see [`benchmarks/`](./benchmarks/) — the numbers move with model pricing, so they live with the harness, not in the README.
@@ -229,7 +235,7 @@ For live cache-hit rates, costs, and methodology, see [`benchmarks/`](./benchmar
- [**Architecture**](./docs/ARCHITECTURE.md) — three pillars: cache-first loop, tool-call repair, cost control
- [**CLI Reference**](./docs/CLI-REFERENCE.md) — every shell subcommand, every slash command, every keybinding
- [**QQ channel setup**](./docs/qq-connect.md) — what it is, commands, setup flow, and QQ Open Platform credentials
- [**QQ channel setup**](./docs/qq-connect.md) — CLI first-connect flow, desktop entry, and QQ Open Platform credentials
@@ -240,7 +246,7 @@ For live cache-hit rates, costs, and methodology, see [`benchmarks/`](./benchmar
## Community
> [!NOTE]
> Reasonix is open source and community-developed. The contributors wall below isn't decoration — every avatar is a real PR that shipped.
> Reasonix is open source and community-developed. Every avatar in the Acknowledgments wall at the bottom of this file is a real PR that shipped.
Scoped starter tickets — each with background, code pointers, acceptance criteria, and hints — live under the [`good first issue`](https://github.com/esengine/reasonix/labels/good%20first%20issue) label. Pick anything open.
@@ -260,12 +266,6 @@ Scoped starter tickets — each with background, code pointers, acceptance crite
**Before your first PR**: read [`CONTRIBUTING.md`](./CONTRIBUTING.md) — short, strict rules (comments, errors, libraries-over-hand-rolled). `tests/comment-policy.test.ts` enforces the comment ones; `npm run verify` is the pre-push gate. By participating you agree to the [Code of Conduct](./CODE_OF_CONDUCT.md). Security issues → [SECURITY.md](./SECURITY.md).
<img src="https://contrib.rocks/image?repo=esengine/DeepSeek-Reasonix&max=100&columns=12" alt="Contributors to esengine/DeepSeek-Reasonix" width="860"/>
</a>
</p>
<br/>
## Non-goals
@@ -292,12 +292,52 @@ Scoped starter tickets — each with background, code pointers, acceptance crite
<br/>
## Support
If Reasonix has been useful and you'd like to say thanks, you can. It stays a coffee, not a contract — donations don't buy feature priority or change how issues get triaged.
name:"Context fold preserves pinned constraints from system prompt",
category:"context",
requiresApi: false,
run:()=>
withTiming(async()=>{
constsystemPrompt=`You are a coding assistant.
# HIGH PRIORITY constraints
- DO NOT use npm install without asking.
- Never delete files without confirmation.
# User memory
The user prefers TypeScript over JavaScript.
# Project memory
This project uses pnpm instead of npm.`;
constlog=newAppendOnlyLog();
// Fill log with synthetic long history to trigger a fold boundary > 0.
for(leti=0;i<40;i++){
log.append({
role:"user",
content:`Turn ${i}: Please review the codebase and tell me what you found.`,
});
log.append({
role:"assistant",
content:`Turn ${i} summary: I reviewed the codebase and found several issues including unused imports, missing type annotations, and inconsistent formatting.`,
});
}
constclient=newMockDeepSeekClient("Summary of all prior turns.");
conststats=newSessionStats();
constctx=newContextManager({
client: clientasany,
log,
stats,
sessionName: null,
getAbortSignal:()=>newAbortController().signal,
getCurrentTurn:()=>1,
getSystemPrompt:()=>systemPrompt,
});
// Use a tiny tail budget so almost everything becomes head and gets summarized.
/// Char-boundary-safe case-insensitive substring split. Returns (before, mid, after) byte slices of `label` where `mid` is the matched range. Avoids byte indexing into `label.to_lowercase()` whose char-boundary mapping is not preserved across casefolding.
editGateTitle:"edit gate — Shift+Tab cycles in TUI",
editReviewTitle:"review — both edits and non-allowlisted shell ask first",
editAutoTitle:"auto — edits auto-apply, shell still asks",
@@ -304,6 +558,16 @@ export const en = {
loadingTranscript:"loading transcript…",
emptyTranscript:"empty transcript.",
messages:"{count} message{s}",
newBtn:"New session",
newHint:"Archive the current conversation and start a fresh one",
switchBtn:"Switch to this session",
deleteBtn:"Delete",
deleteConfirm:"Delete session \"{name}\"? This removes the transcript file and cannot be undone.",
cantDeleteActive:"Switch to a different session before deleting this one.",
attachRequired:
"Live session operations need an attached CLI session. Launch via reasonix chat or open the dashboard from inside a TUI session.",
activeChip:"active",
activePill:"active",
},
tools:{
loading:"loading tools…",
@@ -431,6 +695,10 @@ export const en = {
whyUnbridgedDesc:
"This spec lives in your config.json but isn't bridged into the live session. MCP servers attach when reasonix code starts; the dashboard alone can't spawn the child process.",
whyUnbridgedHint:"To activate: restart reasonix code, then refresh this dashboard.",
bridgeFailed:"Bridge failed",
bridgeFailedTitle:"bridge failed · in config",
bridgeFailedHint:
"Reasonix tried to bridge this server and the attempt errored. Common causes: wrong URL, missing auth header, upstream 404/5xx, missing local command. Fix and restart reasonix code to retry.",
pickHint:"Pick an MCP server on the left to inspect tools / resources / prompts.",
toolsTitle:"Tools · {count}",
resourcesTitle:"Resources · {count}",
@@ -614,6 +882,7 @@ export const en = {
customRequestBodyMustBeObject:"Custom request body must be a JSON object.",
saveBeforeIndex:"Save semantic settings before starting an index.",
extraBody:"extra body",
batchSize:"batch size",
keepExistingKey:"leave blank to keep existing key",
remoteProvider:"Remote embedding provider",
remoteProviderDesc:
@@ -679,6 +948,12 @@ export const en = {
shellBgTitle:"background process",
shellSubtitle:"model wants to run a shell command",
shellBgSubtitle:"long-running — keeps running after approval",
/** Browser extensions (userscripts, ad blockers) inject scripts that throw into our window. Their errors land in the global handlers as if they were ours — see #818. Filter them by origin. */
if(ext==="md")return"# Example Document\n\nThis is a sample markdown file.\n\n## Section\n\n- Item 1\n- Item 2\n\n```js\nconsole.log(\"hello\");\n```";
Loaded 100 of 1030 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.